{ "Event": { "published": true, "date": "2023-12-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-01", "timestamp": 1701475382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2a1af41d-9736-4aba-ae0f-c1cceba2b877", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c000d56-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454825, "uuid": "976ea4ed-ea34-41f1-95a1-99878c2d23d0", "comment": "Malware payload", "value": "ed496ba1017687098c569fb0583fce20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454825, "uuid": "80ab94c2-a008-4cab-8052-c976c1cb6116", "comment": "Malware payload", "value": "008cd711ea3cdccc3d5db93c6eee76dd63bb9252f0fc6f81ea041c9a15848c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454825, "uuid": "a333bfdd-ecce-4c30-8d05-80e34b25e527", "comment": "Malware payload", "value": "9117ef786cd80be1a4325c2e36c57349de9dc09d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454825, "uuid": "be74e7d5-ce11-428f-ab55-79ac3c066753", "comment": "Malware payload", "value": "7f3f59bb30735ccaed39b77960cc583ef05181131a6a15de7ed78b4cfd751197b6e24b60661aff7cd4b5c1db436a285a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454825, "uuid": "01fbdc0a-27f9-4821-ab54-e7db0c8816a2", "value": "T124358D46F5D781B5E366213005E3B7399E7995430A30BBCB32E9DB6C4F32E516A3B221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454825, "uuid": "16882ed0-3a30-4318-92ee-1ec0ee57a374", "value": "12288:IbvpYcWFWLWWB4kuY2FO1rHEmY/8VePxnEP4T7+xZ:IbvecmWqWBUY2FWze5EP4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454825, "uuid": "5fb3c891-1391-4162-b84f-3950c4e15fcd", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454825, "uuid": "94a904c9-aec3-458e-9eb3-f85f647985fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454825, "uuid": "f3c2acfd-d79b-4cbd-bed5-bf2209e8c838", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.19300.28148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334eb174-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442328, "uuid": "e051d6ae-aa03-49c8-9016-28d9607e44ba", "comment": "Malware payload", "value": "c6c614f147d72c02a3976e9b170aa3c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442328, "uuid": "a42c40ea-e34e-4e38-b199-d800fe8a2360", "comment": "Malware payload", "value": "00e1f9f1b7ba2d8ea16485a4425d0726e8ae79d0d5d258cfce1a626841ea714f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442328, "uuid": "15b47d38-88c1-4486-90dd-31c4dc388e43", "comment": "Malware payload", "value": "06be45a9b39a7bd233a2a5d6a5e561a72d66c141", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442328, "uuid": "12351573-1d56-4325-b6f9-fcf02d257e32", "comment": "Malware payload", "value": "88845fc7327f6da73d8aa0848a599dd3b7257f236aee47f25ee7bca52dfb5962a6bd83065940b0916684ab4b9361fd64", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442328, "uuid": "400bd7c4-8fe8-4fc1-a301-7b6b8a2d52d3", "value": "T190560175731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442328, "uuid": "aad2fa76-8589-4119-8892-c289e6afb8ab", "value": "196608:/zDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYhF:/irUVis8O/0giAZ9PDVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442328, "uuid": "871c8f82-d09e-4b49-9c5b-d67b137d7bf0", "value": 6384570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442328, "uuid": "a5554c8f-28c5-48b5-be49-e86642968267", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442328, "uuid": "76ffd681-3a4c-4adf-8ed6-7a59b42c97af", "value": "\u0413\u043e\u043b\u044b\u0435 \u0444\u043e\u0442\u043e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaff19e-9024-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701419875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419875, "uuid": "84ebea58-bdee-4a37-acae-cbc16c976194", "comment": "Malware payload (AgentTesla)", "value": "05e7f056cc047a522cc2f1593a7f1c4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419875, "uuid": "fd728e46-d13b-4931-aeca-bf3cfd58c735", "comment": "Malware payload (AgentTesla)", "value": "021dde3d8e8f0c8fa2fec8760b0f6e29d85bf2beb3a9c49902f20fc4ed462002", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419875, "uuid": "c905e40e-5f24-4106-ae63-27f70968d2b2", "comment": "Malware payload (AgentTesla)", "value": "2129143fea7010a8cf120629da20f4e8e8ffeada", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419875, "uuid": "e5450c62-5194-469c-8a34-ab0705f7eca7", "comment": "Malware payload (AgentTesla)", "value": "073f67cf21165063a205f614724abed22c5559bfd65ab810792a7dbeb4a1fdaac41a56e0b8f554b735da76b582401c81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419875, "uuid": "73b7394c-6f72-45b7-b3df-250ca94c47d2", "value": "T1DCF4E024E1F91B62C5FE93F2044556140BF638AAB57EF32E4DD9A0EE2765F004A42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419875, "uuid": "2587eff8-809c-4215-a89f-488dd9d670f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419875, "uuid": "9e518b35-89fb-48c4-bfb6-1ebfa94d69f9", "value": "12288:T0dII+Ld/YsbZ2MenfeVNrBfpz4dkyYm+Cv+73qTtW:T0C9YCKeVNrBfpQkLmzO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701419875, "uuid": "e6daa43a-cee2-4ced-b3b7-546db2890b63", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701419875, "uuid": "6b1dd501-7737-45fe-95db-1246d45450f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419875, "uuid": "e588e122-990f-49e4-9ac6-a870d725e2e0", "value": "SecuriteInfo.com.Win32.PWSX-gen.11933.26356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba9d403-9012-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701412143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412143, "uuid": "3e9ccb9c-afe2-4f22-b971-395a2d05bdc1", "comment": "Malware payload", "value": "0844bff0cc66563711e5ba12d00eb26c", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412143, "uuid": "08434629-2761-44bf-ad9b-dbde315bcedb", "comment": "Malware payload", "value": "02202875e638c4314b95987732ab0c4b9bb4c4e0aba47b762c9664e2f6370708", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412143, "uuid": "20363295-8cd3-4587-b236-927ea4e116f4", "comment": "Malware payload", "value": "bdb13bccbcc6c393dca5008f19df331e0b8aec32", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412143, "uuid": "30537fe2-ef79-4271-a051-7c9b33ba56a5", "comment": "Malware payload", "value": "ca336b4c33026f584ef6fffb7a1b60787436d117da58ced86884947a5ed58ca92d653af6fea445e1fd199cc89236d54b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412143, "uuid": "e88f4f87-21e6-484e-91f5-9d13ff43196b", "value": "T1BB55F0039804DB93D50D83F9BE434AE91F1A6F19E88569DF10A67FCF3E31A620D9A11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412143, "uuid": "98bf4cbb-50a0-45d8-9e91-3ee7063061e7", "value": "24576:uw6/UZy5Cfg8WV2w6/XZyyCfg8WRwnIK8XoO04TQx/jD6Jn1Huwbg:56/Gw/76/ph/xwIVZzTWXIn1Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412143, "uuid": "dd5bd346-a1fa-44c3-80ea-669461b660f8", "value": 1334784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412143, "uuid": "b627eb1e-63f9-45b8-a6cf-08c99165f9e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412143, "uuid": "686f93a3-1284-4c09-9661-f8647e395317", "value": "payment swift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0988dccb-9029-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701421642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421642, "uuid": "776ad6ea-f6cb-4a91-bfbe-1ea0d906eb70", "comment": "Malware payload", "value": "08efe8c1385e8f77a510aced92392afb", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421642, "uuid": "4153a7e6-8d1e-43e8-a37f-7186bd1ee5df", "comment": "Malware payload", "value": "0241b90dff6b2c76bcae2c50ff1b4a1d8957ffedd6b316ec9d4f0d454748959b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421642, "uuid": "273e8ce3-36e6-4b28-ba28-1e0489654858", "comment": "Malware payload", "value": "8ee66b0f2b08e35c845d38164969072a8a22a87b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421642, "uuid": "58f3c9ad-2ff1-490e-afba-57b6ee610adc", "comment": "Malware payload", "value": "7f58abaf7da8dce3663d0d8634d146e2cf2627da10437d103c87fde399e6b76bc9fcf13124e3c1442efd9dc5e6d21420", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421642, "uuid": "d4d74e28-c0e2-48e4-b0cf-15c59ac8b695", "value": "T1B325FA819D058465BBA6D33F20A02999DC5FB70176FCFC5F942868CBCD9A17CF86848B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421642, "uuid": "2493ecd6-2142-4b07-bdb1-658b774e485d", "value": "e09ec40d35aa4742305bd2d2cfab6124", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421642, "uuid": "73dc0cd1-38d7-43c8-8d7a-240a1a524c28", "value": "12288:mw68Ryl0S+oK+QF9Jfg7zSw06lrPlAwwTnH+MpU1IVZp:EwgN+KQzlg7zSw0kNAHTnsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421642, "uuid": "fc8da926-e318-4e40-b89d-5ce1b401026e", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421642, "uuid": "d98e2f06-4ce4-499d-8523-4bcbeec37d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421642, "uuid": "0859d7ee-7e07-4ea5-bf02-f29e3aeb8a84", "value": "QuickDeskBand.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a4c1a6-9028-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701421320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421320, "uuid": "7c679d59-2354-4b56-b187-d1b7994845ab", "comment": "Malware payload (RiseProStealer)", "value": "56e49b70cb7677d5d14263dad1501291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421320, "uuid": "f3049441-87b9-417b-b211-d32cee8fadc3", "comment": "Malware payload (RiseProStealer)", "value": "0251e02fca6b28109c413af8f76192a3c87b166c5777975af30239d13568a3dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421320, "uuid": "ee326332-f32b-4bb3-8f3d-99dacfdc36af", "comment": "Malware payload (RiseProStealer)", "value": "d8c2f52635bbd6d7ed93384e6728f662c9576285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421320, "uuid": "ebbf1456-b142-4ca6-ab03-6986a3ec73c3", "comment": "Malware payload (RiseProStealer)", "value": "9fa744bf3d79f167b848dfdd86beff07953ffaf30bcc008e545e3627511463b36fe7ff1972b6738f5a920b8fd0e82a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421320, "uuid": "2bd310d2-125c-4258-bd8a-7bc69b79bcd3", "value": "T1BFC5AF25AC4CE1E3CBE330B157DC276057DCD0A54BC972DBBCA176E6CA846FA1A31168", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421320, "uuid": "a592b4f5-1123-4c9c-9cca-6257434f0481", "value": "fe9e3404bebf8b23e1a17d6558da6aa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421320, "uuid": "87d381f2-a0e0-4527-8a92-7d240711575f", "value": "49152:8mHkoSMlmq2qiaKEmoQOwHo/pNaPNMwlBIHrcOk3tpT/fK3OzZzdgUaRiHh3N/QR:nld2qiREmoQOwHYNaPNMwfIHrcOk3tpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421320, "uuid": "4ec5d2cd-5831-40d1-82e9-722c86794959", "value": 2732544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421320, "uuid": "c7db5398-7553-49b4-8b83-7a7d587aa20e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421320, "uuid": "0b299890-ab64-4438-a29f-01b3b91d4fd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfaa69e4-9029-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1701421974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421974, "uuid": "d06148e0-f128-48af-ae60-8256f014a462", "comment": "Malware payload (Adware.Neoreklami)", "value": "0db963acdc3b3dacb89eea152dd46b3c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421974, "uuid": "5744e0fc-695a-4b7b-aa09-f2df4afa808f", "comment": "Malware payload (Adware.Neoreklami)", "value": "02cca4a4f41fc2cedf84189b96c9ecb727b2df7cf9f07780f009597b22bf780f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421974, "uuid": "015282a8-c433-4908-9086-8b1b47a4ea2c", "comment": "Malware payload (Adware.Neoreklami)", "value": "0d91310025a7b7a76e8aa723b678f71710eb7de7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421974, "uuid": "2d8fe205-86ce-4e5c-bfb7-3db9a8ead907", "comment": "Malware payload (Adware.Neoreklami)", "value": "16824ede62da5c3c18e5a8cf5539e845fc9513cc2705a446059a1acb2c031916f2ebba8bdcb79d33e08f10601f7b93c8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421974, "uuid": "29dbf01b-5737-4e78-86a5-efe0809cb89e", "value": "T13D76334137E3E139D2165D304F58BBDA6298676A0EB09B2337FE17DF1A2D983A207435", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421974, "uuid": "85c1c438-7b70-436b-9d24-560e0e264a2b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421974, "uuid": "65397c89-edb5-4806-a45c-7d5471f5a0ba", "value": "196608:91OFQi0ij4kZ9zZOz4iy56n08cFtDLxw0X19iq9Gp7uH5scaHc:3OllZ9z+4iygcvJXiq9IbHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421974, "uuid": "63627086-b114-479d-867a-328b75f1821a", "value": 7522408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421974, "uuid": "b8a97f2a-eac1-40a3-a768-d53095ae10d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421974, "uuid": "355956dc-d92a-4dbe-833a-5a559abd73ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6363418b-9070-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701452287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452287, "uuid": "7085c2c9-5733-4b62-b9f1-b4ebb8b7809e", "comment": "Malware payload (Stealc)", "value": "ce58d634be4500b091764634ed90e2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452287, "uuid": "59bc379a-4974-4a1c-94b9-0335e87b4456", "comment": "Malware payload (Stealc)", "value": "02d4c69ea3f0fecf650085b84096dc9360675697531ca3e8eb053668603cf760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452287, "uuid": "bb0b1d14-0b17-43e8-8749-4eee82fb67cf", "comment": "Malware payload (Stealc)", "value": "36afb984bc0da77ef463cc886242678ede73f39c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452287, "uuid": "bc844236-3fb8-412f-8a62-9f8f1cc7790a", "comment": "Malware payload (Stealc)", "value": "e0c06fe4769633a8c2a8c0bc82116a974a96d246964e17d34166794918aec1cafa2ceeb7545dd7745b852704f925de27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452287, "uuid": "0f056c0d-277f-41f3-814d-35b9ca5a452a", "value": "T1C8545B13A2D1AC60E5264A328E2AC6E8665EFF518F3D77DB13546F6F09731B1C262F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452287, "uuid": "48c3bf3e-6fbf-4cfb-a7b2-9e0229bec043", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452287, "uuid": "beaa3c28-320d-4804-a6ad-129b3454a0b8", "value": "6144:ez2+UNHlb0Ulf1BCYp4BsQZLrH9ViL4fScp6:ezUb0Ulf1Mm4u+P3bRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701452287, "uuid": "b8d68387-d88f-4349-af26-e167244f7106", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701452287, "uuid": "d17bd140-8282-4d22-9da2-805576c4a13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452287, "uuid": "f45bb7d1-f32d-4c6b-9785-19ce91e23a52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0019913-9034-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701426726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426726, "uuid": "f4889a1c-20b5-4c96-bd3e-a24c6152e185", "comment": "Malware payload (AsyncRAT)", "value": "dfe3b173543bfde09bb71170b620d687", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426726, "uuid": "2f38ec68-ab09-4565-918d-40f01ecb016d", "comment": "Malware payload (AsyncRAT)", "value": "02f7ef431654292b6b80cccbe9ecc391cafa706918ee2b3510a5c8dfd8378a15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426726, "uuid": "d03af752-1d59-41c2-b8cb-81a208f6b0ac", "comment": "Malware payload (AsyncRAT)", "value": "22bff39986646a5aa03e0bbcc5fb06229da53a7e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426726, "uuid": "ee06189c-a7fc-4f0c-8399-7ab7037a54b5", "comment": "Malware payload (AsyncRAT)", "value": "b639a7bc745577c94ca4e7b1079373ed091438f43f03c57a0fea296cbeacc216cd86814ce77b1faa796c9c6874cfd9cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426726, "uuid": "1a338bed-c597-4738-a5f8-3dc1c07fbba6", "value": "T110235C4037D88136E2BD4BB8ADF3E1458279E2676903CA5D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426726, "uuid": "b8753420-c7bc-4334-952c-b4f2544eaabd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426726, "uuid": "d49325c1-4617-4edf-9bfc-017a931da23b", "value": "768:4q+s3pUtDILNCCa+DiptelDSN+iV08Ybyge8txYVeS82vEgK/JvZVc6KN:4q+AGtQOptKDs4zb1aVe8nkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426726, "uuid": "985f1cc4-d3bf-4093-88a7-0f9993c7a18b", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426726, "uuid": "5915ecbc-b6a6-4ba5-b02d-fce614647835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426726, "uuid": "58d3079c-7703-4ea0-8fdc-889244558903", "value": "1701426725c869c7c2762e289c22e3d19640e999e128c79bca2bbdff76368ef2a03df2712f247.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1bf098-8fee-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701396546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396546, "uuid": "595cda37-5e2d-4ce0-9b72-1c516e0b5304", "comment": "Malware payload (Smoke Loader)", "value": "adb9ac735917518cee0c8fb41b37b4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396546, "uuid": "73930ff3-30b1-467f-b243-da64a3c1c928", "comment": "Malware payload (Smoke Loader)", "value": "03d1ee7b285ca1d03b89d8899c1b966fad747341dce8a46f1efb803718905279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396546, "uuid": "77a98871-e860-4a5b-8ee1-6f2730a07781", "comment": "Malware payload (Smoke Loader)", "value": "927041059c60287accd402d57a15c1065a7df5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396546, "uuid": "c16ee6a9-edb1-410e-b0b9-36d7f7a1984f", "comment": "Malware payload (Smoke Loader)", "value": "c5ace2d001f759cdd47bad5f96bfb798be498074bf50e6eb17f38e0335fe8a2a3e6ed89e4593edcd5752a414e0e92f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396546, "uuid": "6486d3fe-28eb-4081-a5f0-eea2cd9a372b", "value": "T16764D74792F13D86E9278B729F2FC6EC771EF6508E59376922289E2F04B01B2D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396546, "uuid": "5ea5646e-d6a5-4433-8c12-4c3285673d91", "value": "0bd61e688135eda02fcf13008a67a440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396546, "uuid": "41593a0d-62bf-4a32-b37b-e70c2bd03399", "value": "3072:NTfM/TOh0+ZRz84jQ3XEK7xOpXkrnk2i5f5fMu63jXdo:5AOnzI4ja7xkXkrGSjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701396546, "uuid": "ad1654a1-3f2f-4291-a176-b3249be34ef9", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701396546, "uuid": "948932f7-acd8-4d80-850c-04779a729d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396546, "uuid": "c3654b78-b984-4eda-8900-aa6e46e9dc48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ca3044-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701422582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422582, "uuid": "9d5f987e-8ed4-40c2-938a-5142fe39d582", "comment": "Malware payload (RemcosRAT)", "value": "986a1e015e13471ba117c834efdf7368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422582, "uuid": "b8489055-e229-4d17-b5d9-84469ecdfbf7", "comment": "Malware payload (RemcosRAT)", "value": "03e1b46d2f7cd22416f24a7d5f4eabc8dd2b3de80b8b8cdc8d360f02ed1d931f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422582, "uuid": "fdec1acf-0394-41bf-bcaf-a06da2cf80d3", "comment": "Malware payload (RemcosRAT)", "value": "81d6be82bb5d840c10d7f0fad9312ab860715717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422582, "uuid": "09875f2a-dac4-4ce3-a7dd-c088cfae0c58", "comment": "Malware payload (RemcosRAT)", "value": "bc65e6b312741c0f8ae783ff1a5cccd6f26df67cd7258351e3981af8e2d4714c6e9e2d209d4334a6c5293626e3dd1773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422582, "uuid": "7ceaf513-ac46-41c2-854d-d70c0ec7e8d8", "value": "T1CA250224E5F91B12D6FE97F518115A140FF378AAE47DE32D4DC9A4EA2666F000A43F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422582, "uuid": "6a79a009-f1ca-4a67-b3ee-40d68a616a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422582, "uuid": "f497f384-0c6e-409a-bbca-de575f63d25a", "value": "24576:rV1x3UYz0awm1X5T5I7qcBZdepQ3LE3ES5QQgvC:Lx3vvNnVI+cBZspQbEUWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422582, "uuid": "8abaf635-60bc-447b-824d-3119c53ba0d8", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422582, "uuid": "3b860246-fe04-4858-9da2-d6fa203bce5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422582, "uuid": "bc37424b-5440-4cf3-bbba-712e1ad0c954", "value": "F09877890000090.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0255e2d-9066-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701448228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448228, "uuid": "04785e92-be53-42ec-b6dc-5b66ee07a4b9", "comment": "Malware payload (LummaStealer)", "value": "3a23765f6e45d309b5dcfcf7ef0e28b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448228, "uuid": "2751e864-daf2-4666-b62d-8628e5a9f9b3", "comment": "Malware payload (LummaStealer)", "value": "044121e168b56bd4eaaab19513ca8a8db3b3d8d2e8de926eeadacea0b5edf23e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448228, "uuid": "d2806076-09fb-46e0-aebf-27814d4c5666", "comment": "Malware payload (LummaStealer)", "value": "094c2a0aed1a86ec4e6d9291a93fabcd97ec4ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448228, "uuid": "d9fd002e-6386-43a9-809b-2205ead8554b", "comment": "Malware payload (LummaStealer)", "value": "fd9e18f9077fa2f0eb66d4c370276cdfb1b16be0c2f2188c75cd37ed7549ee59dff53d9c6e5c49e62ee6832fe6924afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448228, "uuid": "cde11f15-d0cc-4079-ae3f-bc64417850e6", "value": "T120545C1392E07C60E5264E328E2AC6E8661EFF518F3D679B13586F6F09771B1C162F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448228, "uuid": "7336ea5a-e9c7-4cc7-ade6-b495c6e8427e", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448228, "uuid": "fa9c1ec4-adcc-4d94-93b3-df9627e7da5b", "value": "3072:QSvPy9D2sdTf9+Br6x0UDiiZFJBpUw5Ng2/xkL+pYkxoOoMlb6C:QsE20fY5+0UDiIJD9NjKL2Xdp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701448228, "uuid": "5f389802-4399-4ef6-9534-a52b38f9f2a2", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701448228, "uuid": "d42d53b8-a6ab-4e73-abc1-122d028df11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448228, "uuid": "86f9c0a1-629f-4344-9c01-fb7cccbf17df", "value": "3a23765f6e45d309b5dcfcf7ef0e28b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f3f8b8-900d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701409925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409925, "uuid": "1e5ddeb2-2d17-4041-a27a-5e0b985b4f5b", "comment": "Malware payload (AgentTesla)", "value": "9657fe99fb22bc160bc90c249d4ac24b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409925, "uuid": "3861fbce-9af0-4e42-b2b0-708d9df8b749", "comment": "Malware payload (AgentTesla)", "value": "0661b14dede4177390f62cf8804749651e97c6cb67c51df7fae6996fcf0ec1a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409925, "uuid": "a0abc9f2-2712-4d18-a9ea-65256c84bfaa", "comment": "Malware payload (AgentTesla)", "value": "88d63cacc0813ec2b645ff67b2550f42aa0473e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409925, "uuid": "b69d8f2e-e59f-485c-a078-3cb516e18cca", "comment": "Malware payload (AgentTesla)", "value": "6c6a86a98457588c400132aafc7a2187da50fed43b30b3744f9ba700b1d86998f29abf7cb3e173536b59c32b9fd15122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409925, "uuid": "3a87f1a3-e509-4327-a6ad-3d65dfb87a22", "value": "T139340E077E88EB11E5A87E3792EF6C2413B2B0C71633C60BAF48AF6514516526C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409925, "uuid": "9cb3905d-2a9c-4e4e-b836-7858d6c0d302", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409925, "uuid": "f3487c23-c9e0-44ff-a0c6-152d8a815959", "value": "3072:1v7699pZBxpiWnFuWfzAwfdV0SJTtINX+5NkGtzpWb:F7699pZBxpiWnFuW7AwfzptINXItV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701409925, "uuid": "63242d46-461c-4212-b363-d88bccd3f4ee", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701409925, "uuid": "07265e45-b97d-4732-8118-0eb427fe72d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409925, "uuid": "b5e920a9-964e-4130-be68-41c57d626596", "value": "17014099242c337b83a3e70cb50d6973455a2f02a99ed0dac287101f7c9603263b3dc5e30c107.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40e2ac4-9033-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701426223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426223, "uuid": "30914ad9-ffdc-4dfa-824d-739698545cc2", "comment": "Malware payload", "value": "96d505aa061f15eff5b723ae3f82bc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426223, "uuid": "e3bd50d6-1c59-4042-aac9-6c89cd95cccd", "comment": "Malware payload", "value": "06acd697bc0a41a6fa1098eba46ddd40d029a5fef3eb152fbf9d0d39e6f8673d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426223, "uuid": "621146d1-21ee-4690-9e61-6f4c9b2e8099", "comment": "Malware payload", "value": "fadec5f3bd444044ec269334cfb1ee9fff41da12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426223, "uuid": "0cbf0369-b012-4e87-9e54-1d5949096ea6", "comment": "Malware payload", "value": "7857b3fcf6b1315cf9e077c984db5240d53412622cbc6a9af75b1ba06440df7cfc4e03a64cdc542ee008f3902ae934ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426223, "uuid": "0533dd43-479e-4ab5-a3d3-c63785ae486d", "value": "T1FF03F2E1E2112E43E07D153786D20780B03A53FD6CF7CB775742C138B7991CBA6AAA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426223, "uuid": "a7ffd88a-22b0-4f19-b981-c03d704294d3", "value": "768:biAFh5YBIKGMZmJ1/VTrzDSXl+h6AbUMP02Q3NYVdQDVMM:bT2nZoVTrzDSjVMEvWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426223, "uuid": "05f5f72e-0d68-4eee-bb2f-c9cc913b74ad", "value": 39463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426223, "uuid": "f7882f67-ae3a-401e-b072-3f6b07ad70b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426223, "uuid": "04415419-617d-4558-bfb7-e2d0e16c35f3", "value": "SusMagniber.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf2cbef-9011-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1701411744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411744, "uuid": "5e28f929-a288-4082-a087-51c21ab541f2", "comment": "Malware payload (DarkGate)", "value": "d4a2eb2ca3c9c631d7fe24550901187f", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411744, "uuid": "1ae2e78b-8345-4c92-9071-1b8aaf9aba1d", "comment": "Malware payload (DarkGate)", "value": "06ad0a15ad23f80816d9388624a14712df3598f856a2360912dd98680374dbda", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411744, "uuid": "bf3d7cb9-74b5-4c92-8942-794f10725dd2", "comment": "Malware payload (DarkGate)", "value": "adce21df1542c8867a8d3ee867ad963671290a9c", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411744, "uuid": "c4bafdb4-fc60-43e8-8dde-64462da89255", "comment": "Malware payload (DarkGate)", "value": "1da18fcb3c428d347bac7710820a66a1d5e9759fe590617da01ce83677d7fb718fe12ef1267d1a051abc20f49ab6642c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411744, "uuid": "a04683b1-1750-433b-a3b3-53f94ecefc9a", "value": "T1A043E4E30E44AAE877D56B2EF25CA83937B11DB7143BAB556092C51B1312805C9EFCF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411744, "uuid": "1e7bd55f-255b-41dc-b333-ecbb93738cfd", "value": "768:+rZm+DbOMXv/8/kpd6T0IBCFLGD6nqY79EtVaJOr:+rZmSbOMXv/8gd6TlBCJGD6qY79EtVDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701411744, "uuid": "60e40ed1-558a-45fa-9cfa-ecb4e11f373b", "value": 55705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701411744, "uuid": "316c122a-87f8-46ec-bf40-c21ce2f33da4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411744, "uuid": "1aaa190d-5cbc-43c6-a1c1-186aa1ea3dda", "value": "lightshot.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727f14e1-9014-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412798, "uuid": "b4e29b1c-cc98-4dec-a4fb-8f8383afe58f", "comment": "Malware payload (AgentTesla)", "value": "fda03781991594e3250907f86ef14bfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412798, "uuid": "a3d263e1-ffe0-4e8b-9738-a43278d69be7", "comment": "Malware payload (AgentTesla)", "value": "0744c3eb29101e4278a482fb2a9cc9e43f05bd33ceab82a44a32d4e71c414922", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412798, "uuid": "c7b03bc0-69b6-4066-9a9f-501d34e69f55", "comment": "Malware payload (AgentTesla)", "value": "3b4b62dd08f9a26ba701773129cac0bc97273edf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412798, "uuid": "6fa07da3-a661-42e1-a13b-32824647c985", "comment": "Malware payload (AgentTesla)", "value": "8c5353adeba1c519eb913c09d54a280748a6ee5dd88c27b88c25fde4dfe3391dfcc78cc8746eb51768a6337a29cc2d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412798, "uuid": "69d1065f-38a3-4ff6-aa8b-c309f7299475", "value": "T19005F1027BB8EE73CB2955FF4955B5154FBE1E564891F6C938CA70B22EF4F808440A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412798, "uuid": "f16e7e48-79a2-4c28-8ffa-cb6e263affec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412798, "uuid": "ea005221-5080-458a-bdf0-d64f9bdd35ca", "value": "12288:rGIoafntxHipXHf6IfQBfbY+xTvxnPXBlo1i4NZL9YNJCpi:0aftxxWYz7jxs1i4NV9YNEpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412798, "uuid": "8727958d-6f2d-4ee1-a41a-d5574a3058e3", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412798, "uuid": "b63691bb-8d75-420b-86d6-f60da4b1e5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412798, "uuid": "454a4a5c-ebca-4e4f-a458-5c1ae95f2256", "value": "FT23194060101821_faraday-products.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b425819-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454823, "uuid": "0300e864-823c-48af-83c6-1219f9aa1c92", "comment": "Malware payload", "value": "d2d6fcaa827b945d051eaaf3fd07d185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454823, "uuid": "48f8f66b-5762-47ae-94c1-18ac5ebc8133", "comment": "Malware payload", "value": "0784ba5061a9f2fed8ac0b72f30f02eb632a9983cc776ec1ccf843de29a2fd8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454823, "uuid": "e28cec41-6bb6-4725-8acf-c3b1452094c4", "comment": "Malware payload", "value": "7ea4dda6e3cb0f7635e404a432257b8dbe93b356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454823, "uuid": "5861d4f7-2f5c-471d-956c-295f113842e2", "comment": "Malware payload", "value": "05e3c82cc9caf61d08d337f3b546587d014d15869b4831121fa76633305aa1aaaab11e654917ac67812578633bf71558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454823, "uuid": "63bae56d-02a0-420f-9201-fbcb051871d4", "value": "T1E0357C1732915033E6B279364F1B429DC826FA261D78345A6BF9AC483D35643BA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454823, "uuid": "553aa7fb-5734-4428-9ff2-3360fb7ea3df", "value": "12288:fGB+O1pf2nAuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rz36/aw36:fKvTs3nyaLOu3MbDwQeYwaLRSss5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454823, "uuid": "e9d1900c-d6b1-4971-9b82-d78cc35fcd7c", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454823, "uuid": "5590ca8b-86ca-44f7-85ae-7c35c73044e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454823, "uuid": "d1ad67dd-2b59-4341-97b6-f572a949643f", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26471.2025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c522ac58-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (PovertyStealer)", "timestamp": 1701416373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416373, "uuid": "98cf262d-73e1-476c-8de6-a718fe4d13c2", "comment": "Malware payload (PovertyStealer)", "value": "b8e53ea5efc220fe80f217a0fe9ba89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416373, "uuid": "89e58da2-2c52-4ee4-b64c-7a7fb5bd3225", "comment": "Malware payload (PovertyStealer)", "value": "07c6deac35b7070d7d9ded3fca62d976c054c1ad8e466a822543cee33ea04437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416373, "uuid": "1893cba5-b05a-4ad4-8f01-692276c6a015", "comment": "Malware payload (PovertyStealer)", "value": "b16786f4afa49654ffeb384e0a19764eb0cc7f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416373, "uuid": "1336ea25-10b5-4ef1-a1e2-c9435771d087", "comment": "Malware payload (PovertyStealer)", "value": "4feba27be8cb8571e4040be767719c446c345610106bf618e1ec6375bcfca8aae72a07e27ae25e3d12f56e1777d58e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416373, "uuid": "6371f2a3-b843-4d0a-9452-6b5243d95b47", "value": "T186E633756E68DB0CCD6A9F302E9163D39F70BE461D93D7CA95177A9A7832F808816303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416373, "uuid": "23db7b0c-7dc5-45b6-ac15-7a6d37c6dec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416373, "uuid": "69407f5c-3325-4878-bdf2-3bd19507a948", "value": "393216:JjRJHKOj+YFAXqHO+boBDi9HtSIrqGVc:J1JHoyAXrBDWHt7HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416373, "uuid": "6c522371-b604-4a13-ad11-a8eb1b02dff4", "value": 14062080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416373, "uuid": "02eee52a-35b3-4917-ab5c-ff78e17378ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416373, "uuid": "a8b80c82-4f26-4bb6-8127-5cb54a96ec0c", "value": "Konstantin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4801d8de-8fe5-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701392541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392541, "uuid": "568ec8e1-f0bb-428c-9977-e15aaa1e444f", "comment": "Malware payload (Smoke Loader)", "value": "e33a77dea579e7452ec0bd6549f10cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392541, "uuid": "8684d779-34fb-47b2-8e89-a7e5cc4a2664", "comment": "Malware payload (Smoke Loader)", "value": "0c9a78a76b94e4b746c60b0546f3eaf3a6a33b99ea6e1c73c0242233df36f97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392541, "uuid": "664552f4-423e-4e22-b03e-d9d111cb0f96", "comment": "Malware payload (Smoke Loader)", "value": "8be267937f92a7601767de2dfee372517765ac91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392541, "uuid": "17afcbda-b1f4-446f-ae57-3519dad50cab", "comment": "Malware payload (Smoke Loader)", "value": "200f334d92e449ee27442a78055be690226d8985359a75c63a0e2f0059d0103c8795bcacde630e0ea6f8591fa20c0795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392541, "uuid": "2d84d47f-ebd6-46d4-87df-a5692964ff15", "value": "T11964D64392E17D86E9278FB29F2FC6EC772DF6508E497B691228DE1B14B01B6C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392541, "uuid": "00db1cbc-a836-4b20-88ba-5ea4226c6077", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392541, "uuid": "7f30c006-b4ce-4063-9002-026565796f79", "value": "3072:mvZYqLAOvLzd3hHsYgaecrfiW8fizOYrT7qY5SRA7uHptMu63jXdo:EJLAKdRMHaKDaqFRIuHkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701392541, "uuid": "35ae3d03-6e37-465c-a62c-a141253bd818", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701392541, "uuid": "adedd057-465d-4857-a77f-a5dad9d9ae57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392541, "uuid": "7dfc0eb5-7ef5-4f75-b824-e25dc99a79c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dac20e6-903c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701429917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429917, "uuid": "e17ffd4c-b999-47be-b62e-a403e5b944b1", "comment": "Malware payload", "value": "6b5e15bdaba2de7113aec0de7f4df105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429917, "uuid": "21357e7c-bb1b-4074-90f2-84ebfc12062f", "comment": "Malware payload", "value": "0e9c824506978176a4117eaa27fd8914cba6a618256b972eef61822b482bc5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429917, "uuid": "2cc62515-3f47-4b8e-8a8c-d33f9d50ed16", "comment": "Malware payload", "value": "d7793a0864d1d4a995e001137de5e559d58e7a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429917, "uuid": "2540abf4-de97-4cda-9489-afa2828f4ceb", "comment": "Malware payload", "value": "6f3515d6adcb8e7078c53747b8b60577f2c419ba15c1db2086bc32094cda93a0857fb6d54e22cb5c97d2285f7a5b676d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429917, "uuid": "62f3ee9b-127e-4bba-a93d-02674d7d9de7", "value": "T15AF5164879814C7ACE8431F3A94E41280A915C5A1B85961A2FF3BEDE973D9F7CDCD28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429917, "uuid": "d9230314-1406-4c32-a6f0-cc03b5df7006", "value": "49152:5QsuHE/h3QMtEdm0mGb/ISmB+EEhlp8R:5Qsuk53vV8IVB3Ehlp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701429917, "uuid": "69234503-f933-48a8-b564-edd4ff204448", "value": 3346944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701429917, "uuid": "bf4c965e-9625-4efa-a283-6f8610d8497a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429917, "uuid": "f1696dca-8e0e-467d-a8b1-906f8fb1f64f", "value": "SecuriteInfo.com.Trojan.PackedNET.2228.1015.6194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38ae6fe-9077-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701455401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455401, "uuid": "fb68c59a-53a0-4f2e-86af-1ed9e2744ec8", "comment": "Malware payload (Smoke Loader)", "value": "425641ee72ce03466324ed0f14ffc46d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455401, "uuid": "cdf04285-394f-49d7-ae99-64741e7e763a", "comment": "Malware payload (Smoke Loader)", "value": "0ea5e6ef38e8566aec0be2a53048e65915842636b9bdce6209f5473920ed417f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455401, "uuid": "6cf37264-77a2-4b49-ab16-901d9e069d85", "comment": "Malware payload (Smoke Loader)", "value": "677176970f4501d0649b0a68c4dfec0ad21a9bd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455401, "uuid": "2753957b-f202-4bd4-b4fd-9c986e30b032", "comment": "Malware payload (Smoke Loader)", "value": "fb424032be39fba6eaf018c0be015dc30293c9171c7a3ff8c40f83b7d6ae69f53707b685c23784fcc75476feb3e00491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455401, "uuid": "8b4653d8-2354-4d96-8f9e-b4ccacc6535e", "value": "T16C547D0352E1AC65E5264A328E2AC6F8661EFF518F3D279B23546F6F09731B1C672F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455401, "uuid": "a1cddd4f-68e6-4310-96e0-fa50eff5d017", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455401, "uuid": "f42f8d04-8319-46fb-90e7-23f778023bc5", "value": "6144:VtExQDxC0U+kPnkUYkLeEUI1bDrDB8Jp6:V3C0U+kvkUYcdnByI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701455401, "uuid": "d2cc3bb7-de20-4c6b-ac0f-ff1c96af6d85", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701455401, "uuid": "57dd2199-dc80-40b3-9b97-c01b09ec7a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455401, "uuid": "8b5661c3-2755-4ff5-86b1-6fa622cf0cb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eefc810-903f-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1701431100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431100, "uuid": "8b529726-c4d3-4e92-a9c0-942c7e0e0754", "comment": "Malware payload (CoinMiner)", "value": "f5a9cd5e397019aaad4a415470285a27", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431100, "uuid": "a9778661-58ee-4e2d-a5dc-00eb30594e76", "comment": "Malware payload (CoinMiner)", "value": "0ec0624c51716f3a5c785aa516165d9a13b41d698fc805c1910bb879f83e65a0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431100, "uuid": "28d9437d-7403-4c67-a54b-e3c6f6436747", "comment": "Malware payload (CoinMiner)", "value": "36be04e79e03832a2a80a4768a139b1f55da3d74", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431100, "uuid": "a5e4bcf5-391b-4e7b-9146-e9105e0b41cd", "comment": "Malware payload (CoinMiner)", "value": "03a9d584a19ba9ee40c42880e62e3c810efc4a4598c52ed6b3eec2ae96fac2a9cad55af796a4066e3f7601be776308ff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431100, "uuid": "1fa07674-c30b-4625-8d77-484d2e3d0ac5", "value": "T19E34CF2276E0C032E16759354971CA755A37FCA2AB6186CF37943F2E5E312D18B74B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431100, "uuid": "d7dd73b6-1a65-4b35-ada3-6afef11c7400", "value": "1e5043715b5ec4c1a45256db4effd68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431100, "uuid": "9127abb0-ecd9-41d8-b0ac-21efeba8af3b", "value": "6144:k7w8etDzZcoUTkcaEWgRDxpLN1CQraMQ:kEjcoUTkTVgRDxpLmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701431100, "uuid": "0216f7a7-b6c9-4517-b629-b8ff74728ecc", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701431100, "uuid": "10cdf3a7-a982-4d17-861c-3ca1c1cb8fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431100, "uuid": "120b44c6-1548-4ae3-8e27-69f82baa044c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31cc4eb-901e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701417309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417309, "uuid": "7a7ead7d-5531-4001-94d5-c17c93584be2", "comment": "Malware payload (AgentTesla)", "value": "5e32b356e47560e7920fe291ab2d0c6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417309, "uuid": "78953f54-d7d4-43bf-9a25-c682bdbb3f24", "comment": "Malware payload (AgentTesla)", "value": "0ec323f55808814136b3c1059277ac2a2753955676218a13aacc73565fea684e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417309, "uuid": "75b4bda0-6d80-4889-9e8c-c593231b2963", "comment": "Malware payload (AgentTesla)", "value": "950d0ac0deb7bba590731dcdf879cb5156214abb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417309, "uuid": "028f828f-c0ab-47c6-b471-e4aeae14e8f7", "comment": "Malware payload (AgentTesla)", "value": "71df13c7ceb0bb080bf72b0689b95cb0ed29cdb38da2d814a3bf1572724ec47976d8c7e9b1b448f39057af0dd40a0e0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417309, "uuid": "0377b528-fe4a-424d-bd87-de85ca7c271f", "value": "T1BA3512467B440B10E4AD9270D1E72A3513F7B6CB31B1C69A3E84438A1F923D4ED9AB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417309, "uuid": "60dd7b6b-1c0d-43e8-9a2b-92086cb48350", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417309, "uuid": "c1549ad5-682c-4957-b0ec-e2590175b188", "value": "24576:X/91i2tfLlwQiAgf2rf58SdKMFyZ6uKrXjk71IgGhr1k1+PbZo12a6z:XXFSMgf2zVpHw2pagzZo1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701417309, "uuid": "b79fd389-d427-4c6b-bb30-3336264714c7", "value": 1059400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701417309, "uuid": "888f2f35-7117-4df6-a110-ca2dd84654a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417309, "uuid": "57065938-e724-4f3e-aa3c-29dc5a64992a", "value": "5e32b356e47560e7920fe291ab2d0c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e421ddc-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413275, "uuid": "49393622-5c96-48d4-9081-48d58077d04a", "comment": "Malware payload (GuLoader)", "value": "fed3f40e427a48337832828471921e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413275, "uuid": "ef8e629f-003e-4226-81c4-31760d758cda", "comment": "Malware payload (GuLoader)", "value": "0f57b76ae852268f8ba11875ad19f6d3c86ce142eb24525cad3ebd2b3a805794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413275, "uuid": "0c690ee1-29ef-44de-9f9a-e4a01d3e1259", "comment": "Malware payload (GuLoader)", "value": "f256298d74a909db97ce7d7df28cbc6f9df64dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413275, "uuid": "00effb59-8bc9-4342-9549-0b508992a6e3", "comment": "Malware payload (GuLoader)", "value": "297438aef78c06c69bccdc19ebe47c65a63492914876e8cd703d697400263c51cc1958ef4b073fce7b5bd7aab78fd0f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413275, "uuid": "e8016b5b-8e13-41fe-aaa2-15fed215c8c2", "value": "T149E4CF9279CA726FDD1F4A74035FEAB21A795CE07382496E4F80760D4C3694A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413275, "uuid": "aeb28097-121d-4f1f-870c-b3ff12676d69", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413275, "uuid": "8bc17171-360a-4ef4-aa7d-8ff235f7deff", "value": "12288:tkEnhe2eNdkiNx/F0UFbZXVgf3RfiMv3aqEAdv522K7abjI:bhendkiNx/FfFbsB7EAdv02K7abj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413275, "uuid": "edfbf244-3c96-4ff3-9278-e8dc3ffca009", "value": 663263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413275, "uuid": "b0f12d7b-ed7c-4248-85ef-184ce07bdb4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413275, "uuid": "8259cb31-8b5b-4cbf-829c-b369b9b8741f", "value": "Invoice - Fattura 276-2023 del 27-11-2023 PMT COMPOSITI SRLpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1218caf-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701412045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412045, "uuid": "ddf91522-857c-4e34-b33a-70f0a489de84", "comment": "Malware payload (Socks5Systemz)", "value": "72394ac9942fb61d813103c42eab8418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412045, "uuid": "ca3f5e79-0cdb-4111-85b9-58e38b52383a", "comment": "Malware payload (Socks5Systemz)", "value": "0fbe5f2cb3efa0a8573c965fc231ca8c0df7a3018d16757b572a853f727a2e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412045, "uuid": "1b068995-7e08-45de-869c-695c9c8d85a0", "comment": "Malware payload (Socks5Systemz)", "value": "c0e96e9c997a8922fcabdf29de57ed6b38fd178e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412045, "uuid": "5823ed8f-7865-42da-9420-93a25e7b5a9e", "comment": "Malware payload (Socks5Systemz)", "value": "496588112ce6f27238a141e34167f5f9be7195f3b8784ba2c422b27f1a2dc1834ecf8584f170ade38fa874d701cd6634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412045, "uuid": "abf4674f-3e5f-45a9-b991-e304499159ff", "value": "T167E533414A5BC4B0F671EA750FE3DA80825BB9A334311DD991DE4F5F6B2D382B82B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412045, "uuid": "7a3dba61-ee5e-417d-831d-cf248fbd50cc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412045, "uuid": "ee9f5259-cd09-4c21-9c99-fa146217c8d3", "value": "49152:/22LK66sfh2ceGIkPOdSQcjWuYvaXqAv48k5NitFUKa37NxMzr02E/sI:e2g+qkmRcjWGXqAv4DNiDkAzr05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412045, "uuid": "6ec5f415-2793-4d60-b4e7-5b2c76604f70", "value": 3217801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412045, "uuid": "4dd44c81-195f-4e7a-9034-28ced23e7542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412045, "uuid": "07cb49c4-03df-4435-bbca-26d6d6945cf4", "value": "SecuriteInfo.com.Trojan.Siggen22.21079.15338.5645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a101de6-8ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701402879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402879, "uuid": "4ef05778-619d-4bfa-ac81-0a8b7e7770b1", "comment": "Malware payload (RiseProStealer)", "value": "3afed19a3ec0d96e4db93b7d6a34d154", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402879, "uuid": "6175723f-8872-4cc7-bcc5-b2268f59fe6d", "comment": "Malware payload (RiseProStealer)", "value": "10cef0b0f286a3f715aaad09fa089a97c10b98cf01cbae4c702eb49c7331f461", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402879, "uuid": "04feb2d2-95b5-4ec3-b8dc-fe719bc0e4eb", "comment": "Malware payload (RiseProStealer)", "value": "8a879ba1681cc76f3636d714e0ee3af084a2ee28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402879, "uuid": "caa4241a-8d11-4503-923e-c9288ef9ab46", "comment": "Malware payload (RiseProStealer)", "value": "0a3ebcc9c7707fe0134367d958bebe739daf330ef71f8f711a0dfe28ade9aed374c778e4c46a781d43c8505687dc5b83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402879, "uuid": "955017a4-ba80-4fb4-ade7-59bd33b40989", "value": "T1E9C6339CF7D52886C1B42D79C662E4A203684CC27B56D30759CE9EEB2635F9F93027C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402879, "uuid": "0666b2ec-d95a-4587-a75f-656bdbb1430c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402879, "uuid": "4ec2af40-0aac-4026-bd16-0c935682cf6c", "value": "196608:cPAycwnoHg8H9jKCKJkg6QBFFiqgS4UHxanML128aralMzBNW25+evO7yyvOfmMj:cPAytoH7djGPZKqcnML1vWuMzbW25POQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701402879, "uuid": "e0d6f981-8f38-4818-95d7-a73edf1d118f", "value": 12007936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701402879, "uuid": "46927f8c-49f8-432c-b578-d22470d2ee92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402879, "uuid": "1627e3fa-d99d-4b2e-a8d2-f36b0db08fc9", "value": "3afed19a3ec0d96e4db93b7d6a34d154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37218b4f-9004-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701405827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405827, "uuid": "5af8fcdf-5d89-47aa-a774-5082508bb17a", "comment": "Malware payload (AgentTesla)", "value": "731ec9a777fa14b50a95069264dcfe05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405827, "uuid": "07d6a28e-24e9-45f7-8f08-3c03b86440bd", "comment": "Malware payload (AgentTesla)", "value": "112cd260d10fc7fb85c15add5d2a7f1fc4f4cf2c7be1339d259a747add1b12e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405827, "uuid": "dde321ad-8ee5-4232-95d8-23295a296bad", "comment": "Malware payload (AgentTesla)", "value": "0979c04b4487a9e75683b00f841c954517649513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405827, "uuid": "8e70f728-af69-45f3-b1b7-bbc27ebf562c", "comment": "Malware payload (AgentTesla)", "value": "12bff17a4b49fbbd9d655fac68d1db2174aeb76beeab220cd910dfd2ce6bebf84f66281b2357705c37069de16d284e54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405827, "uuid": "d496b7fa-c91d-431f-9bd0-49faffb26f5b", "value": "T142D40214B5A56B63EB7967F286A001254BF33AEE1375E3181CDAB0DB2578F098950F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405827, "uuid": "0953cbe2-65f9-44ad-b85d-477c052ca2b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405827, "uuid": "c7d96398-2b27-42fc-aa6e-307aa3a8ace7", "value": "12288:p5q8o7xCoDnqPZXkBlS9VxkMixW3UwTITwJydzGXjM577:prutTqPBkBl4oMYWhTITNdiXwp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701405827, "uuid": "74478721-3d49-4159-984d-f51f19c2ba2c", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701405827, "uuid": "1bfd882d-5ae7-4f5f-b174-ddaad854dd93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405827, "uuid": "637ac5f8-5579-4946-b8c3-5a6e87732a29", "value": "731ec9a777fa14b50a95069264dcfe05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3d514b-901f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701417408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417408, "uuid": "1acb5533-d727-4ec1-98e6-5e07447ea5da", "comment": "Malware payload", "value": "134380c1e432bd20f54e34bbbd2f8351", "object_relation": "md5", "Tag": [ { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417408, "uuid": "2e2f66a2-557d-40ed-a317-9835a20d5a5b", "comment": "Malware payload", "value": "142cfc350c6cec3d991f0a23ef0fcc0c86253151672d8e1111cef227fb09508c", "object_relation": "sha256", "Tag": [ { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417408, "uuid": "caca3533-f1c4-44e1-b7e9-29691fced34f", "comment": "Malware payload", "value": "13f91f0d762f47d157542c72df4d3cdac3db97fc", "object_relation": "sha1", "Tag": [ { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417408, "uuid": "648d2112-82c6-452f-9aff-4c16d5acfd18", "comment": "Malware payload", "value": "501635958d8524cf289629bb4fe487635301e878f3f13fa57a3c0fd3fe2477f1c82b03911bc2ee9dcdff566c03532c67", "object_relation": "sha3-384", "Tag": [ { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417408, "uuid": "75a0a515-6bcd-4ad1-9416-cfdc6965b37f", "value": "T142F733779CF351A317FBB68C1FA08C3A9AB65C1A29D1F8DEB17295ED13468339C25804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417408, "uuid": "6a39fd74-ee1d-4f56-a59c-1932c4af92e6", "value": "1572864:XpZd+OUVj6Ak6GJc1ltE1/qVxh1gwuO4O4RtqqCLiknSu7lWcdhd:bwnvkVSw1yVT1gwV4ONGwSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701417408, "uuid": "2a95b789-cda9-4133-b34b-0400de58a4d8", "value": 74310874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701417408, "uuid": "013d74ff-1fac-47b9-b5ad-43e5f973061d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417408, "uuid": "9434131a-22d5-4557-ad4d-42f26e27ceaf", "value": "EnchantedRealms.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996d6957-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435198, "uuid": "d44dbcc5-490f-440a-8880-41226f1af1b1", "comment": "Malware payload", "value": "b96eba87538ccbc1ca044771ed62cf1d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435198, "uuid": "f4ef2860-4898-4f9a-a702-7b375f8cee26", "comment": "Malware payload", "value": "1432245b72297066b82b3203ed2bc3a85678251e2151e31a21ddb2e5fbd95aed", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435198, "uuid": "bed2df78-ca34-4bc6-b8a0-0e64ab463d50", "comment": "Malware payload", "value": "c540b4ab84dc34955e1b014c52a7fa29f46ded1e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435198, "uuid": "fa096384-c50b-44d7-ad44-21a901d7cdeb", "comment": "Malware payload", "value": "81f359b90ba8a0f97c5f0a7ab601bd8ced449746f7f8da1e42c0b352e0fec55918e48f75b5dbc2fb01894ae86bb79c40", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435198, "uuid": "fce73809-9767-49db-a04b-3867b9f0470e", "value": "T1FD560175731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435198, "uuid": "18e1e1d7-4d79-41f6-8c1b-310edbbb40a8", "value": "196608:/6DGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYhkg:uirUVis8O/0giAZ9PDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435198, "uuid": "0bc18b80-86e3-4bfe-ac3e-9069df4a209b", "value": 6368190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435198, "uuid": "59cab740-51b1-4569-b747-55c7241209a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435198, "uuid": "f1ba4312-1ea7-49ec-80e1-1473fbf31a19", "value": "AVC_(AnonVideoChat).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2facff-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (PovertyStealer)", "timestamp": 1701416363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416363, "uuid": "8e224d36-2cfb-477d-ab27-42276a120d2a", "comment": "Malware payload (PovertyStealer)", "value": "cb031980eb0030f7096b5e097e841a87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416363, "uuid": "fb47ef7d-50e5-4d07-a278-c8907f4cfed0", "comment": "Malware payload (PovertyStealer)", "value": "15399042016065429443742d3638917dffec34e0ae6921d4b10ba9b5c2bf4353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416363, "uuid": "5092e723-5793-49b4-b454-2359571d4c35", "comment": "Malware payload (PovertyStealer)", "value": "7d1b8a56ed0fa8b367605ed3b909cbfe2f9f017d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416363, "uuid": "11a4979c-52f4-4cf2-8a35-cea62dfec208", "comment": "Malware payload (PovertyStealer)", "value": "b7db465c79b14a0c5ce04e6561208900b3f1dc815cab350263b00515c3a73286a6fbe4e46326c7a88bf18353fd051e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416363, "uuid": "89ec267d-5b95-4525-bfd1-32bf4ebd5e12", "value": "T12DF633197341CA47E29B9670D417C2B64372BE899103572739F63E4377F43C8229BEAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416363, "uuid": "293700b2-f41a-4677-b6c2-a1725e5bcb78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416363, "uuid": "ac449770-f004-4cef-9e83-1f601ac79d37", "value": "196608:usTThnGlMNmviSDpnol5grgEvAzR6X08FCncKyDwl7aUDwyrcvUNcID3U:/lncMNkiionogQTF4Rp1cvYcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416363, "uuid": "ef83dafa-27c5-4b5d-88d7-4c5623c33588", "value": 15995392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416363, "uuid": "fcb1701b-62f4-4c29-ae8a-473c72965081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416363, "uuid": "11a530f5-b898-4afa-a742-98f0daca82fd", "value": "Konst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9932492-905e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701444700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701444700, "uuid": "0d3774fe-3f29-4836-8ea9-632dbd5a812e", "comment": "Malware payload", "value": "5f3e8b0a61c630e5a4939846afe3b700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701444700, "uuid": "5f59511c-c37c-4821-9152-b48f1c21f522", "comment": "Malware payload", "value": "1622b3c967b2c4aa9f1c8f9191570e28d17f341a77a39d0acd836005156a9910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701444700, "uuid": "ceb8e42c-12e5-4f33-9bb5-77796ddf0d5a", "comment": "Malware payload", "value": "62eda4c4b1ba0fa350a348eeef7583fb88dd7bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701444700, "uuid": "aa3bbdb0-44da-4d5e-b5e6-139da9535e6f", "comment": "Malware payload", "value": "450227cb816d64d56e3ba0072e1d5a24ee13e1cf71dbdf9ad617754bd66d3b00558fa37652aa6e429f31fec93ce2d06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701444700, "uuid": "3dbdd5b0-ab47-42a2-b584-91c190b2c3e4", "value": "T19D65F0C897656B96C1CF0B77C4D1778183B4C633A34BEB0B69A01EF90D19BE9DB06582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701444700, "uuid": "56f6821f-25a4-4519-99e6-9b29f2bebdbf", "value": "24576:LnrL21eEdkg2NQGbO73nLDOEDwUi3pawE1LOj0/fi:HLfEaNQW03nmEDwcmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701444700, "uuid": "f5065741-af20-4547-b7bb-200f319d13d3", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701444700, "uuid": "b460255e-f895-4ca2-bcdb-929a20b8ddab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701444700, "uuid": "02a93af0-7c76-40d5-84d0-cac1f2a1aa3a", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.5124.18270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8a4609-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701416414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416414, "uuid": "74467b44-0501-499f-8509-2d6161830920", "comment": "Malware payload (njrat)", "value": "11374849012dfeed18493578007f0c53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416414, "uuid": "a69c4992-f091-41c5-ba48-97eb1c9d2070", "comment": "Malware payload (njrat)", "value": "16607e62e5e61fd70634ebde62a145329a23d3d31867c2e86554b5f9ad313063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416414, "uuid": "de41c994-f059-4311-8425-5cb699885e56", "comment": "Malware payload (njrat)", "value": "367d9ee8bbd2c911c8d9b51fa6f1b664e90036c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416414, "uuid": "7aa96df5-cde8-44e8-a1ca-f33ca707631c", "comment": "Malware payload (njrat)", "value": "efd448b75b626383b155ff9027c170ad20c0cf006024048df391ce156903468b061da23fd13dee39dae42db69cf81bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416414, "uuid": "ffa6ace2-638e-4260-82b2-2f0f72db2d90", "value": "T1EF93D84977E56524E1BF5AF75471F2004F74B48B1602E39D48F218AA1A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416414, "uuid": "3e03a55e-094d-4eea-9ff1-bcbdcc4ba2ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416414, "uuid": "34783862-eb00-424c-8796-69aa5eb0650a", "value": "768:oY37yTnkpjTMpALPGMtsas88EtNXhU9f1mxCXxrjEtCdnl2pi1Rz4Rk3vsGdp0gM:Ly7kVbPGHz88EbE1pjEwzGi1dDbD0gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416414, "uuid": "5d1fb414-8712-499f-a364-d8db4d0f0b45", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416414, "uuid": "f43cb560-1f66-4db6-9b14-a5afe19c3eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416414, "uuid": "ef7f688a-49c0-4ed0-ab10-cb73e4e28139", "value": "11374849012dfeed18493578007f0c53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e4526f-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454838, "uuid": "f83dcf8d-0f25-475c-8d90-57ace52012ca", "comment": "Malware payload", "value": "0309b92785bfc08baf2ac8afb1f843f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454838, "uuid": "00c267b4-c57b-4702-95be-b97b9e92edfd", "comment": "Malware payload", "value": "17ed04e0fea61a8fa340ecdbe045044123ef37d8bf39cbc8f65c53bee190544f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454838, "uuid": "c10360d5-bff7-4277-99d5-685bf7440388", "comment": "Malware payload", "value": "bb97af503efe29e92e240264616a020a64cce3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454838, "uuid": "519fbd60-a157-4c72-9070-78c651bb9e16", "comment": "Malware payload", "value": "9004f787dda83a4530b7d44d14225de7d8d65d29b129e51588ca6e43a10bdf09f8065d70ad3b9e9619f07f9906a31a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454838, "uuid": "90418804-6452-4ec7-994d-af90d51c4dbd", "value": "T189059E12F6D380B3D73504300AEA3775ED74AA620A19ABC7A3A5DE7E5F32141DD37229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454838, "uuid": "4882ad04-2af2-45a3-b56e-e128ea5298d0", "value": "cbc93f1505e830d0701f533a0c381611", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454838, "uuid": "2760ca4d-8577-48fe-8055-5c1e0e6efc71", "value": "12288:EHDbGMnFkX6K+aHIstmH/9UxEOuATdRgWgx7tD5+COSadYV:eDb0X6daoCgOuX7tN+CsaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454838, "uuid": "6e4ca555-40ed-429f-9de9-2cc703fb2778", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454838, "uuid": "a89f87c9-99da-4a6b-a306-bf85a7068103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454838, "uuid": "832996fc-3dda-4d96-b929-bccb5ebbc1d6", "value": "SecuriteInfo.com.Win32.Evo-gen.32721.4309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6767c2d7-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454871, "uuid": "aa15a1e8-2848-4da2-8d85-e9fecf2f5844", "comment": "Malware payload", "value": "c1ae14a5914f1381a28847813eda6752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454871, "uuid": "ed336c5d-d563-4b19-8a89-4370c9d628df", "comment": "Malware payload", "value": "189a5d34e6d38815d9475900ab9c9b62ddb6cd224f1f948ac21dc5cb54d76f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454871, "uuid": "335e86ce-f050-4f6c-8895-de8fdce046ab", "comment": "Malware payload", "value": "f3ee586e29300617edcd1fc75c210fb0c1e9c625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454871, "uuid": "334c9006-43e8-4a47-9ad5-3735336c2d0c", "comment": "Malware payload", "value": "ad995f97fb60b7792d80986496c174b18047fd6c27503588af3d6d5132d981d3549b403d946684db68936876c4f3e014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454871, "uuid": "22adbb68-935e-426b-bad5-a76500a8b15f", "value": "T18405126EB3AE9C4BD51639F8284283FA07049DA61816C747B931FCCFF1B5B576C24260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454871, "uuid": "c0cff442-7937-4b9e-813c-9e604cec9b62", "value": "eb7eb953024f4f4e9d7b2541f3db695e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454871, "uuid": "33331248-2880-4481-bd8d-35c2b1195eda", "value": "24576:iRBoSqduvvnjABUINK7+b0ovJlm329Na8Dmee:ifmduj6KC9hlbjTVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454871, "uuid": "d5b6b686-a2cf-4efd-bb55-dd81c8da1709", "value": 808111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454871, "uuid": "5e3fe1e0-73eb-4ac9-8059-ba2bf9bf87e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454871, "uuid": "c9cc9c4a-bbde-435e-b16e-af9943987d44", "value": "SecuriteInfo.com.Win32.Evo-gen.17230.1494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95f999d-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (BlankGrabber)", "timestamp": 1701403495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403495, "uuid": "17cb9edb-6abb-4b3b-b874-a1212b345385", "comment": "Malware payload (BlankGrabber)", "value": "a17eb2d181dd820bc6b65bea32554213", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403495, "uuid": "cdab0364-5eee-4666-843f-2e5025457c83", "comment": "Malware payload (BlankGrabber)", "value": "18aeff41271af688d193e2e31124207cfe32029dbf10598ccd0bfda194255746", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403495, "uuid": "adf8c405-6882-4ef9-871b-a191578f8070", "comment": "Malware payload (BlankGrabber)", "value": "ee4967746bc97a15e8aa61f8e5d61225df30512a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403495, "uuid": "98e7c1ba-ac78-4c82-8c3c-73d3e3b73e1a", "comment": "Malware payload (BlankGrabber)", "value": "0cedfdcddaea9b3287e14df5710a434ae0a1e90e3872e9ec23968dde7bd9de7500d0de114a8c540e94551160f2db36a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403495, "uuid": "a32d7d85-0add-4a2a-929c-bc34e78b7ff4", "value": "T1CC763320F2E4D872E640693546E987306B3A3E602BF488DB47885F7E5F261DD8836F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403495, "uuid": "36d301fb-c374-4962-a61d-0007ec78cfaa", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403495, "uuid": "fdd45343-97d0-4a5d-bfcc-95abc542291b", "value": "196608:ac/oqM6IgGGhwIi6487ZvO1bv/BQRhDtHHyCR:ZoqM6RGGhW648FG1bv/q1xDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403495, "uuid": "b9318f2a-0728-4c4d-999a-9ac46dc89ea9", "value": 7824869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403495, "uuid": "5cc264e4-8b7b-4361-b060-b356d3a86625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403495, "uuid": "b0f7b6b5-ac88-4b25-bddb-6fd3097713ba", "value": "a17eb2d181dd820bc6b65bea32554213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c9c7e8-9014-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412806, "uuid": "a2213223-a01a-47ec-95ca-b8155aaa283d", "comment": "Malware payload (AgentTesla)", "value": "dcef6132db05f9704623b495b05c1e4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412806, "uuid": "6a0b6079-85ac-406e-aeaa-87cca1aeb28e", "comment": "Malware payload (AgentTesla)", "value": "18f41f2a39ff37e43e2a8e01b0447d613257682929e0d5383458935d8279773c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412806, "uuid": "bd3ec23b-00e0-4690-b5ed-e0f9c3f91d61", "comment": "Malware payload (AgentTesla)", "value": "ec64670ba9e10bf41fa634be3f8b7c5bec0f719b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412806, "uuid": "f57e1ab7-f05a-4c8c-a166-b26ba5585db1", "comment": "Malware payload (AgentTesla)", "value": "0604bf80b1786ba31a8d0ad56649a9433514c2ed0abde941e0474521f3c0341100a0705df62793acef60a60ddeaf30d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412806, "uuid": "5c66da5f-6458-499f-aa3f-d99fd6a2076e", "value": "T10AF30D7025DBD10CF2F36E612FE57ADA9DBBFBB1BDA5605E140402074A21D88CE66372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412806, "uuid": "a1f168ff-5359-4f72-be70-db9ef11efed3", "value": "1536:vSBSNS2SNSJSNSImSNSzSNSmSNS8SNSySNSaSNS1SP:v0YzYsYeYmYTY5YHYPYQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412806, "uuid": "05bff488-7f13-4c07-953e-fc2abbdfda9f", "value": 163366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412806, "uuid": "95482f16-8cd8-4bf3-bfa3-c8b0af58b298", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412806, "uuid": "c0f7c2d3-602d-4e34-99f1-2710042fc198", "value": "PO_0CT01.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5776187b-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454844, "uuid": "e7e4bc74-73f6-47e2-9e82-b672e1242a37", "comment": "Malware payload", "value": "239213a972d149eb697bb25f4d2b1ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454844, "uuid": "32ac6fc6-135c-4ef4-85a1-a91d74caa84d", "comment": "Malware payload", "value": "1a13605978063e2e209f9b093e10896c2ca45c8630e65066690a4964f34b3f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454844, "uuid": "8416d71c-73ae-46eb-bd88-ff59da696ea4", "comment": "Malware payload", "value": "ccc0a7ec47b7cba3b29064d23267432e9bbbe504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454844, "uuid": "e9bd1b97-4f57-4700-8aa6-e5f1b67752c8", "comment": "Malware payload", "value": "24054183a17571093cdaf18c70632cd24744dc54acb45db9819553f32699c76ce6cd4214fa8bcd9bc042ed0b29b8f747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454844, "uuid": "45906b6b-2370-4c8a-8d8b-32343b559d91", "value": "T158E533F28E1EAEEDEA788AF304CEC8E59E2D035CA4F29E095C411EEC454D466D05B5D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454844, "uuid": "b2461d0d-9b9b-420f-b6a6-7d569145c1b2", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454844, "uuid": "e34dbe5e-98cb-4a5a-9a0e-d7b7e38a7e09", "value": "98304:t0s/2UjkgRaPN1ORLniSA/DUMxUi+a+S8ufEmY6pnX5ixEF:tkskgRoNgBniSA7U6Z+a+SfsmY6psO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454844, "uuid": "c7acaa1e-f9aa-4ec5-812e-14dfb9c12864", "value": 3309568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454844, "uuid": "f3bc3063-16b3-4c50-b52e-8bb78648462e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454844, "uuid": "778a3b87-f693-48ea-9aa9-689e2d6d7a38", "value": "SecuriteInfo.com.FileRepMetagen.19007.7964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76e94c6-905b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701443489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443489, "uuid": "b6558862-0531-44a0-bb5a-5558b52f6e9a", "comment": "Malware payload (LummaStealer)", "value": "014f0b79cb5e53869b8044584b7989af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443489, "uuid": "20f6d029-5489-4565-826f-e6f0cd5d6445", "comment": "Malware payload (LummaStealer)", "value": "1a87d88c6a9a4f539e968c8d147d8744f3c2136e000eeabe43bf469b344abeb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443489, "uuid": "725f71a0-94f7-4e46-86c5-15469798c434", "comment": "Malware payload (LummaStealer)", "value": "13687af7267563c1c5bee60c1027b5ad21f2e942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443489, "uuid": "ed34509e-edd2-40c3-87b9-1154a6a99e42", "comment": "Malware payload (LummaStealer)", "value": "7e5f0c611c0a6d74c8006726d361367c8b94b6ceee8d997a327e6eb8d5a1e7c58fbe011ea743c65c52e4b5d5244d15b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443489, "uuid": "162379c8-179f-4611-86a8-94d9b085fb1e", "value": "T1B545BE942B55C037E8B371B8095DB572E0CC5DE45339D8D392FA8AFBE1405EDAA307A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443489, "uuid": "74d03dca-49e7-473f-8879-c1f96d5d0e68", "value": "5bc49fd2e9ca5fa9a7d854e4dc0b1a55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443489, "uuid": "be184ca2-297d-45f6-a0ba-f2527db9ab73", "value": "12288:kCPJZpHu+g3+tmK01ZQuduuvTlIT00O4FqqD3kUesvH16/2WKR31:xPJZpH60mK01bNl30O4UqJesvV6vMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701443489, "uuid": "b65dee73-6388-44a0-975a-cb7840fb2e09", "value": 1174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701443489, "uuid": "edf91483-1970-4317-9213-2cd5c1a823dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443489, "uuid": "55a424f0-5a3b-4634-b072-19876cc8896f", "value": "Script.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e737eea-908b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701463794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463794, "uuid": "9882c5b2-b602-4e1f-b800-e396a7bed53f", "comment": "Malware payload (SnakeKeylogger)", "value": "fe03b712d2e463fdeb67f9f9f2d98fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463794, "uuid": "56b660a7-47d3-41a6-bd42-0eece1226a28", "comment": "Malware payload (SnakeKeylogger)", "value": "1ab6ad1baf7099b79f78d5cc575dc08d33320b1f607b6fa038432c3a27fb2dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463794, "uuid": "c3f3ee8d-22ba-4c70-a3a4-a21afc0fa5b7", "comment": "Malware payload (SnakeKeylogger)", "value": "d978aed329e47d47791e13f31fc4aa823e545f89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463794, "uuid": "9ced7e4a-e8e0-4618-88ac-5c26bb95c92c", "comment": "Malware payload (SnakeKeylogger)", "value": "8839398af19ae3488ca3c75df720b675bfa7daa72aa310ed319e4290be4b17134c033cc1c8218bbdb2a5c62454ffdaf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463794, "uuid": "384b1699-477d-4dc3-9e1f-3d673d3c9e4a", "value": "T127D4E124E2B92B52C5FF93F1042466140BF7786AB53EF32D4DD9A4DA2666F004A42F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463794, "uuid": "60b62e72-1474-47d6-8127-a1b1fbf4bfab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463794, "uuid": "a4931ace-0734-4445-9516-ae6c784ebae6", "value": "12288:hMdIt/5J/tXcPl1RWLDmJr4YoKnE5ZrZ4YIfjwIF7:iWBJZ0lSuEbT5ZrlI7ws7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701463794, "uuid": "fe301dd4-a52e-43b9-a78b-1409515724c4", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701463794, "uuid": "34f76437-2af8-4bac-a803-dad42a83a94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463794, "uuid": "738a77b4-5084-48d2-972f-ddf0fa5bfe79", "value": "KcOX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f35fa47-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454830, "uuid": "11e7e57f-91c1-4b38-a7c6-e8eb9a34ba88", "comment": "Malware payload", "value": "599678786ef9c9d2d9c758edac2ccfd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454830, "uuid": "05bd42c1-13f3-48f7-bf5f-3ea44fb41b23", "comment": "Malware payload", "value": "1ae25da1aefacdb0ec7dabe7330edf3e0a5042b7ed5142771e7ddb46e815e130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454830, "uuid": "39ad9463-e7c3-4f2b-a18e-fc87ee7e56fc", "comment": "Malware payload", "value": "8dab8a35f8f5bd8c986f59687fce2e82c2d198e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454830, "uuid": "d51953cc-619b-4dcd-b816-384351a56282", "comment": "Malware payload", "value": "506b65fd490f77bd46790767ee98d6f2f479b417e846e037965e70eb8293aaff4acc44b8bc4d38e04679fe2460cddf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454830, "uuid": "cd37ae09-2e58-4ddd-bd5c-4e6a6fc6aec0", "value": "T11DF48D12F6E280F5C639153009BB67B6E636FA570B21CFC39370DE1C99361A1AD3716A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454830, "uuid": "f7f6498e-357f-4709-82ae-e245bff9564a", "value": "6144:VAy/i9C7O+Sx2fUqgtib1wn04y9cLRRWBeQqyymyZ5fG/hQhaP/Ka6P:VACiF2fUqoBtlRWBeQQmyXKf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454830, "uuid": "3213deda-bac1-4920-ae8a-44f99b10f506", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454830, "uuid": "3e03f436-371c-4971-9bd5-9c05d4298c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454830, "uuid": "9cd979b6-c495-4a27-b0f3-2a4ef42af2dc", "value": "SecuriteInfo.com.Win32.Application.PSE.10ODIJ9.15696.20150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd2f854-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442319, "uuid": "c5121806-ff43-4a43-977d-7b08dddba15f", "comment": "Malware payload", "value": "4885269b75a7f9987849ed65c9a93667", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442319, "uuid": "1e6b26da-1cd4-4764-b230-77ff37c95b03", "comment": "Malware payload", "value": "1aec33bd4a91e4abaaeed1a367246ad997abf461e437b118870d0718a39ad42b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442319, "uuid": "c9e9dca5-8881-40fa-a6f0-7031f87d359b", "comment": "Malware payload", "value": "b11a5f0b88b7d846110c6ff11dc355a014f150c0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442319, "uuid": "68831101-53d3-4975-9e5f-da696ceaf7ee", "comment": "Malware payload", "value": "0720923ed2f5c0659044469793f4f45938abdea15c8aac29172216accaef1831c3d6353614865045f17ab6e3ae613a94", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442319, "uuid": "c2b18f55-3607-4509-b7c6-fd4f130f1568", "value": "T1EB560175731CF40BE073DE316371814F75E085E51A72E312AB07B8185DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442319, "uuid": "208b6c91-5e70-4bc2-a97f-c88b0f8166de", "value": "196608:/KDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYcyp:eirUVis8O/0giAZ9PDwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442319, "uuid": "1b877dea-9c6b-4dc1-a556-9f153f0a1692", "value": 6376379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442319, "uuid": "91e453cf-f4a4-4034-a229-2e9e8c10e2c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442319, "uuid": "49a15e68-3c84-4f81-b04f-e5e6526b341e", "value": "CashApp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94960dfc-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413285, "uuid": "44658fd8-6161-4e00-85f1-e201ffdd3332", "comment": "Malware payload (GuLoader)", "value": "ae15f34fefc0753874849dd15e6a5a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413285, "uuid": "ac3b210f-1147-4544-bbb7-c3d78423865a", "comment": "Malware payload (GuLoader)", "value": "1af247ac7eb6b3d8bd3aebe9dd80edd61c4b6d8b8d2785b5a7416809781c6c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413285, "uuid": "e043c5eb-eaec-42a2-a543-521261cb5082", "comment": "Malware payload (GuLoader)", "value": "6ea9df06e49aab5ec851490656f7f5385e158a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413285, "uuid": "f5b4b202-6de1-4797-bc62-f913c5cc5372", "comment": "Malware payload (GuLoader)", "value": "4fc8e15539c1e3b2a59437e4c7d990b4117c28407a39285ffd8fc863be057c7db8de5c91c06891e9f594e0b99454fda5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413285, "uuid": "0ce811ab-61ee-498f-a3c0-bb97a2321acb", "value": "T1B1E4CF9239C9766FDC2F8A34035FEAB22A755CE1B381096E5F40360D4C3664A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413285, "uuid": "325bcd4d-f35b-45d7-a450-5c9a6a09f29d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413285, "uuid": "4375a404-1d5d-4b20-902f-6ee2e3d91751", "value": "12288:ncqnhe2ecnhlKc+aueNap20dm17zOckylak7iI/dKX0HO0:nPhemhl+auz20CKdOT73dy0HO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413285, "uuid": "bddc8320-07f1-4aa0-ba3b-a59984b285f7", "value": 680232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413285, "uuid": "6efe2e00-282c-45d5-b055-37731336ea2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413285, "uuid": "885fc456-ceb6-4221-950f-5f90dd4fba08", "value": "Transferencia-9.640,00 EURpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8308438b-908f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701465654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465654, "uuid": "e436cf18-c01c-44bb-873f-3511ee2a2203", "comment": "Malware payload (Formbook)", "value": "faf2187e3f8d113f88d35022b98dcbde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465654, "uuid": "269e4fb1-2499-4f3f-8303-df10a6434fce", "comment": "Malware payload (Formbook)", "value": "1b245652f8eb90239d220881931099461279d671ad3c9f386c1c93699a9d4fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465654, "uuid": "ee192385-d128-45f9-9e8a-3e229b00e274", "comment": "Malware payload (Formbook)", "value": "235be68849a4562be150c3b0fbf9030704925331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465654, "uuid": "b7860425-bdee-4a04-9f92-c92f18d2bd2b", "comment": "Malware payload (Formbook)", "value": "32243be06bf012593a3fc4b1e2c12bb8ea9787822451a9dff420a60b70879597f90cb8d415b2a39b70028affc5cc3b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465654, "uuid": "82d6f06e-cb47-4d75-a8ee-0cc8ed9f0a1f", "value": "T1DFE423457EBD4B65C5BA07F73EC062080775C60BA9A6E04A4EFF14CE67A27500B61F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465654, "uuid": "b5bdf2dc-b91e-4f20-99f7-3d8c5642202e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465654, "uuid": "628cb2a2-bb56-44cf-8c4c-7bba5d354c69", "value": "12288:HcaIilR6XiceLO+/TO4ofH/QhQGQ56BY90fDkDP9wM1/PTXQQpWEXq3:Hciiuy+/atfsQCBJi9w2/PDQQpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701465654, "uuid": "e2258790-1d35-49c9-ae22-3f87409b5369", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701465654, "uuid": "2d9bb576-7acd-4e61-be13-7a78b956f063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465654, "uuid": "c4376064-ed68-4548-a601-322260796bf8", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.32739.16926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bf92c9-9052-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701439624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439624, "uuid": "dd3d1777-e6af-4ecb-b87b-32558c569d45", "comment": "Malware payload (Formbook)", "value": "58ad74f66fe410ba126fc0a67b75f72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439624, "uuid": "f8d97e72-624d-40ae-886c-92b563bc8fe0", "comment": "Malware payload (Formbook)", "value": "1b406a68c4eafc78f127b013623b0d64d07b8a586ccd7fc6ebab8254fea0a469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439624, "uuid": "c28ace52-ab6a-4948-addb-5b9f6ed6fb7e", "comment": "Malware payload (Formbook)", "value": "9c4a949e4f75dfb07c2334a955ce0cc092363370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439624, "uuid": "7715d9e4-b87c-4df9-b72e-0170dd72d320", "comment": "Malware payload (Formbook)", "value": "28a20fb018976a1be345b07a7fd0621b2fc570475690689d51a0abc9c77cc1912e47950fa930063a8141e539004d448b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439624, "uuid": "6c0306cc-92b4-462c-a59b-5beff0c60a93", "value": "T1CDF4F111326CCF03E4BA4FF96852751453FA359E6422F6582DC274CB50E5FE60AB0AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439624, "uuid": "65c85604-3896-4ab5-bc86-b82b20da45c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439624, "uuid": "aa200335-000d-42a9-b4a0-a381571db70c", "value": "12288:7IW6KczGY5todjJ1VtEjvCIrAmZpKunC5eJvNLqs5yUN:16pSYAjJztWCs3GA1LqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439624, "uuid": "75ac8f9e-0b7b-4a9a-80d8-a421005d81c4", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439624, "uuid": "0a0a4f5f-9f7f-4b77-ac74-a1782c030a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439624, "uuid": "f488f416-300a-4e4c-b341-4b38de9f2770", "value": "FRA-4181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa0c0ee-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454857, "uuid": "412ea164-d174-4231-8107-9ba5292ded95", "comment": "Malware payload", "value": "3acc3d42d897eb926dacb999391271d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454857, "uuid": "6e5880e8-f8e9-4199-a529-4dbe70f06d45", "comment": "Malware payload", "value": "1bc0bcbd2dba4bcc7f9670c29bd131e7d4e3bb31e73b66b74f4385c32acf51b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454857, "uuid": "b937c4fe-5082-4077-b5bf-c8b967da0d6d", "comment": "Malware payload", "value": "0af8de0045a20b5366240a7a2f7c185bd335a331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454857, "uuid": "78298aa9-5eee-4521-b000-e21492088821", "comment": "Malware payload", "value": "fceef836e678675fd15e23d71c5b01fe60172c5935ef8d098e1458b94cde532a747e0ae9d4b55eae226c685ce28055c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454857, "uuid": "05ab6e38-862e-49ca-bcff-82932c69bdbf", "value": "T1F1034A51F74129F0CD5C1634D07B0E46E3BA6AE2D8E44A12263BA597BFE14E3983A743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454857, "uuid": "b85c5133-c96d-4c8b-b056-01e6f2f21a99", "value": "384:E0gb02N6IIVQc+VdRBvPuMBFMBVVCaLAmW7hRZ8y/J:E0g9nrcMhvPuMBMVBLAPhhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454857, "uuid": "d956babd-354c-42be-871e-60dc2ef7fcc2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454857, "uuid": "d138c488-13c3-40e9-a109-a490af76a578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454857, "uuid": "b0eeb7d9-0e3a-41d1-ab1a-bf536cf4f8d1", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.13029.11841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3573780c-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701413126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413126, "uuid": "76b836f1-265d-4f24-9728-aafff5dd1166", "comment": "Malware payload (DCRat)", "value": "1e3051b3e6cad4a6d4c57a6d6634335b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413126, "uuid": "c5a55c84-8fa0-4be7-8a4b-fc59f3fdf0b1", "comment": "Malware payload (DCRat)", "value": "1bd0f2ff31f6290aa6d75e44a279aad15492b745d200914df8dca75c5e5e06b8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413126, "uuid": "52d5c630-8eb4-4b64-a49e-dd1d0d712510", "comment": "Malware payload (DCRat)", "value": "b5811f13c6a4a8fc6681612e67fd5a8b455bf9bc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413126, "uuid": "61134ab4-5ddf-4821-a3f1-a347e2f27226", "comment": "Malware payload (DCRat)", "value": "44b6ed41e4641d600878d2e6803392d29fe93392d81651f1b654f56607ab7d35fe4a9086415f0e9c88cba043af30db82", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413126, "uuid": "5319506b-abb3-49bc-a988-1fd6e96adff6", "value": "T18C05F701BE44CE11F0191233C2EF595887B4AD516AE6E32B7DBA376E15123AB7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413126, "uuid": "54eaa716-c1dc-4bb4-9188-b5594856d33a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413126, "uuid": "ee393e04-b6b4-45da-868c-4bf8befa2209", "value": "12288:Q/miZnnymOlI47bsMvkwLh7Pvd8/0umxL2kT507VFSuE:Q/9nnbOlPvfxGHmV2kaJ0uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413126, "uuid": "86cddf5f-2a64-4772-b841-3dc503dbe563", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413126, "uuid": "f325ae98-af79-4654-b270-2206a4f04b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413126, "uuid": "4e5767dd-7c76-432d-bfcb-5f7b3528ae86", "value": "1e3051b3e6cad4a6d4c57a6d6634335b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c6330-9051-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701439077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439077, "uuid": "f2e7c80f-6ded-4e5e-82ea-c0c42a96f05b", "comment": "Malware payload (AgentTesla)", "value": "8eab5e4d034fde42eb31add0cb923a97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439077, "uuid": "c20a27ad-61ed-477d-9e30-054dd43c2cd1", "comment": "Malware payload (AgentTesla)", "value": "1be1eb3fc904fc5a9e9e555e3fa4a2b6a5a299917d5afa9a1570079195387fa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439077, "uuid": "fbdfab57-11e2-419e-99ff-5b7983ae3659", "comment": "Malware payload (AgentTesla)", "value": "ac9f5a051227302049aa5136a26f30a3707db55c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439077, "uuid": "15e1b637-e9b0-4d0d-b033-082b1a373a12", "comment": "Malware payload (AgentTesla)", "value": "e2f93c7dfcce0d01ae979255dade4701121e5b8f265caef181856940e0874b8e42806fa0f818f31c9d1ef521d5919ec2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439077, "uuid": "44dc2690-9a24-49f8-a8b2-7dc277dc81a8", "value": "T17ED4CF015BF20E9BD57D1EB4AC31264183B8C157B2CBE7A75AA87EF418877E09B424D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439077, "uuid": "1609bad5-382b-439b-8ca2-5d15c54b232a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439077, "uuid": "f2f31c54-a64f-47af-8b83-7d73555a4c87", "value": "12288:14uUdaP5mn0llWSQSSKJOzIT5HiSRJ56/:ydaP5mn0llNQN2OzCti2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439077, "uuid": "b4672f10-e7da-4cbe-b1b0-bc94445c3824", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439077, "uuid": "4208aee1-fd39-465a-a27e-4820bdb4fc28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439077, "uuid": "7df7961f-23ab-4da5-b7fb-30fae2633c36", "value": "NEW ORDER--GO23B005--DEC 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6790303-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422791, "uuid": "0cb81c3c-7de5-4eed-a877-412e5a7d2235", "comment": "Malware payload (AgentTesla)", "value": "967eb9fa0ce5f1ec2b6b132728fc6e07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422791, "uuid": "c2ba4031-d0d1-4516-8da0-fde6668bc6c4", "comment": "Malware payload (AgentTesla)", "value": "1c6dffa90d393fdcc2db9e1cf8af2c557129bb4afadb04d87969ad3edd10ffc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422791, "uuid": "f2c2a0ff-b477-4e4c-9df5-da030af0f1bf", "comment": "Malware payload (AgentTesla)", "value": "58d29f3b5463467cfd666b8b1b79bbec930f0d66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422791, "uuid": "f7f0017a-58bb-46fc-8828-6a6da64817e5", "comment": "Malware payload (AgentTesla)", "value": "af8dfed4efb8469b77c214cb5f76de56a67708e5e51b2d957e138854fc1e152542e1181bf82b778cfbd078252b230b4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422791, "uuid": "79e2aeed-3347-4594-a9aa-84d41dab0e09", "value": "T1F4E412A5335A9763D07F97F728C8841993F3F407B850E20C9EE251DF2A71740AA91E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422791, "uuid": "8c139049-d97c-4f64-90a7-f15466e3f3f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422791, "uuid": "4ffe338b-8661-450f-9c4b-122e38a94aa2", "value": "12288:tCIEJjIu1KPsUDMy1+TiReOE1rUxsLINxW/9AFItaGeGQwmEBK:7EJHKPrWiRMV0Ne9A6sdGQwmEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422791, "uuid": "7267405b-83a2-4af3-9a16-e0e11c62c7ab", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422791, "uuid": "74b5bb14-3e18-4088-97dc-1294f9f7c644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422791, "uuid": "07dca6a6-9d47-4340-8ada-ae17ab4989f1", "value": "RFQ_20231201-876678xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b598f8-9017-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701413930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413930, "uuid": "18b7f0a8-7a54-48f0-8dd7-d5b26b2ab6d6", "comment": "Malware payload (Smoke Loader)", "value": "bce2d7b736512258ea55585c4d8cec19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413930, "uuid": "dc108ace-cddb-48ee-9813-141cada64d7a", "comment": "Malware payload (Smoke Loader)", "value": "1d667d53356f42d6033558a0533f9f2e310df01af502f96e8b4d1f4660a9c4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413930, "uuid": "28ab6987-5a57-41f8-b26a-a60903adcd73", "comment": "Malware payload (Smoke Loader)", "value": "4871db8f5435959f88b3d033cbc32f669441e762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413930, "uuid": "58424589-9ea1-49ea-9bd9-bc045ee25412", "comment": "Malware payload (Smoke Loader)", "value": "38cc9d781ed5d015b11ffbf89d43d1ca2cdbf9ef002e36d11be224e99676456fcbeee7463f84d822a1c95638f57a30e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413930, "uuid": "0ac7479f-3807-4f00-88f0-ff58f4c47db6", "value": "T16364E75782F1BD44E9278B729F2EE6EC771EF6508F89776922189E1F04B11B2C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413930, "uuid": "1d439eab-dd79-433d-87d7-90285ea61112", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413930, "uuid": "c7ca1715-1ca8-4d4b-ad37-5ca12c5352bd", "value": "3072:dbZ0Rzy4l9lEUWO1HaitG42JotPDQRetje5PdkFUXdZ315U:VCRl9qfO1HI2tP/t4TNhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413930, "uuid": "78fce602-06bf-472a-af39-a246892b6b5f", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413930, "uuid": "4204de53-f4d4-4e6d-a077-6b1432423f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413930, "uuid": "63783a53-b75b-497b-86c1-126fae3a3496", "value": "bce2d7b736512258ea55585c4d8cec19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8de9bc6-9059-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1701442632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442632, "uuid": "7a1e1410-82a8-474b-b1af-a10a0e800489", "comment": "Malware payload (CoinMiner)", "value": "1b8dc924ebb32f35a93eff55de2ed8ab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442632, "uuid": "22bad9bc-f9ff-4742-8c3b-70a43c5fe988", "comment": "Malware payload (CoinMiner)", "value": "1f263926aaa7019b95c3d64e87f6d4f734a356018b3aa3f6f5b9bfc787fa2dba", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442632, "uuid": "e5946047-ab94-4325-8dcf-30b2d7bb8a9f", "comment": "Malware payload (CoinMiner)", "value": "a30498dd06e5046b848bc423e3f094e0096ea1d7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442632, "uuid": "1023ebdd-1658-4d55-a8bf-dd57483a37b8", "comment": "Malware payload (CoinMiner)", "value": "65b4e1334e2ff47a86c83ce68fc0d092e8758a17c26cfeda26d9013bf4a5d883909793240678dbdd86e5503e733eaa5f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442632, "uuid": "6c39a7ec-60bf-44ad-b41e-c4ced1eb569b", "value": "T16B449D2276D19831E51749324E26C6E82A2AFFA18F2067DB23547F6F5E312E1C675F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442632, "uuid": "99e11554-d2fb-4e1c-832f-ed254ade70a1", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442632, "uuid": "76abf458-749b-46dc-a5a7-5dc3dfa27366", "value": "3072:aSpdy9Dk3dTNRFBnZ+0UFPtdhmGoooA+XNEFd0FSXk7N5l7RDukNULvpYsnBnoOs:aWWkNNzl00UFPtpotI0ZRDpNULR1Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442632, "uuid": "93a87713-a721-4dd5-8ba8-f2e72b693c89", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442632, "uuid": "5243054b-148b-4022-960f-2fd5dffe3918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442632, "uuid": "b6889f78-ca35-48ba-a3d6-6ab79af7921b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b0875b-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454816, "uuid": "e42ee0f9-5265-4d08-8bda-1953095d1852", "comment": "Malware payload", "value": "5086e717b3bfd25ef4ad4965458b8b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454816, "uuid": "2e81ac6a-0052-4204-9617-c1c943e99d74", "comment": "Malware payload", "value": "2013fc52d83561eaec94eb4c86675eb63be50f1851d60d5dee8b88258f3e72fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454816, "uuid": "fd54142c-ed45-47e1-b1b2-2077ccfedf53", "comment": "Malware payload", "value": "a27f754e730e78c852d3c7883fd1fa65a82ef2a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454816, "uuid": "bf3f8030-340b-4ee2-bae1-eb6d70265643", "comment": "Malware payload", "value": "a241245c454f325e8e6ff48b548be2bf3069b530c1878d4b97e890f582e4bdd18c2b73b4c75b9dd6392e9360c29ca21c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454816, "uuid": "cefd0075-1b0e-47c3-92f6-6f494910b738", "value": "T112F5CF52B3C1C0B1D49A6A71D47BA3B6AA30FE01E73599C763A03D08BD713D1693639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454816, "uuid": "a93909e8-397e-4557-a7c9-9efd62b3c7c2", "value": "6952bcf0687d5716ab21814698908549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454816, "uuid": "8cd8a259-947a-4489-b973-c0ceae5fe74a", "value": "98304:ENVuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuTuuuuuuuuuuuuuuuuuuuuuuuuuuT:EbtiZ6mnEzsyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454816, "uuid": "75a4131d-5afa-400e-bb63-27f412db6a36", "value": 3616286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454816, "uuid": "2d60b42f-622b-445e-b932-0d62966e3e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454816, "uuid": "18e8170f-6172-433c-b764-83ad39b82494", "value": "SecuriteInfo.com.TScope.Trojan.Delf.22436.16193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22549bc3-908b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701463774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463774, "uuid": "c814c793-4d6c-479b-8880-f5cb0d90b3a6", "comment": "Malware payload", "value": "91d04346e7f17b8e2aae64d27f042adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463774, "uuid": "bfbe4fb5-aa87-4e81-92a5-9824b6c8b610", "comment": "Malware payload", "value": "201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463774, "uuid": "8b975910-9a3b-4752-8a89-8d39af3ed3c8", "comment": "Malware payload", "value": "36e3c72d06975bbf8275f96a9978be4faa6a7848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463774, "uuid": "3520acf8-700a-450b-b0fa-ef1d1b50dd78", "comment": "Malware payload", "value": "508ab12866742f3ba71261ee56cc1c579e9b771f0cf9f12c4d12e55570f38f4724dacc7c25c88b489d0ea390ff7ed6a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463774, "uuid": "9dbbbf7e-23d9-43cb-a0d7-d2f757c5e972", "value": "T181C533835B980A61E47D0673A8CF6825B44C6CC14F94F8DF64E1B3C499216EA5DF8ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463774, "uuid": "7f58f274-3921-441a-ab50-3e8b6282afd9", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463774, "uuid": "9ee0c081-fe77-4d31-baf6-a27e0248ec1b", "value": "49152:knvVwOy5ObqmiB9hWGw54UYmbRx+USKVCZjOypc9cofHWJ/pviFkO:kGx5myXWGIYmbRxBS5jOyq9cofHWJRlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701463774, "uuid": "bc56113e-d702-4519-9f7d-9437d4a0386a", "value": 2650624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701463774, "uuid": "7a2c40cf-037f-4e40-91df-1503872630cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463774, "uuid": "6f70e927-6503-4ba5-b78f-590ff6b80773", "value": "yljlbesdmoas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedc314b-9061-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701446105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446105, "uuid": "e83eeb1c-e757-48df-9c57-8a041455d53c", "comment": "Malware payload", "value": "55e3941e7602d88f9909f90d80baa12a", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446105, "uuid": "393328d5-6926-4af7-84e6-177921770ac4", "comment": "Malware payload", "value": "20328af5f4fa5e23a1ca821cc0f5201cb7aec1ad3e5b4cc6689d26e126ecbf47", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446105, "uuid": "0fa27c56-43f5-48fe-9e87-3556a836293a", "comment": "Malware payload", "value": "11a5a393fd134d37f2ba64d3878ab13819910ed3", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446105, "uuid": "931ae593-c094-4184-a56b-1be05ab8e5bc", "comment": "Malware payload", "value": "efa853af37cada74f38acd8ab1af27db155393fc85a878243878f705870596f810a62c0a6c6a97b4d12a519902a8be4c", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446105, "uuid": "58b0d9bb-da77-4c7b-87ab-eccdf9d9fe7a", "value": "T1FE5733852CDFC0F5E6C51964861F76DF07F186A68994892CBEC03CC7EDA1F7260698A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446105, "uuid": "1dc6c163-fe12-4839-9e5c-4a5060160c05", "value": "ac86e77886b9065c351159bf0f98d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446105, "uuid": "9c15fe6b-f26b-4853-a5d4-ca0676f19c47", "value": "786432:85fciOw1e943jMwS4cOBUsBPh/V7AtzOf4E:8hcfT4k4cOBU+Z97Atyf4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701446105, "uuid": "a3bf561c-67a6-4367-9b59-597b3c42d619", "value": 28102144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701446105, "uuid": "3bacea7b-16d2-4330-b52c-3d88a6faf8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446105, "uuid": "6c45cb14-a3ad-48e3-a3ff-30cedb6251f8", "value": "avutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cbfe69-9071-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701452663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452663, "uuid": "ed81e558-af55-4bfa-8e81-225eded68a45", "comment": "Malware payload (Tofsee)", "value": "09e86355c9c595720b5a6154426c9910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452663, "uuid": "f39b90f9-0843-4546-a28c-d71e6adc6871", "comment": "Malware payload (Tofsee)", "value": "204063581a5aac527fc0be421097ddc37b338cedced74ca6858f88f3d31bcc51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452663, "uuid": "e41ace03-1fff-4cb8-871a-a83c8fd757dc", "comment": "Malware payload (Tofsee)", "value": "83b66aaab60f02c75b43ce10e5b77ba87646e2e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452663, "uuid": "af13ec1f-ccdb-457f-b9c4-f9334a755529", "comment": "Malware payload (Tofsee)", "value": "ac0ee671303f5f7cc697cd3c4f60fe2306753d7283b7738ef8f5775937d3d68a8c36b138278cb8bd25d681d291cb622a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452663, "uuid": "2e03e0ab-faf3-46e2-9d8a-4e06073867c9", "value": "T122641A1392E17C51E9264B328E1FC6E8761EFB519F7D37AA1218AB6F04731B2C162F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452663, "uuid": "f4ea1250-108d-4e88-8d7c-27cf6323adea", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452663, "uuid": "3b16fc28-29cf-4b4a-ac23-59403e62c055", "value": "6144:H8prBAyFXYy/6LDrWvzVYWMsfKaA9Vpwpp69a:Hi0y/6LDiuWMSFeCII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701452663, "uuid": "def7930e-8242-4067-b065-ab49365361a0", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701452663, "uuid": "5a6ca1aa-043c-4fe4-bf1d-fc645f15e200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452663, "uuid": "14964cb7-03c4-4683-bb89-f5ffb707fa6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667f2c91-9000-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701404188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404188, "uuid": "60e61f20-1a5c-40ea-9c5e-5b3b6635211e", "comment": "Malware payload (AgentTesla)", "value": "2e3230f17c04b24a70dd68a4f11530ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404188, "uuid": "4a4eb687-3a69-4db8-a885-64ce06598659", "comment": "Malware payload (AgentTesla)", "value": "2098a0c04c68816feb9f55e8de37b4de35fa819850dda0390559f1f83ec0d6b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404188, "uuid": "3e3132c6-e61c-481d-87a5-ba46bf661eac", "comment": "Malware payload (AgentTesla)", "value": "49e4e8b895689185cdc30b875e4dbc073bd30fa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404188, "uuid": "93c2574a-920f-4b4e-82ea-0f491543311e", "comment": "Malware payload (AgentTesla)", "value": "cc4bf10deebadc2e6cf35b5ebe2f5b604ef1c4d36ec45c3f6fcc1270fc7beb6e39f6cbef757a109e32a969cd92aff46e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404188, "uuid": "eff8c608-9783-4df6-844f-2d05aa7ff94b", "value": "T16CC40255335983A3D67B9BFB3888544483F2B42B5820F31C9EE210EE3675741DA93EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404188, "uuid": "12faf720-955c-4be7-a65a-a33863ff4045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404188, "uuid": "0e5804a0-0e5a-4cc3-a356-869cfb68056f", "value": "12288:OCDKJGIcvENhRA2OEIX0jrNWBBs7scQH0xNj9Cx9TrIh:PKJSIAdEU0HNWBmnQUxnCvTrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701404188, "uuid": "0f7c85d6-2bc8-442e-8a8b-89361a616c4a", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701404188, "uuid": "efe26a62-3773-4d59-a0c2-03e674c8da84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404188, "uuid": "1ee157c7-f9c8-497b-98ef-0558aff13449", "value": "SecuriteInfo.com.Win32.PWSX-gen.16993.11761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b8f14b-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454832, "uuid": "90ccc167-5cb3-495f-9b2c-c92a048d568d", "comment": "Malware payload", "value": "eb8f5339f94ec748a536417c28bf9f92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454832, "uuid": "88918325-4404-4680-b0b4-0b67f52bcf5c", "comment": "Malware payload", "value": "20b61a74c99c04c4efb399480e7a5ef292483dce16799f802a04cf5ecc04f6f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454832, "uuid": "00eaf287-8822-48b8-b70a-b38f3a36ff6a", "comment": "Malware payload", "value": "a6435152b1a75f75911320eab9c106832b98be21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454832, "uuid": "e5d3ab6b-1a99-4f24-8020-db25fa210194", "comment": "Malware payload", "value": "e3b60ab37fdaf8d4e77b97f7df2137777919057b99011e0056d065fa0cdef1622d9f30c970e05bb6ec0dc9b28c087e93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454832, "uuid": "989c9305-9a21-4b46-9930-5278fd730326", "value": "T12D545B4A7D90FC26CC2D19323DA3EAD4DA73AC085C54C68F2A697E9CAD3E1405D375B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454832, "uuid": "b4c9f212-0083-4b3f-88d7-f5e277269d33", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454832, "uuid": "b652a320-cebd-4551-9947-e233c99063da", "value": "6144:+RR5rhZFQGrsUwF7vlPoSQMjQG0kG6BME0LXvi25u64AMY77OrpQ:+R5nWFpPoSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454832, "uuid": "0a2bdee7-88b2-487c-ace3-0ec544aec345", "value": 292340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454832, "uuid": "78f7101c-c847-46a3-9b1e-42fcc144f351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454832, "uuid": "cd33aafe-ad3b-44b6-b173-cc862a43c62f", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.20313.7137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba48db7a-8fef-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701397028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397028, "uuid": "4313262d-dde2-4082-8294-db635a8496fc", "comment": "Malware payload (Socks5Systemz)", "value": "c27dcb0a9c1bdbceddd4736040e28763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397028, "uuid": "3f94fb6d-a664-49de-9a63-8ea46b62f462", "comment": "Malware payload (Socks5Systemz)", "value": "21db543089b61c3e2d6aae87724b604fc8117ebbe03fcb2bb4db8d02a54dbb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397028, "uuid": "cc517e77-3ffd-4fe9-9efb-952cfb550111", "comment": "Malware payload (Socks5Systemz)", "value": "7b4c3abf4007b08dbcff10a337762ebdea9a5211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397028, "uuid": "b1375c5f-7263-432d-b7c2-2270c13dfa0e", "comment": "Malware payload (Socks5Systemz)", "value": "91a5ab24987a38ff353a0c73136b64a47eb756a20e6d142ecc69b7acb0b9132722c32944e69aa28fefb803892acb3bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397028, "uuid": "b58185ad-55c4-4b0e-abb4-6659781fbd0c", "value": "T103E533414A5BC4B0F671EA750FE3DA80825BB9A334311DD991DE4F5F6B2D382B82B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397028, "uuid": "5f7a4c83-5c80-481b-9c30-d6e0b34943b1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397028, "uuid": "63524fa5-0a1c-48ef-a0ac-bd8e20a6f1d5", "value": "49152:E22LK66sfh2ceGIkPOdSQcjWuYvaXqAv48k5NitFUKa37NxMzr02E/sI:J2g+qkmRcjWGXqAv4DNiDkAzr05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701397028, "uuid": "7f8c2d32-7b8a-4255-bb92-cc0aa2befc26", "value": 3217801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701397028, "uuid": "9fafd737-52a1-43e3-bada-85ffcacca4f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397028, "uuid": "8c52cf6a-0b2e-4534-82a2-b3345cca4745", "value": "SecuriteInfo.com.Win32.Malware-gen.3376.27092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2b8a0b-9045-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701433998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433998, "uuid": "2f364fcc-5d36-4997-a46e-2ea76ffafbba", "comment": "Malware payload (Socks5Systemz)", "value": "2b08603b06f06408aa20de816bd73d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433998, "uuid": "b027431d-01ce-458f-8293-111e2743c8ae", "comment": "Malware payload (Socks5Systemz)", "value": "22fdfde16d444cb9abe26e5f06cc4d7b72b98499a3819240615fef58cf6b41e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433998, "uuid": "07daef12-160b-46b4-bc6f-95a69c8b2b51", "comment": "Malware payload (Socks5Systemz)", "value": "522a61c33ec2639d10229a1f205c433916c0551e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433998, "uuid": "a9b84fef-0241-4d5f-bab2-f16ebfda980c", "comment": "Malware payload (Socks5Systemz)", "value": "b87dce1f4a1276ceec866b4c86d9c43b453eb971677ae3e1c1b1c825d1d244835f1353dafd80bae933fea7b15a9178fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433998, "uuid": "3a8848c1-52ac-4941-a055-b60046ac446a", "value": "T17DE5339212B3C436F891457248E8A44496D3FA214AB47D96250EC6CABB335D6F0EF37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433998, "uuid": "e73960fb-3abf-4ac1-9d03-b45370ad1fd3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433998, "uuid": "b6d19a9c-124f-4535-9ca2-3e0ffd4c4339", "value": "49152:M2V9j2tB8nFGjZqzfN9VporsIKpeN+sivVAvtgUeYqpMqK9b7Bz/sI:hV9KBi9grsIKcNBivVA1g4yMx7Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701433998, "uuid": "13f3cda0-0821-487a-a2f0-a223dae7dbc4", "value": 3102974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701433998, "uuid": "0779d368-c0a9-4c77-8849-9305b7b91c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433998, "uuid": "19577cea-1b03-4971-b4af-371c10e3035f", "value": "SecuriteInfo.com.Trojan.Siggen22.21729.26506.31765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee27b37-9045-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701433999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433999, "uuid": "aad2336a-e073-4355-b891-6780bfded9d1", "comment": "Malware payload (AgentTesla)", "value": "98a8b2d442934424bdb49020bc3a6b50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433999, "uuid": "25185d79-8e42-4f1a-9eea-0c0c1f917d23", "comment": "Malware payload (AgentTesla)", "value": "237694adba91b73248b5c823bfbcc1c2169ccd44871be880926a6bdb6d665540", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433999, "uuid": "ca2d97ee-6275-4f99-9166-03b04b260997", "comment": "Malware payload (AgentTesla)", "value": "707004b4e79bb255c6128e54db6867713f8c5944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433999, "uuid": "d248c7b9-6ead-43da-9347-a568518dfa74", "comment": "Malware payload (AgentTesla)", "value": "3ea752deff03a4c7cf6bb8c3de820ae0415559d9172599860d6ed1f44a952467cb8b58d3068ab6e9dd16d0c70ddaaad0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433999, "uuid": "00f53ec8-aa9b-4d19-b493-2d5ae46a2445", "value": "T160F4E024E1F96B52D6FE93F0441466280BF7796AA43DF32E0DC9A4DA2675F014A43F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433999, "uuid": "5037145b-006f-4414-b400-daa678b208a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433999, "uuid": "730aaf2c-40d6-4ad2-a670-678da4cb18fa", "value": "12288:s+dIr3FcoVbJMVGioYAo9AfTLSmvSlVwVE6D8uZD:tu3XM+UULvcRud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701433999, "uuid": "1eff5501-0460-4c8b-890b-295cd3bba604", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701433999, "uuid": "3d6635c6-b5da-42e2-97fb-67609c50da61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433999, "uuid": "01ece297-6c95-4ada-b44d-92f8707be835", "value": "SecuriteInfo.com.Win32.PWSX-gen.11216.12023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ec1c96-9099-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701469815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701469815, "uuid": "f007559b-34b7-4073-9318-4080fc8f3a02", "comment": "Malware payload", "value": "b5bcb7641e9ea0c920fc3d733e152892", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701469815, "uuid": "7e004d2a-822d-4fa7-b0b9-f29b8e3e8485", "comment": "Malware payload", "value": "23c318388babac5153bd0f4526bc5201d90cdb7d1c485a52dc156e1515ba7d31", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701469815, "uuid": "d8c4051e-a9de-4fe2-8be8-0438de4db0ca", "comment": "Malware payload", "value": "20466e06be5f97bdc98e56eed42a5405b2706945", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701469815, "uuid": "4cb33629-c9d9-4673-b806-d79d62f4ccfb", "comment": "Malware payload", "value": "30591ac4bf5c223a8a4f4ab013a544c56f673f3cc7a16a58cf11c9b465e51e9f263f3f432b0d0a0991deb683dc382191", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701469815, "uuid": "81b65906-6fd7-46ab-b6a0-79a76b8fa7f9", "value": "T1B7F533D149CF03EE2F27A598CF9F0A6E0D0DF06AF7D4185A92AD01BD735CA91E136858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701469815, "uuid": "c783afb4-7d67-462d-814d-8d24ddaeeeba", "value": "49152:/nresUwPx23ric7V6ZDPpUWUMmPmdx8EskkFj/es0QVctOp1T/tn3Sr2VQJeurBw:lA7ihPyNMldiEIR/z9OtS/RqUQ8U9Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701469815, "uuid": "851909a2-6735-4002-b5a1-2ced3d0f7dd3", "value": 3593480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701469815, "uuid": "d8e4e360-d98f-416d-897b-e8c19990bd46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701469815, "uuid": "67c0ffcc-6ff9-4192-aebd-43d83ae29541", "value": "1511.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1224d8d-9008-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701407776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407776, "uuid": "350947be-8a9c-4369-bdef-dbff76bcf9f4", "comment": "Malware payload (Formbook)", "value": "209f35585729237e5ad4c91baa385572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407776, "uuid": "6eaed10c-feb1-483c-94fa-fa720f3cca04", "comment": "Malware payload (Formbook)", "value": "23c80d4ff63858e20b32d5e1b04c726c29bff6da8ee1d689cf2cf9628ac045a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407776, "uuid": "e84cd653-c997-48b8-ae1c-a18b36d08cbe", "comment": "Malware payload (Formbook)", "value": "50811efbd4dfd66b1fc9c9c984c05d70f04e914c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407776, "uuid": "4dbd4378-0a26-4fec-ac17-3a720e8b7149", "comment": "Malware payload (Formbook)", "value": "92d9de9323760b966033219a122d5ca71e1c07459af8fb7e6678fbacc571f50b4143905c7e48285af0dd34c44a8845da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407776, "uuid": "50873d1e-5394-4cec-b937-14bdfd33882d", "value": "T186246C10B4D28072D4B3093548F8DB79AA3EBD614F258EEF67D81B6D4F342C19A31E66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407776, "uuid": "ac140826-8471-4d29-a346-e77e9bd6241e", "value": "1acf5a1b530e0646da6f35fd47907635", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407776, "uuid": "751dd10d-9190-4983-bbb3-1b3d8c61173f", "value": "3072:242TH3Ji1YNURZd6TDXJppDoVKs+Y3a3rw8gpSt2GuAg0FujoZKgiptlp1:24KX9mZd+D5piKcSxtAAOiOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701407776, "uuid": "953f86ec-69c6-4e83-8d16-e9c3bde069c7", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701407776, "uuid": "175de619-a307-4576-b26f-c0efb8a080fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407776, "uuid": "c3424b78-8161-4d14-b5ef-9f3c199c0b65", "value": "SecuriteInfo.com.Win32.PWSX-gen.31903.3372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4746b1-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435202, "uuid": "8b3e3d8e-b619-47c3-9744-084dcab7b6f7", "comment": "Malware payload", "value": "01eb11ae8a8e24ef33c6e46dd9cc1520", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435202, "uuid": "f4ff4e03-f965-441a-9bec-827e44f3f876", "comment": "Malware payload", "value": "23eaada92c470bd95ea3deddffef36280cd860863d7220357570cd9529b10819", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435202, "uuid": "a0fd7064-00a7-43a7-b361-9f6dc312adf5", "comment": "Malware payload", "value": "9ad955c4b4f7ae11c122ecea23a1743c1f0dd320", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435202, "uuid": "13fb8212-dafc-4735-bbf3-1c7b52dbc979", "comment": "Malware payload", "value": "42e543cf803aa9f3c0c35f96b7db020d69a4fc2cd19aea9ccbfde073c1f4cf07e9ae398731bb975e203f9cfa459b8602", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435202, "uuid": "3bab8d25-968f-4164-9932-c74de477efa3", "value": "T135560179731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435202, "uuid": "688a2821-9734-4b71-bec8-baf660cf6c72", "value": "196608:/6DGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYE0:+irUVis8O/0giAZ9PD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435202, "uuid": "1f73f083-65f1-424c-abcb-02c7f08294e2", "value": 6384573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435202, "uuid": "a66d657e-d0ef-470f-8e41-da154cf61e24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435202, "uuid": "1e61b4c5-73fa-4dd2-ae6c-2927420f62d1", "value": "\u0413\u043e\u043b\u044b\u0435 \u0444\u043e\u0442\u043e).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d3c93-9054-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701440187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440187, "uuid": "92a77408-191b-4b15-be5d-ef2ab34300ab", "comment": "Malware payload", "value": "535f001f214acf8cae9b752236d9a413", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440187, "uuid": "e09cce8a-abd4-4a4d-bb76-304c43adae8f", "comment": "Malware payload", "value": "23f1c2354bc172f063578d93a6f4d02f5fcb02d2141473828f3f0ba427ff5ab6", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440187, "uuid": "e956e858-e805-4456-a476-b78b2d5d8adb", "comment": "Malware payload", "value": "5ed50a5e7d94aad3165e2f3ba9e05abd9db9e324", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440187, "uuid": "7685f8cc-c710-4649-aa71-1eedc7d8d4bc", "comment": "Malware payload", "value": "d33d1ac09d3eb65077f2b0c47f33551459263aaca8d2a686fcc8aa9d37c76e95a826c8712e601bb48e4bc38e7ff9c23e", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440187, "uuid": "d0682b0b-23ee-477c-b6a0-ab362ee3ad4a", "value": "T1BDA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440187, "uuid": "68286c58-ecb8-4ab8-bf5e-2402e8c81820", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701440187, "uuid": "0777c9d4-594e-42f0-b226-2ef7a13a2b95", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701440187, "uuid": "e6aba8fd-30bc-4815-9dcb-61abda381461", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440187, "uuid": "7f2d8663-0ae1-4a5c-aecd-197eb3e14ddb", "value": "23f1c2354bc172f063578d93a6f4d02f5fcb02d2141473828f3f0ba427ff5ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3de64ae-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435215, "uuid": "4edb8e57-cc4c-48b2-adb1-d58a1d85e59a", "comment": "Malware payload", "value": "4b96e04f1b9a36f5f3f736544444ff07", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435215, "uuid": "c577d9c1-4f7a-4062-a387-fe20088a582d", "comment": "Malware payload", "value": "247448a009978a8bfaf5b7d13031203b346aad889384b823d2a76565bc2a4de9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435215, "uuid": "c7b5a96b-31b7-4170-b480-4ad1327e0e1e", "comment": "Malware payload", "value": "96e81e660d453728b28590b149d00dffe189ce28", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435215, "uuid": "c441b984-c3c1-4abd-a16e-995d0e5824f3", "comment": "Malware payload", "value": "bdadf4b8d9f5123b5ab44a107919f2d77f7e8436a2e6472dcaf1776f0767678db5ac1d05d933a942bf22cfff86fbb490", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435215, "uuid": "cd4b89f2-82a1-406e-9856-92f02d3a7654", "value": "T187560175731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435215, "uuid": "af2d697c-d65e-4442-917c-6b260554fb5a", "value": "196608:/6DGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJY5BX:OirUVis8O/0giAZ9PDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435215, "uuid": "ac86cb8d-d427-48e6-b050-b41e73fb305b", "value": 6368186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435215, "uuid": "78297f36-8850-4a6d-a65d-65eaa8d8d3cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435215, "uuid": "138556b0-ceee-42cc-825c-b4874bafc706", "value": "LIVEU - \u0416\u0438\u0432\u043e\u0439 \u0432\u0438\u0434\u0435\u043e\u0447\u0430\u0442.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a41d7e0-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1701416301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416301, "uuid": "aed1968b-44e7-447e-bc4d-674c9fb9a8c6", "comment": "Malware payload (MarsStealer)", "value": "e47d4a3c6c18349547847ab18211f323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416301, "uuid": "d0fe306c-a294-46be-ad1c-342a50b8bbb8", "comment": "Malware payload (MarsStealer)", "value": "24ab05b58fefbbaddf9d332076e9f9764a3610d7985be88dd6054d68ec991618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416301, "uuid": "c90a6ab2-67e7-4dfc-88a8-70563d0454ef", "comment": "Malware payload (MarsStealer)", "value": "10a4f47c73f73517daff9180abb0abf2b449727e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416301, "uuid": "b8430c41-ab8b-49fa-99be-b1e369d52b99", "comment": "Malware payload (MarsStealer)", "value": "1d7a4f353845c58e994a0a8faa683374787a23c46531b6696fc58b74f774a2dd400888dbc1d9b7c269903b7600b026b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416301, "uuid": "047c672d-b54b-47a1-aa60-0148d26384c1", "value": "T1ADF63302E789CF8BE251C1709547C5706A267CAEE60BD33B29C07D63BBF1399114F66A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416301, "uuid": "41cead56-a75b-4b48-8d3a-1b02b517bfd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416301, "uuid": "acf70d79-0813-4f08-b37f-693cdc48d41c", "value": "393216:9ftwlfMewL9oZkrA4vPZ5UtU0K2g1fxKlMwo39d0V:VWnwLeZkrAm5DvfxKTET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416301, "uuid": "0cd0e46c-5f05-4a07-abb9-30b2c73b6261", "value": 16422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416301, "uuid": "05aa06b8-a996-4be5-8320-82112f208daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416301, "uuid": "10d0eb82-178b-45c9-8c70-f695858e9082", "value": "Baldr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55cbea3-9063-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701446841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446841, "uuid": "fb5f24d3-00da-4a86-87d3-b856a3c22aae", "comment": "Malware payload (njrat)", "value": "8ea3b78d2fb89b6917d226e489b910e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446841, "uuid": "a6d3b4e8-10e7-4fc5-b086-bdca3a99aeb0", "comment": "Malware payload (njrat)", "value": "259f3e4c5ddeb1aface878f1dfaba982ef622118c7ac5ef361c25f8d8c67fe03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446841, "uuid": "216d5018-2cc4-4616-960a-ccf16b408861", "comment": "Malware payload (njrat)", "value": "ca51c6c6368ee8deac45574bdd103f79dbdda5eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446841, "uuid": "bb5a8d95-8d13-4217-822a-9b8db6c9ef8e", "comment": "Malware payload (njrat)", "value": "2d4a86c7ecc1b5f65610e751ff1959a7c194cfe2c9d80b2b924d448f11c31f59bf1a8df0c1f6a4067e19e7599e94f9e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446841, "uuid": "2c3a46aa-43ea-493d-84ba-70a09573d444", "value": "T16FE208067BE94215D6BC5AFC8CB313214772E3838532EB6F9CDC98CA4B676D04245EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446841, "uuid": "9a6ae60b-3566-447b-8842-c268de8a14d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446841, "uuid": "da946a19-5801-44c8-94f9-7b6c15489561", "value": "384:70bUe5XB4e0XnOZzw0Q0mS03AWTxtTUFQqzFMObbV:4T9BuOC55dCbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701446841, "uuid": "26191591-4a9f-434b-8e05-7bd560b3abf3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701446841, "uuid": "ada2056d-2ff3-49b3-b75c-f3c07db32744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446841, "uuid": "0e434b3f-68a9-4fc8-ae2f-888cacaead0d", "value": "bSco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea33fd1-8fef-11ee-8907-42010a9c0042", "comment": "Malware payload (AndrMonitor)", "timestamp": 1701396954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396954, "uuid": "0ca4e53c-dac1-4490-b95c-f865875a6b02", "comment": "Malware payload (AndrMonitor)", "value": "5ac9e453eaa0e2e2346f2600c0ce8109", "object_relation": "md5", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396954, "uuid": "9ae0fdeb-6287-408d-bed5-a211c1e77640", "comment": "Malware payload (AndrMonitor)", "value": "265a0c96a6289c3273d24fec06d674ea07c7b729301b9ff3bbf2748c15777e4d", "object_relation": "sha256", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396954, "uuid": "d294e724-9377-429c-9b26-586f1d5b116a", "comment": "Malware payload (AndrMonitor)", "value": "a8720196468204b731dad2a6a33867f1f957e1ed", "object_relation": "sha1", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396954, "uuid": "008360ec-5c97-4b28-aa7e-7a94806a5c5d", "comment": "Malware payload (AndrMonitor)", "value": "c3bfba32d8440fcd9e34994ee374a32bfda8c8c70c0fd86d54704f89e1a0bea993964ddfc4ae20330a64dd5cacd56551", "object_relation": "sha3-384", "Tag": [ { "name": "AndrMonitor", "colour": "#36C9EA", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396954, "uuid": "18f01777-0ef2-40f6-b48b-3b2e80a1d9e8", "value": "T11B2733735C0A9AE9C0316475157E6385A876CA2E3EF3AB111418EF63C5F3964CAC9FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396954, "uuid": "943d11bf-895f-411e-a39a-35595c9b3b1a", "value": "393216:pRVzUxsJA35z7A79L+neV1mbgafiubcMZ3bnT9i/zVN2I+TXQ9uKpPbNiRSKcsZ6:p/UqJA35z7c5rTmbBffcO31i/zVN2IkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701396954, "uuid": "03aa8b84-f646-4f99-bc38-27d8833439f8", "value": 21498723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701396954, "uuid": "934583b0-9158-4e20-b77f-dc62bfef97c6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396954, "uuid": "e84917e3-eb15-49b3-b03f-c308e0ef87f7", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d16f56-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413316, "uuid": "e6a971c7-19f8-43a5-a32c-b76c9f15e5f8", "comment": "Malware payload (AgentTesla)", "value": "e87a53f8119728e8c0e5432276f1fbd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413316, "uuid": "9627ebd3-fed5-4d1a-a849-2fc5a012af1e", "comment": "Malware payload (AgentTesla)", "value": "279479d7f8311dc31a6123bb46451795ae79864582bccee23e3262119a218f34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413316, "uuid": "3a34ce21-1d6a-4d86-b251-f349f98d4f92", "comment": "Malware payload (AgentTesla)", "value": "617316663be1c8fe0a31d7e989ce7eae0a93e922", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413316, "uuid": "94c84644-8a31-4d96-8852-6360ad673987", "comment": "Malware payload (AgentTesla)", "value": "b577fe1650ab8d756f9c207f1f256ab349381ef8f03dd18771fae3d1051b583e3517389f38167e5cbeb5e96e292a2cae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413316, "uuid": "590e227a-75c3-429e-89b5-3c3a0b43ce09", "value": "T16B05F185BAB9EF1BD23A7BF20950509107F190AA5232D70E1EDA71D7D854B131F82F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413316, "uuid": "8987106d-b01b-44b2-8201-959c14867410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413316, "uuid": "22c8688d-7061-4cf7-9706-016f3be2deba", "value": "12288:asxTA6qNb5y7QsDzVlEcSqXbUsiaB3xeX2lfpuMtUzKVXPTt0uSax:lxs6koFzAcSS+aneX2lwMlVXPZMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413316, "uuid": "f7768cb3-2706-4fc0-a8e9-3ba9941e3d27", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413316, "uuid": "35c2c194-0ff4-4944-beb3-c730be8439d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413316, "uuid": "87aa77c2-3950-442f-b990-d9902e593dc2", "value": "Invoice 3892764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf1de54-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701413834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413834, "uuid": "8fd6452f-9020-44f0-b994-6ad1a43d8c99", "comment": "Malware payload (Smoke Loader)", "value": "d067e333890f02df29a5e4ca78ea7c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413834, "uuid": "bc312a35-c162-4610-9893-564441db4c7f", "comment": "Malware payload (Smoke Loader)", "value": "27f4f0e84a00e66fc9146d76fb7df56805b44a55c0186eb61230332f69c3d687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413834, "uuid": "d45600b3-ed34-475b-83c4-36f068a9a061", "comment": "Malware payload (Smoke Loader)", "value": "f06b689cd2bdb6146e0adae353940265a964ec32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413834, "uuid": "0fd80f68-d27e-4375-ab24-24b3840e3b3b", "comment": "Malware payload (Smoke Loader)", "value": "022b05f45f29f135fb93a49fe6c27c8d6a257051557a45fe4eb15c4c18465afaa1bba16ef5664a2ee9b6372550234ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413834, "uuid": "57a007bb-9a6d-4ec1-b541-b0271be119d0", "value": "T14034CF21B6D8C4B2D22799364961CA655B37BCA29B6186CB37C43F3E4E312E1CB74707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413834, "uuid": "71754ea9-c154-4609-b2a2-dd0dff54cfec", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413834, "uuid": "d4fdac5c-b862-4536-ab85-4787950369e3", "value": "3072:8/5SISWVDziRzrNNBakXgOtjDKc3QpFsjKn3g4zaAheCAGFyoZmfhkkwswCJ:Q7dzarnAWgOtjDKc38L3gHGFmfLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413834, "uuid": "40b4120a-fcf4-4cc7-aaf3-639d58ed8015", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413834, "uuid": "b792d16c-d56b-4a68-88c6-1c5b69a9689f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413834, "uuid": "b4e87437-9703-4445-82fd-d83336bc1a9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d257a2-903d-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701430432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430432, "uuid": "e25a8f61-13d6-4d55-9679-af9c2563c4b0", "comment": "Malware payload (Stealc)", "value": "0b839a80a2229dd90965e1d957fe5615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430432, "uuid": "2cafdfbf-39d7-4e90-9157-3abd44ebffce", "comment": "Malware payload (Stealc)", "value": "27f9fabd0c8cc215850373feb61598fc5e0ffce5b29f779fbdcc4e1f1583f609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430432, "uuid": "10fb0fb5-e103-4344-aa0e-2f9d8274b291", "comment": "Malware payload (Stealc)", "value": "e12e16c42c61e9f9959e029d676b3169dd5b4d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430432, "uuid": "e0cdd4c1-33a5-4e06-8480-de41a0194bd7", "comment": "Malware payload (Stealc)", "value": "b86b254f1f53a8f297ca08fc0b8cee842283f5df7e0b3092496928d8d727f75eef877a0ee04ddfaa60692b26e84004a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430432, "uuid": "8427344d-41f8-4a1f-a9c2-b24253594a9f", "value": "T11A34AF2276D0C432E36359394A71C6A55A3BFCA29B6155CB2BD43F2F9E312E18B74703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430432, "uuid": "ddf552ea-8321-469e-9f20-9f4fa4e6e8d4", "value": "1e5043715b5ec4c1a45256db4effd68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430432, "uuid": "7ede0a0a-ef28-4b7b-83ae-e382e17f41e7", "value": "6144:5hMWVmNwIUz799msCVpBjy86gbfrKQs18:5+wIUz7KsCT1yB18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701430432, "uuid": "1774db4c-3779-43d2-9b2a-ddc7a0c8cfe1", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701430432, "uuid": "99dbc78f-8df6-48cc-bdfb-a2122cd2281f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430432, "uuid": "7eae1fb0-b1a6-4aee-9392-2114845f3066", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4c49d2-8ffd-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701402888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402888, "uuid": "62acda0d-6a4c-4b34-9610-cf706cbfee18", "comment": "Malware payload (DCRat)", "value": "71ea6268f9069ce113824b4ad34384ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402888, "uuid": "04712f8c-2ffc-4313-808f-0bb854b2c55a", "comment": "Malware payload (DCRat)", "value": "2882b29fc8c4bc157b8416a4a621084557639de0dd7a86dcf0dda2e35b900517", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402888, "uuid": "c0ea75d9-1ae1-4e94-8fc4-48a51f567378", "comment": "Malware payload (DCRat)", "value": "c6faa871c7434ff60583de306b6947ef7feadc06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402888, "uuid": "d441d2a7-873b-4787-85e8-139d64e30470", "comment": "Malware payload (DCRat)", "value": "0135e1f05132b9887c3f42b33d4f4b01c2d97bab72a1cc78e4fe46dba2a141fdc3fcb37d96fa0b07f9fd188f21a7cc24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402888, "uuid": "3e272fab-f739-4206-a8d6-22a314f9371d", "value": "T17E3539017E44CA22F0191633C2EF494847B4AC506AE6E72B7EB9377E59123937D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402888, "uuid": "8a956211-c4cc-4784-b540-f06522482076", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402888, "uuid": "8c45c076-5ad0-438f-8157-fe77f5814d8a", "value": "24576:U2G/nvxW3Ww0tACSUGFzLmBqSQ25wE2yrnj4FA5:UbA30ACSxiBqSQYyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701402888, "uuid": "0b9da0e1-955a-46fb-b4dd-f00198fa27b7", "value": 1163921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701402888, "uuid": "5e253c15-d8e5-441d-9e0f-6c14c24519b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402888, "uuid": "9fa20673-8850-481e-8cc6-ae0c4b6c0cb1", "value": "71ea6268f9069ce113824b4ad34384ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2359b55-9040-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701431911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431911, "uuid": "143b4f0f-9395-4b26-b3ca-e07751ce6c6f", "comment": "Malware payload (Smoke Loader)", "value": "c4999a4067da8cf32cc1f4f755cb0d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431911, "uuid": "d85ad866-6c77-4272-af07-da797f20d8c9", "comment": "Malware payload (Smoke Loader)", "value": "2a5c11ee717304f47fcf1db502210920f3a844724ab911b021a4d1a3d4fe9703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431911, "uuid": "bab98a28-5092-4131-85ac-dbe1eca624f6", "comment": "Malware payload (Smoke Loader)", "value": "4e437f9be8eff459f26ee4054f6d307bc7afb12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431911, "uuid": "d1785d3e-dc93-457a-afce-ef8fc5b45300", "comment": "Malware payload (Smoke Loader)", "value": "346b5de580e8fc2e536e756ee79dd362831abc678bb1934a9331650fae984273ab3ba907248230ff8ca86876482fd614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431911, "uuid": "54dab83c-c5ac-42c3-b058-01c792d224ab", "value": "T18334BF2276E0C072F16759398961C6A19E2BFCA29F2055CB27943F3E9E336D18B74707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431911, "uuid": "a2181f3f-0785-47cf-94d2-ed1b90676d38", "value": "1e5043715b5ec4c1a45256db4effd68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431911, "uuid": "203c0ec5-ed3a-4a38-9472-e418ea2330bb", "value": "3072:bJUNydzjjVjpaB2zmNIUFh4HJRe9rQw1DmL3Xz0QzznxCQxTRr6wJA/SS:WWjhj8Uz2IUFh4+r3KXz30kr6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701431911, "uuid": "234c30d2-921b-4224-a576-a5d07acc3944", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701431911, "uuid": "aafc168f-4313-4e88-8e99-d947fb5190f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431911, "uuid": "b8fe5102-f619-4eba-b759-593022f74aaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dca8701-9046-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701434131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434131, "uuid": "1635e782-d4f7-4b4a-ae0e-7de4264b5d67", "comment": "Malware payload", "value": "8b74e875edcf9218f082a9f73268a3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434131, "uuid": "be0a0a65-631b-4e40-8324-49937c38a55e", "comment": "Malware payload", "value": "2c20cfff163a1eeb05d3200a175f51c785a3a3fc211b2d4aeb2db5e85fa29d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434131, "uuid": "56fce610-5f9d-4d9a-87fc-af5b35a71974", "comment": "Malware payload", "value": "8e2573aa2cf6ae1d445c9636ef2e5cc2b15438ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434131, "uuid": "ba6c61bc-7b93-4ebb-86c3-0e4422750232", "comment": "Malware payload", "value": "7b67b07d53ae4a8b9d919e7d226279e4953456f1bee2f0c13a51ded6c8ab3e6051f158eda037a476c32d6b172b29eee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434131, "uuid": "ce3050d9-5d8c-4139-b760-5874e76fa6c1", "value": "T17B2612E27EED085CF8D960734EF599B99E1BBCD87625062B2016727BF6337010E4A817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434131, "uuid": "489dc56a-5924-4192-9f79-e692813fb3bc", "value": "a9fcfb15a5aa9fa0f3b761a2696ae772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434131, "uuid": "1fa54453-4bd9-4634-9626-9b5150b4fbd2", "value": "98304:uifDhOv4OiZrq1DfPHNADtV6v+kE+utxBcIkmVLulVtzlUYgOIjkJ0JidsmmaFl:H8v4O7NADtV6v+kE+utMNmYlV7fgOIk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701434131, "uuid": "abb759ef-0429-4b2f-b087-5e954d7acdaf", "value": 4481552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701434131, "uuid": "de8a478e-68ea-447c-b2ce-206c1e02b180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434131, "uuid": "1d740029-25f0-48c7-9d32-e5492099e26e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087609d8-9014-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412621, "uuid": "a969afa6-e208-4b13-8eb1-0c82e7af02bb", "comment": "Malware payload (AgentTesla)", "value": "033029c129d3af6eeedbee6d7aa3842c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412621, "uuid": "5f8ff417-9e91-4d19-b0ff-56a543353f8a", "comment": "Malware payload (AgentTesla)", "value": "2ccf170ae2be29186c44ef1af4fa94a3c934e292c47099de6150599f00a476ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412621, "uuid": "c3d20bae-f689-4a36-97f9-a763cd908f08", "comment": "Malware payload (AgentTesla)", "value": "3c2e1b61888d14bad301ab12ad84d9e1f4553239", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412621, "uuid": "f045340f-c30e-4d67-8247-b868c93a1a1d", "comment": "Malware payload (AgentTesla)", "value": "c9227ab7f49d60785ce5018ec794e8eafbf8b56fce4fa111eeebb5e194eee4e65990500c47401c32490fca4a3704ab71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412621, "uuid": "eacf4e48-5f97-47be-9ed0-95edaf36777e", "value": "T116D423EA0B3B9DF5CFDCD620CF049A36A8A446350D55974F29B4B42CFA8F39916390D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412621, "uuid": "0869ac28-37f3-4707-9362-032b864933ad", "value": "12288:jeZBMcb9x/39SNJaEkZ/yxn5N1tBMpTbznqlLcHwruDMZBGT:jfcbL/Y7kly5N1/MIlLcHwrlZBGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412621, "uuid": "f461e652-4f4f-45eb-9db8-9bcfe6ee36dd", "value": 617534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412621, "uuid": "d7b2ff77-044f-4ac6-abdb-692c4cb0229e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412621, "uuid": "67d1c967-3457-4d93-8ecb-df37fdc942b8", "value": "factura.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598c4054-8fef-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701396865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396865, "uuid": "45108884-7c22-498d-a065-6fe613048805", "comment": "Malware payload (RiseProStealer)", "value": "d7a584ae65517b3d4a243c3df0ee594f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396865, "uuid": "141ed7c7-4213-4a98-84ff-9af4d3292c8c", "comment": "Malware payload (RiseProStealer)", "value": "2d533e2380ea5ebe349ea602f3c2d8533d32f5e1448981a7bf71e7b3fdc81b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396865, "uuid": "349758b7-3cfb-4f08-abdd-1616c9d7d1a1", "comment": "Malware payload (RiseProStealer)", "value": "e59f45ba6c50221c3254c0576fa3709c6401c7ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396865, "uuid": "b3ad7a02-710e-45ae-bd80-d8f047b5ff4c", "comment": "Malware payload (RiseProStealer)", "value": "0a36753c4958ba6b6159c4bf021ed7bccc21f6a393e0f3f6aeaa7ba9ee868a7a942572c314a2bdd0bc48ce666a2058b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396865, "uuid": "c08c8e0d-0933-4407-b13e-8e7b907fa9ce", "value": "T163C57B09A8AA42A3CDE1147F89EC3A97111DC0B5CB55E9C71A47DABF50F01F7B9322C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396865, "uuid": "992e51e6-430b-43dd-9b4c-43476426b9b6", "value": "fe9e3404bebf8b23e1a17d6558da6aa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396865, "uuid": "37170b13-c61a-4d85-8c51-c45c05596bfe", "value": "49152:Nm3mc1p4JhpLcwvjQhF6jy3iSXCaj+iuPvZOHR+oBCAh37JnT4MZE4M7OPSU8R:Y4rpLZvjesjyJXCaj+iuPvWN3W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701396865, "uuid": "6862586a-5ad0-4945-baeb-307c52446d88", "value": 2732544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701396865, "uuid": "b3299913-edd1-407e-9ecb-5fda43f7ee83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396865, "uuid": "c43b89de-e694-4bb8-a883-c70d52727142", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f54acf-9033-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701426271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426271, "uuid": "4989530c-3623-4151-b5cb-71cbde7d073a", "comment": "Malware payload (RemcosRAT)", "value": "9e17a6ac573bc582f7e020afeca33433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426271, "uuid": "0094d3d9-2330-4c65-87f5-c60ad7152d02", "comment": "Malware payload (RemcosRAT)", "value": "2e15752e1ce078c54355c354cc29ee8d75d48aa3c9821c81c2a74e7f679edb21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426271, "uuid": "12703c3d-4c84-428f-96d5-a4ef7e9e451b", "comment": "Malware payload (RemcosRAT)", "value": "59f9c4b93074cb279b72c2bc99ceed89aadc522d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426271, "uuid": "b94bbe11-a21f-4f87-b572-ab4ce6e4dc5d", "comment": "Malware payload (RemcosRAT)", "value": "9fc3c6da6478f7b3c546d21f902dbfd1c8e9db8d70391fe77c827b283821a94950705db33804cd867ea378f7eb4c4080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426271, "uuid": "c76119a3-69b7-49dc-9227-bf2c44a0c252", "value": "T1C7250120B2F86F62C5FE57F104555A100BF2789EA47DF32D0DDAA4DA7666F005A82F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426271, "uuid": "c8fe19a1-a5b4-450d-88c3-8a264e98af2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426271, "uuid": "84786755-4c05-4fcc-a95e-115cce9f5c32", "value": "12288:7xdIBmU4EF5xiq0tHQ4jnteL7yXfzLjrMuhg6BJMRnokKdH4KVzoZG1v7j+OX0QL:7xy4EXcq0tw4jMCrjMqwyddzN+pQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426271, "uuid": "fa146840-030f-4a38-a4ba-706ea7553bf8", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426271, "uuid": "092b4777-a982-4fb8-8347-ed6c78a288d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426271, "uuid": "5568dd6e-3f1a-499c-8e4e-f579fabae9b4", "value": "SecuriteInfo.com.Win32.PWSX-gen.16394.5888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c31a100-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442343, "uuid": "a7a491cc-f1ce-40ce-8a90-cd6b97e07dad", "comment": "Malware payload", "value": "84e3186c4aafb657379266da2479b8db", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442343, "uuid": "06fe3fad-2c6c-4114-b841-ad08a08246ea", "comment": "Malware payload", "value": "2ece87c53052487e44839a31ac482471657316ecbe1c9699fe448bfb71259d79", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442343, "uuid": "9ee45e6a-44d1-4900-9499-e0c3610f38a2", "comment": "Malware payload", "value": "dcb876758a80d26a391f7d4b3c5001edd21d3c85", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442343, "uuid": "6e14f4d5-02e4-41f9-9d83-9784a155fe87", "comment": "Malware payload", "value": "fcb52fb205da66efe17b4217a9f22a41c400680f9f4c6cccc9a028e654eb3450c22acc94c3e34e831df914bf096ab81b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442343, "uuid": "797eca3b-c073-421a-b213-e6108ae96b48", "value": "T1B9560175731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442343, "uuid": "c8332ff9-de35-4a87-ab3a-1c23d93fad32", "value": "196608:/tDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYN:lirUVis8O/0giAZ9PDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442343, "uuid": "afe64b5a-0b1b-4964-ac32-a49996345550", "value": 6376378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442343, "uuid": "5eb47994-b557-438f-8853-026418b3bf7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442343, "uuid": "6dfd442a-00b1-4661-b3b4-6ebabf9370b6", "value": "t.me_kateestar_videochat.apk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cfd5a4-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701422662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422662, "uuid": "82481f8e-24db-4cbe-94e3-a6ab75c058b0", "comment": "Malware payload (SnakeKeylogger)", "value": "dcecb74e068c295c7ea728288e326995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422662, "uuid": "e249d84a-dfaa-4626-9d72-9f6d2973806d", "comment": "Malware payload (SnakeKeylogger)", "value": "308e7b13ebf2ff903af13f2c81dd79489c4cd3fde26a3bd033890922b33ea519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422662, "uuid": "67b17288-dba0-465c-9138-cf5abd6a0c0a", "comment": "Malware payload (SnakeKeylogger)", "value": "9950f7b907b937a6097c566385bb94f5e05ef17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422662, "uuid": "446027f6-3b87-4c99-a37d-75f5199b11c2", "comment": "Malware payload (SnakeKeylogger)", "value": "d399df85213b1a7f7a0faa5df6470cd4ebbcf79e35a1f0277800ee2a7f4199f6180d1d028230ead4d91bb3aee152003f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422662, "uuid": "27b5833b-b92f-463b-8120-ab6287165163", "value": "T1F2D4E020B1F91B12C9FE97F1151912140BF779AAE47EF32D4EC9A4DB2666F004A42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422662, "uuid": "799b6c87-4298-4f5d-894d-ab5a487318ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422662, "uuid": "6c5787d9-f755-4971-ba57-d8c807fd4a69", "value": "12288:83dIV7UOxFEhR4qH4yH5O4VIp3ZQlBN60MJaFuFP5ig1:s0xxFEn4qYyH5O4VIZKj60MkUJ5ig1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422662, "uuid": "7d26e100-060f-4398-8f30-848c30b88abf", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422662, "uuid": "563584b4-3536-47f3-8da0-c769218d0840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422662, "uuid": "ffed9dc8-0e18-4ada-a248-1a208fb6ee1b", "value": "SecuriteInfo.com.Win32.PWSX-gen.7645.9699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a50104-903e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701430782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430782, "uuid": "06e4b2f9-a841-481e-afd5-4476e88a96e1", "comment": "Malware payload (Smoke Loader)", "value": "1e66f3b336d994d513600be6ea43ed86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430782, "uuid": "1bd6cbb9-edd9-4a37-aabe-8026ae658c3e", "comment": "Malware payload (Smoke Loader)", "value": "30e38b7039f1fc2070c81c2544ba1169d91074e59924b74e3aa7caec4d081073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430782, "uuid": "3df392bd-fcd1-494a-9226-f9dff6e2ace0", "comment": "Malware payload (Smoke Loader)", "value": "add339230f9d211edfde1d6e342d11c0daef830a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701430782, "uuid": "1473a78c-ec10-4499-a4bc-51a9f4362f0f", "comment": "Malware payload (Smoke Loader)", "value": "6c3b914a1d30348d41ebd81400134709d09c127b59d07fc02d97c3c20b1665c49af33bfd449a867ca944127e0b53576d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430782, "uuid": "66b2fa1e-e76f-43ac-8993-0b9e43fb8235", "value": "T1EB34BF2276E0C072E16B593D4971CAA55B27BCE29B6086CB27D43F3F5E312C18A7570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430782, "uuid": "07a89e7f-792c-4b87-9b63-3f5ebae17903", "value": "1e5043715b5ec4c1a45256db4effd68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430782, "uuid": "ca4c0128-9432-4ba3-abdb-62740e6e23e2", "value": "6144:Iqumj0pQIUK1Vnc/hySVDV4jCQVVGraP:I7QIUKPnc/dVDVMVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701430782, "uuid": "65e3d608-05e9-4bb5-b303-114b8736bb72", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701430782, "uuid": "f76cd1a1-7bc1-451e-99ae-081630f39984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701430782, "uuid": "a27e4e8c-f941-4835-b967-32c14f8d1ac0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a233c8-908e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701465204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465204, "uuid": "b90ea006-eea0-4044-83b3-16b47733086a", "comment": "Malware payload", "value": "d1c3dc0294f1b773f805cddd2a03bf2f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465204, "uuid": "837e8235-691a-4233-85c5-44eea3416e60", "comment": "Malware payload", "value": "3269610e521056205ea1d6add448dd8c7f562e6e6bae1d892494af06d65237e1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465204, "uuid": "28794513-ffd6-4820-86bb-96b388a2f49b", "comment": "Malware payload", "value": "44b5cebc8660bfaf7fdffd161722d71d66397999", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465204, "uuid": "643ba50f-c3ca-4087-8937-a6f3750fcf4d", "comment": "Malware payload", "value": "016cbcae8e869109f577fe04b65160f6d7ce3ae8cfc26e2ccd3243d7fc399c92eb681a2d82daa7a7883e4b10cc38129e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465204, "uuid": "58bc7484-11c7-4fb6-8463-fe127f1337c1", "value": "T10F473337E3363B1BE9B930B3630BAA5655701877FC748D4E99C69E4B57F8809B238610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465204, "uuid": "d5f1248b-a1a5-4294-90c7-b1105ae7d8fb", "value": "786432:hnH/6Q+isfGZrSNrBJGR4bpukXbzhB5Xtp0NJkd:hH/3+7fZbJGRopuGTtpKOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701465204, "uuid": "ffff52d4-16c0-4971-9741-5ea8e1864d02", "value": 26193064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701465204, "uuid": "8a4f3dc2-2772-4bb2-bc36-e8266a682f35", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465204, "uuid": "5b3696af-ac5b-4053-ad27-63ad49fbf681", "value": "Free_active_password_file.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e565739a-9024-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701419863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419863, "uuid": "5ecf213c-9ccd-4359-9a5c-1d1234e21582", "comment": "Malware payload (Stealc)", "value": "f8a7d0ddfeed72fad21e0f9ea4078387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419863, "uuid": "0de2a403-bbf6-4325-9249-898f19b346b1", "comment": "Malware payload (Stealc)", "value": "32ac805bc88b71ee119f23a18b3ec10c32c944f000283bdd0ffcfa26b97846bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419863, "uuid": "7d720fdf-b09a-4364-a24c-8dc592a021e1", "comment": "Malware payload (Stealc)", "value": "6aa32ae8bdec7a053daf9fda70ebf9fabb4aad69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419863, "uuid": "e6da290f-3eac-474b-9a65-059dc903078e", "comment": "Malware payload (Stealc)", "value": "07773e4028dce250bf076ce02bd0061b5420e262593afbc74a419f650d3d56523fd7aaa31f6abe1a8f792e136e33dc9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419863, "uuid": "8162bd65-e17a-453e-91f1-066874bb9746", "value": "T13834CF2176A1C432E12759354971C6B51A3BFCE29B6196CB37D43F3E5E312E28AB8703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419863, "uuid": "be832c1a-6db2-4bcd-8a34-a728ae4e8589", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419863, "uuid": "808903eb-fb19-4275-b87a-c9499168afb9", "value": "6144:fXDix9wAsgOnjblRS9WRRYR7BxqukJfwfDTg:fXwsgOnjY1bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701419863, "uuid": "afb80651-cbf7-47cf-90f2-1ea5fb70d167", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701419863, "uuid": "eda47288-ec79-4a3d-befe-a378128f44cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419863, "uuid": "568549ce-9bba-4c30-8ad8-f83da3cb1e7e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9829.31780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482788a5-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454818, "uuid": "cf1623bf-1608-4a11-9598-71b9185b734e", "comment": "Malware payload", "value": "74c75053a727f0782e5ef9af6566f16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454818, "uuid": "bbce8bb7-481d-49a7-9a1b-e9e0be090064", "comment": "Malware payload", "value": "332a2a07568de1287283ff261e2ed49f94c9673055f4d7c93d3e876b2110008c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454818, "uuid": "5b3c2c3d-8edc-419b-9897-31bca034d532", "comment": "Malware payload", "value": "b48d6ffcbab81ec9ac80452bb28bf2d9cf91e5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454818, "uuid": "d2f1f867-3f0c-4a21-a085-e4859b9ed6bd", "comment": "Malware payload", "value": "f4cde72b3eb42f15042249263a71609f3e831af039d276ef804958cc990b611382041671a0f0cad37cefb6ecd590dd1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454818, "uuid": "7b02b042-5f50-43bf-9acd-6545ec375961", "value": "T108356D21B2914837C9732A39DC5792EC6825BE042E24AD772BF53D4CBF797823C25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454818, "uuid": "b14244b0-4c33-4463-bb00-d556270eef8c", "value": "79c895dfad0d489839f1832521ff1475", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454818, "uuid": "be5efe31-dcae-4f5d-bb49-21be915bba09", "value": "24576:8YUrREeW5ASyPtVAECQJeZtYzme/XvZx9m8Jot:8YUt1VAXI6u3M8Jot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454818, "uuid": "0ca49709-34c3-4a69-bcbe-42540c1b7780", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454818, "uuid": "d9ccbdc1-5468-4f12-ac1c-00fbd3b6a65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454818, "uuid": "2e11c30b-b710-4d5a-9bf3-be3b8411ae7e", "value": "SecuriteInfo.com.TScope.Trojan.Delf.20620.20196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8c5923-901f-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701417570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417570, "uuid": "5f5d2251-57fa-4a46-bad2-a53e8b055c18", "comment": "Malware payload (AsyncRAT)", "value": "b58e652b276be496bac9239e3e3dbf0a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417570, "uuid": "d64bf37b-0815-4d35-ac7f-3ec0a6c64000", "comment": "Malware payload (AsyncRAT)", "value": "33bceb8d158db5bed5a3e64da0ce658a7be711b63a99b06e742a9a5012354c01", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417570, "uuid": "710c513f-6452-4d00-aa69-305bf818f83e", "comment": "Malware payload (AsyncRAT)", "value": "0ed094d890785364f702e9612bd444a705e3c1ff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417570, "uuid": "4de41dd0-ec9c-4088-b344-d985491ec93e", "comment": "Malware payload (AsyncRAT)", "value": "0310ef94bd74be172ef2aaceef79d202b88c962bd8c0f7df3e6365dc56243a7eb2e8fda782e15a24220afaccbd6fc4c4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417570, "uuid": "805546c1-e0c8-41ba-a5a1-cf0d3c0aeaea", "value": "T15FF2ED203AFF510DB2B3BF621BE9B6E94E6FF7726519605D204403475B62E40CE66B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417570, "uuid": "2c7c3f91-8d5b-4bcc-a8ca-f649e9f94925", "value": "768:EN/MSist1hG4YBnVHSV5WVrZvZjBCHbshGR1VHh9jB6hQaBMhbvQCBX:ESet1h0nLZvZthhKjYMhbxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701417570, "uuid": "1f00d198-6c20-4886-ba31-85bb8f4e2138", "value": 36908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701417570, "uuid": "b459a1fe-b5d9-489b-b408-af65a74aa91b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417570, "uuid": "e068b119-4a7a-47f4-af7c-ea1db4af5b1d", "value": "REMITIRA_A_TRAVES_DEL_SERVICIO_POSTAL_AUTORIZADO_copia_de_la_demanda_con_sus_respectivos_Anexos_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33b7f24-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1701416343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416343, "uuid": "94e60fb1-7831-4d40-b6bb-43f5ba068305", "comment": "Malware payload (MarsStealer)", "value": "98a0bf4af1e1e9a69bddee4421e1772d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416343, "uuid": "f7a1d00e-bc3a-4fbb-8583-e1a4ccf5c569", "comment": "Malware payload (MarsStealer)", "value": "34318cdef0cad69ba0ba6f68b42fdd5c581abdbc4feceeab73bc13c56840e7fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416343, "uuid": "f7ed6250-954d-4323-b766-ad690aaadd37", "comment": "Malware payload (MarsStealer)", "value": "38c9160650423557c000b624dc5764c7e593b6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416343, "uuid": "16c0a17b-a366-42c4-a648-093e2357de1d", "comment": "Malware payload (MarsStealer)", "value": "e7c541ae6988159add88ecf3ed04e80ee19f188cff23a95ff11dfe309af7078cf17df9977af2e8a2991596e598eaa79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416343, "uuid": "e7572a7b-5468-425e-9214-4f9e8db62f76", "value": "T1CEC63339D93B66D0CFCD037AADB33219F337706F4343DA8331929AAD6562B712A81165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416343, "uuid": "5ddf6526-3c16-4c3e-b5c4-0eb7100d7104", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416343, "uuid": "8ae2469d-2ba6-4b9c-9172-2cabcdc1bbc4", "value": "196608:Z0OHLe9/L+y5ugST2ZHZIXt/D7awIyOmAJuA4PZPc2iVXLy0LY7tvRo:K39/Cy5ugPnIFb37AJ+Nc2ikQGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416343, "uuid": "c00e967c-18d5-4e09-881b-7e2fc343fea0", "value": 11834368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416343, "uuid": "fe0d34eb-9ecd-41c4-be0e-2761933fa801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416343, "uuid": "309a4903-98f1-4c04-9f20-593d3ef879f6", "value": "information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ff4e6d-9033-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701426273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426273, "uuid": "6037b5c4-6843-4d51-ba17-1bf453c3cf6b", "comment": "Malware payload (AgentTesla)", "value": "741a5a12f09c04ea3e9016b0df5b1619", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426273, "uuid": "33fde88c-6db0-41fa-b5ba-6f4a946b10c8", "comment": "Malware payload (AgentTesla)", "value": "34e80cd7697e28920dc9d333f057b29cb3e4010a8be917130a9c3137aabfb547", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426273, "uuid": "f66fb930-66ee-4fd1-94a1-6d94f68703b0", "comment": "Malware payload (AgentTesla)", "value": "70bc8da958d222169fbbaeef24caf81dcad79403", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426273, "uuid": "1ad311fe-c357-4305-90ab-02c565050c4a", "comment": "Malware payload (AgentTesla)", "value": "3b1feef981566164702ab47eff1bc752c3aa63a7459e4740965f1ad1a3f2fa0e399e17b6e770cbd651dbd9018595fd81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426273, "uuid": "d495a2e1-775e-453d-bd1b-174d090fc1f3", "value": "T13BF4E124E2F82B62CAFF97F1144456040BF7795AB47EF32A4EC5A4DA2665F004E42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426273, "uuid": "893971a4-b210-4b9a-85ce-b510099fe506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426273, "uuid": "ef3d8ed0-1f33-4f9a-8c4c-118723380771", "value": "12288:qhdIaRFF8dhPVYuKpqScN28sYpOI0fEPwtn/2eSJ+3pOlLAeqo9gp:qhPFShPVYu4Zu28sYYIOqSn/U+3pOlL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426273, "uuid": "88eab273-8ac4-4e05-8c07-7cf18014321a", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426273, "uuid": "25ffa683-94a5-49e9-aef3-680014496a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426273, "uuid": "b609d495-7b9d-4df3-87c0-d7729dd20d88", "value": "SecuriteInfo.com.Win32.PWSX-gen.1072.24827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92d9505-8fdd-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701389402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701389402, "uuid": "73f1fbe2-d795-4d64-a59c-8af73593fc65", "comment": "Malware payload (LummaStealer)", "value": "616284591807270f26a2b13222db1659", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701389402, "uuid": "93444c4b-3808-4876-9550-730b2e7b3ed4", "comment": "Malware payload (LummaStealer)", "value": "34eb3ad12d7732ae0e106794f1aa4d49ed55a3164da32ccea68695415f3f7349", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701389402, "uuid": "06092e9f-a3bb-47b7-b423-00bf498b0fae", "comment": "Malware payload (LummaStealer)", "value": "6afd665d66711d0f3681d4f7ce51b375a7eeedff", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701389402, "uuid": "41fef8b4-2719-46a9-9496-26821a75601e", "comment": "Malware payload (LummaStealer)", "value": "ec0abbc54d5577417873d1bbf46f36b2be0e56c3465659fcfc64752a6520faae53b7f2270800ba85ce60bdcfd0afd53b", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701389402, "uuid": "62944233-0189-40e6-81e7-27ffe26a73cc", "value": "T1FB0712C7E99481F4C046C534528723AB70A4BC8D85F9BE5F3AC63D107F71E948A8EBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701389402, "uuid": "37b14e5b-23a6-4288-849d-aacec2243888", "value": "1cea4cd5c60f2b9671deab97265f526a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701389402, "uuid": "c117be1b-2752-48a9-b92c-9f3cdccec8de", "value": "393216:JvSWZnqMuqMb17M5DeWJa5MwkZwaf7ENmOruX0:JPZqd1GaSwkQak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701389402, "uuid": "023942e2-e618-405e-910d-6b90d9746eb8", "value": 18455952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701389402, "uuid": "6296c786-2919-4196-9a01-7349294117f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701389402, "uuid": "dac5bb7c-eff2-4e9d-8000-a80883376edf", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308b3af9-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442323, "uuid": "2d01f800-a83d-4770-9bad-3dd1737e20ff", "comment": "Malware payload", "value": "5087407973bf0883973accdeba9e2538", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442323, "uuid": "7e05b50f-9f41-416b-be01-f8138470fd56", "comment": "Malware payload", "value": "35121268449f3e4b9679522532beaf126747f9d259df01304dea5eda86cc7e8b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442323, "uuid": "0db311f0-a006-413f-a211-3fdb3ab005c6", "comment": "Malware payload", "value": "4233923826fb7706c26f80dd0e8dd8b09267a33b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442323, "uuid": "93cd2be7-8f07-4b34-9813-2eea281d181f", "comment": "Malware payload", "value": "270b421eb8ace8caeed0a4c31cf53acadd749e1c217b38d36c3266ff7b372c3b5256c996bb8bc9d9c4a6438a38b25df7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442323, "uuid": "2f13b124-4af0-4ec2-a68b-388f0d187ca7", "value": "T1CD560175731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442323, "uuid": "f5b6e411-2e05-4516-bd6e-62317760e17a", "value": "196608:/FDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYv:dirUVis8O/0giAZ9PD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442323, "uuid": "ea228fc3-984d-4806-97af-66e359e8123a", "value": 6376382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442323, "uuid": "589f309d-6f6d-4f21-b17c-0287e1a0313c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442323, "uuid": "92ac7ac5-609c-48d3-a8e1-0d576f3b3a3c", "value": "\u0421\u0431\u0435\u0440 \u0437\u0430\u0449\u0438\u0442\u0430.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330ba449-905b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701443186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443186, "uuid": "3f322325-e4d9-4688-b902-846e5b062755", "comment": "Malware payload", "value": "a582cb04e53943a362055eccb0b1411d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443186, "uuid": "171c65e4-401f-441f-8897-6f30032de9ed", "comment": "Malware payload", "value": "35c95938f2142be31f8ec491afe72c1d31e4d792c6672e49ac8400e9c7b4a555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443186, "uuid": "c15cdd21-882f-4a48-98d9-20738a000f89", "comment": "Malware payload", "value": "1e27694a6c69ce3e2d2c871f231a3434d0935f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701443186, "uuid": "2a6b8d64-27e1-4fb2-b1e0-25dd473e1a15", "comment": "Malware payload", "value": "737842440b92f63de4a4102c600a7eaf16a9b45607453de64be33d9fad353b121882f4e43e1a2665586501c4ec3c770f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443186, "uuid": "07bb616c-42b1-46b1-948d-e3640162079e", "value": "T11E06AE022E71DF62F01CA13BE2DE954C13B4D9245A82F3272DB8323D8596B676C65CDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443186, "uuid": "15cafc12-315d-4489-87ab-327541dcf0e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443186, "uuid": "3388a9d6-eef8-431d-98c7-f6ba1e31b480", "value": "49152:gmkFbQYpP4sR2WEa5GeC2Gb39MtKl7qDObofvenQ++u0BlxPjXJfjWGefrZQMr:LkN1P3HQbuKoYQ+p0BfLZrWGef1dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701443186, "uuid": "0a786fcc-e12a-4504-886f-afda742ce329", "value": 3963640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701443186, "uuid": "6cd0a752-76b1-4602-b493-8c90b22e5ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701443186, "uuid": "cccb923d-770b-42c0-8cb3-62b8cc54efd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9755e9ef-9012-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701412001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412001, "uuid": "0862dfb7-6cb0-4acf-a5ca-6a216091b1e0", "comment": "Malware payload", "value": "b00d5c13a2ba59887a7dea5d1c1c18e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412001, "uuid": "edc40a41-9ede-4445-9206-a91659e79863", "comment": "Malware payload", "value": "366bc0b1e3d7c632c17c5440f34ad581ede4d3828a6da30923b759843e19e114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412001, "uuid": "7ed3def1-0f64-43c3-bb19-04f8dac64c42", "comment": "Malware payload", "value": "04d16f0cfccb9bf35f92c4e94f8f5ab522337ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412001, "uuid": "80221293-4a55-415c-83c7-cc562d1be861", "comment": "Malware payload", "value": "a249618dbd5e9a63a3539e65eb52c59362815f4b897cc74375ea83a99b4651493871d023046cd542f1294f7a445cb296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412001, "uuid": "57c31391-f933-4935-acad-b4636ba3f988", "value": "T1EAA48B04A7A6BD45D0522A7C77A53400B2F85EF72D79EE1C3A4A324B53F2ED286B51C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412001, "uuid": "1ff9495f-d0d3-4377-98a0-1b56177c4383", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412001, "uuid": "ca0ca030-5a08-4686-9798-b95f45f8094c", "value": "6144:3JvVa/qddUnyWSo4tM5imbY4EVIguUPgfz50fz5trU:3Jv6q0uZC4L4Vg7kzWzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412001, "uuid": "24f44535-898f-495c-bd0a-88764efb0fd8", "value": 449456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412001, "uuid": "20f6561a-759b-4e80-a8bd-7fd0b303ebe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412001, "uuid": "d659d5f2-b8f8-46f2-b8bd-6ebc975bd300", "value": "b00d5c13a2ba59887a7dea5d1c1c18e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eb518a-901a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701415426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415426, "uuid": "520f6e87-4ffb-4150-822b-b75b8cc9a4eb", "comment": "Malware payload", "value": "1557c5ca92320aa9f410190289eafb72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415426, "uuid": "0c569911-0e17-4dcb-81da-a30a8fab7018", "comment": "Malware payload", "value": "36e9ae2952837be58012d64e65e69a4b9c828248fa35b8f378192d6f4c8f7d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415426, "uuid": "3c6c1602-c0a6-407e-8f80-579d22bceaf0", "comment": "Malware payload", "value": "453441f76c5c755b3e974a8868ae9f37c309990e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415426, "uuid": "6fc8f285-5282-4dc6-b1ce-99741ac112a8", "comment": "Malware payload", "value": "ce3a4d8494eba0edaf05bc70be02450dfcde2cac4746e366878bdb81a7ab12b6f6263821f016f7ec193ce0457b2d4d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415426, "uuid": "1d008dbd-213e-4766-bc78-98b9389ae2ad", "value": "T1C527D0F5AB1013E59F83998D4E07E7D6EE6991006222246D728F0647EA439EC4373E7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415426, "uuid": "450456a4-1598-46d8-be66-636e862f66bc", "value": "1cea4cd5c60f2b9671deab97265f526a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415426, "uuid": "279ba031-a0a6-40aa-955d-11094efcd3c6", "value": "196608:drc0e433t9Kxy3CS6l+X2WzLfcA4R4eNEeOftzi1mlhu5h3Wunj6jz+mZiyz6m:L7Kx0Gl+GWzLcAQ89iAUhmYcpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701415426, "uuid": "fd1eb676-0bee-47f3-afd8-9c6869eca7e6", "value": 20510032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701415426, "uuid": "97e18650-e647-4faf-9e06-576a1f2f028c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415426, "uuid": "c65bc681-9931-41e8-9b6e-c93f2d761d1e", "value": "1557c5ca92320aa9f410190289eafb72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc75814e-9034-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701426666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426666, "uuid": "94e803ef-75d0-4b71-8946-6c026dadd73d", "comment": "Malware payload", "value": "cf570e9cf7cef77169c51b8dd6ef0ca2", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426666, "uuid": "b980bb7a-820d-499e-81fb-ee562bcdb5d6", "comment": "Malware payload", "value": "38477e963754ef21ba11bd4bf7565ec0bc9aa327c008f4be57aa672e8eaba3dd", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426666, "uuid": "d414f42b-a2c0-48f4-a64c-4e910a9d9bda", "comment": "Malware payload", "value": "118554a7a54ca23a4e60d9f0c3d96f005630b9c5", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426666, "uuid": "216e04c1-decb-47a6-b415-92abc2b637c4", "comment": "Malware payload", "value": "735f73bf9622d0d8059ad807ac0722332ceb074844c2a185b08f1ba09f7c9704aac7442e96bf38a3918cc1d06f796e00", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426666, "uuid": "db6cfab3-cea3-47e5-a0bf-e4ae55282460", "value": "T16A421B1997C8EA3DCDFA0A33DC1316410771C5C49A5BEF6F91ACE5151DE338A0993B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426666, "uuid": "6d4322ae-0308-4ef5-b676-189fb923ab72", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426666, "uuid": "9b5f7106-9d60-4c5e-95b2-b675824c3f9f", "value": "192:hPgqlQEW0Jc47gJV/Lv2aGOCqq1i0ShIW1vUsbYDkxseA8OAUk:+ql5W0c4UJd6nDi0cUsbYDSsnAUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426666, "uuid": "3b6fb168-667e-492e-ab1d-27e9b945ee6c", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426666, "uuid": "746095e5-525f-423f-87a8-11344e478b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426666, "uuid": "28f120b0-1d21-4fb6-a875-7b30b2b2c2d1", "value": "170142666538a8f1384c215cfdd24dd822cfcd400a63a6df62cfcf784f2af9364ad7697b29100.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10eb657-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435210, "uuid": "68f4e5d0-57cd-49db-87e1-aefac0ef32ee", "comment": "Malware payload", "value": "6dc33da4813bcb18537a6383e60274d5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435210, "uuid": "bfb3694b-3248-43b7-b1a2-2bb7ce18b5f9", "comment": "Malware payload", "value": "388d6a4bc712361d89b6acc2ed1e652ac3da410dd8db50d136109b9d5a79173c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435210, "uuid": "fe16b3a8-7a87-4230-babd-55f589571aa2", "comment": "Malware payload", "value": "4a3a7fdb7aea9d76ce56737bc2860ebbe207cd8d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435210, "uuid": "5a8aa7c9-c8e2-4a2d-abab-c5029898fc3b", "comment": "Malware payload", "value": "4a5a5b5bb70cf130c60480eea43d787d2f0d6c10f539760ca98c86ab6d746ee4d0006e85fca805e679e3dabd973f97bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435210, "uuid": "1bc275d3-e035-4626-8896-f924e846aed0", "value": "T1E8560179731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435210, "uuid": "2ae920a9-1793-4b45-ac03-8bd4782c2f27", "value": "196608:/WDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYM:yirUVis8O/0giAZ9PD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435210, "uuid": "20622168-6466-4826-8883-7c5450852a77", "value": 6376382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435210, "uuid": "d5c3baa9-1e86-4d94-90ae-d7f49c5862a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435210, "uuid": "bd399acc-6797-4076-9ff8-da7ede4749a7", "value": "Gg.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c88dbb3-9034-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701426425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426425, "uuid": "047bb780-66a6-42b3-8da0-80f68ca68d80", "comment": "Malware payload (AgentTesla)", "value": "aa2bbdd4f76e86b8a34746c29602982e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426425, "uuid": "634683c4-ee5e-4795-a1ac-613210e1d26a", "comment": "Malware payload (AgentTesla)", "value": "391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426425, "uuid": "f93fc56d-c4b4-43a0-9eea-c067716fd67e", "comment": "Malware payload (AgentTesla)", "value": "65afd6aa0bf71c64cbaa3076dee472d696dd5566", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426425, "uuid": "c01455ca-7e39-4fb9-ba04-26a5dd575196", "comment": "Malware payload (AgentTesla)", "value": "495ac38c0b7ad52b4c8b8fa0555779c30ce9687d7942fb1120fe5594cf7d8143f9324d0d3a1b14c43c68224093bd3442", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426425, "uuid": "bbfbb06f-4d60-4aa3-9fd4-03f318a11494", "value": "T14E05BFC4E678D6B3FC1E59B534EB8C1483A685B359B0DD980DCFE1BD25C139228A349B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426425, "uuid": "d736ffaa-76e3-43b1-9eb3-b151e6aa04b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426425, "uuid": "3526ca61-1d5c-4a51-b219-c46ce0818dec", "value": "12288:S3f5A6IOwgTt0Pkua0p0lZXRYQlBTPNPqt99EUU5kLQTYCS51fn7dyx:YTaslk0l1RYmFqt95dsMCS5l7Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426425, "uuid": "2c453e22-2290-4010-8770-41ee619dbf9e", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426425, "uuid": "a1aaaf03-50ba-4087-8082-1f33a781f6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426425, "uuid": "3d69ba2a-6762-46cd-86fc-2c5828b2f47f", "value": "payment status.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960cf9bc-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413288, "uuid": "c59c3ff4-3f7b-4bf8-b591-0264668eeb1a", "comment": "Malware payload (GuLoader)", "value": "513a717194d7344d1c8f2914000257ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413288, "uuid": "958911c8-362a-42f2-93b0-ab8ecdddeb44", "comment": "Malware payload (GuLoader)", "value": "3931bfe429ba3c31725f31dca4ed290d2e7e04efdb130ef570288a25f76bea9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413288, "uuid": "04a4a526-d5fa-487b-9756-355741b9ec79", "comment": "Malware payload (GuLoader)", "value": "6a0b462c9678c9f024be0989e7116a340cfaeae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413288, "uuid": "43f424fa-8c6f-4f77-9b56-d212f6ae5e43", "comment": "Malware payload (GuLoader)", "value": "912f3ba026de91ca8140fb747d47765e51c1652b2b67acdab9de1f57023efde580755da394d37a01637518a03910414b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413288, "uuid": "d1f05210-97a2-4d54-91d1-adca99335bc8", "value": "T164E4BE923589756FDD2F8978031FEAB22B755CE0B391096E4F80361D4C3668A80EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413288, "uuid": "6a198c76-bdfb-42c1-8066-3a07bff0d807", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413288, "uuid": "278d662c-3088-417b-a765-35a1f5705b29", "value": "12288:wcqnhe2ecfzWecPkDGK3WhZ+OvAzdm17zOckylak7iI/dKX0HO:wPhemfSejWhFvAzCKdOT73dy0HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413288, "uuid": "c8418307-52d8-4912-808f-c3cbdeb874db", "value": 673568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413288, "uuid": "893341e4-25ed-430c-84c5-c216c32bb9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413288, "uuid": "676daae8-ee96-4f4f-a9e2-88013782ae63", "value": "99225644324009[1]PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676307cb-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701411921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411921, "uuid": "299fe4fa-0f9b-4a71-9df7-a0ee54d53b70", "comment": "Malware payload (AsyncRAT)", "value": "1e1961c1b3fab9d3213365d7b2a6d4ac", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411921, "uuid": "d0cfa529-91ed-4cee-88ab-d8eb21b30d44", "comment": "Malware payload (AsyncRAT)", "value": "39a4a3be1713f0b478d730f0faa7dbb2c7cc936f7e74f47b0c5649809d4e0cb4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411921, "uuid": "1c72965e-90a3-4d64-a556-80a6979e798d", "comment": "Malware payload (AsyncRAT)", "value": "fd27fb12e4b6e1af127170891001c3134e51f892", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411921, "uuid": "318bb419-259a-4d93-b4bf-a20124257dd3", "comment": "Malware payload (AsyncRAT)", "value": "f66dd72dd1e40406588e7d80cf5960b055a83a3ba80a7719eed0e4f0f6406c945e15e601e196bdf074ffd261ee57b6b8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411921, "uuid": "e5cca49d-d954-4b3c-9fad-3d379a04236f", "value": "T120658D8843987D0AC65D0639B015334D17F0ECE16EB6BFDDB90878BA2FB2BD245B9152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411921, "uuid": "6cfe7698-67ae-4e8d-8c0d-e96cfa1ae7f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411921, "uuid": "91816072-cf32-4d47-90fd-4d91a87b9857", "value": "24576:yDqw4fKBK9KzKdyfKV6Kta3y8dvPIk7H5jlmCHMuB46sNJFyh0AFOzIkY:yXBK9KzKdyfKV6KtIRPdHZQCvZAJFyhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701411921, "uuid": "7297b3e5-c7c7-4984-af98-bcb4c7797150", "value": 1472000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701411921, "uuid": "afb23976-e88a-4de8-bae0-eeab0e7058e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411921, "uuid": "b72b80a8-a534-48ba-845f-fca94742c8d3", "value": "1e1961c1b3fab9d3213365d7b2a6d4ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7556ac-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454852, "uuid": "c7ae18a5-558f-4fc8-96b9-5ea6fe6b2441", "comment": "Malware payload", "value": "1601f695473aa2e025d36fb19b9d24fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454852, "uuid": "d4f700c5-50a4-490a-83dc-606815a3111e", "comment": "Malware payload", "value": "39a5c994e1efec7d793a916b3fafcc9eda603dfef8bc1220dbadad9b1b0cca22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454852, "uuid": "722d4a1c-1e7f-4917-a347-01e9b169e3ca", "comment": "Malware payload", "value": "5aaf7d81a283c40d6d13b95acc09c652166f2588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454852, "uuid": "192102bd-8a2d-4de1-8339-f114cd269d72", "comment": "Malware payload", "value": "3766e8989de73d648d9ac658658eac36789a9d555702c618c931d24a4a2fad40d0a6b5c8a78654e354054ab35487b3e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454852, "uuid": "30872eaa-ebb3-442c-b554-6b485e141b8c", "value": "T1CA357C0732915033E6B279364A1B42ADC926FE161D78345A6BF99C483E35643FA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454852, "uuid": "1294d9b8-4692-4c4f-b67c-338c2cafbbb4", "value": "12288:gGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3X:gKvzcrnyaLO+3Yb/wQeAh/7R/1DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454852, "uuid": "ed7d4315-e1e9-4f4c-b1e4-9363013722bc", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454852, "uuid": "14b6fbe4-833d-4765-b731-272371a4d254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454852, "uuid": "63f6141c-6561-4a5f-91f7-ac21ebd3801f", "value": "SecuriteInfo.com.BackDoor.Pigeon1.13345.3883.13375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0cd393-900c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701409593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409593, "uuid": "0d243a16-c955-4afb-9e39-fe415534df5a", "comment": "Malware payload (AgentTesla)", "value": "fc6d7a11059fee2eda2bab5e4c82c839", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409593, "uuid": "e8fadc64-d37b-4a8e-bd92-12c0b954e1e1", "comment": "Malware payload (AgentTesla)", "value": "39afb67d0916e6761f7604cb65ebdb1c115f24e62d9b122c0137b46215a0b00c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409593, "uuid": "541b1c6d-2643-4721-856e-54f62273a0e7", "comment": "Malware payload (AgentTesla)", "value": "9907895c521bddd02573ca5e361490f017932dbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409593, "uuid": "babae834-3639-43f8-9bcc-68a5af1f023a", "comment": "Malware payload (AgentTesla)", "value": "fcca00ee22d75a18450c2a5d98498cdf17aa3e3efc94390beb21373386451501a5c3daebbff9b9650aab847bc6082529", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409593, "uuid": "aefd1dd0-55b2-4b04-8fae-bbb75606deec", "value": "T1E4B301CF3365ECD0B562E9C8791B1401A5A8080C64B3B16BD9BF0FF61DC65CCE94D696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409593, "uuid": "50e96e52-4a97-4a7e-85c3-40eb4cb2fcd9", "value": "384:boJdyttnpXrov4gPyjjF/9sui+1VaEEEfEfffEfEffESxyOVYZPjcrdRoDT/8W8z:kS5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701409593, "uuid": "68da35bd-b145-4612-86ba-0c0b566119f9", "value": 108552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701409593, "uuid": "5ab4cc49-a134-4169-aedd-aa9658f8f4b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409593, "uuid": "b90e448f-6f31-474b-bdfd-024d752d0a81", "value": "invoice_2566246817.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd12fa6-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701403181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403181, "uuid": "50543282-9fef-4ebe-84aa-47839a1e81d4", "comment": "Malware payload (Formbook)", "value": "0f60f086665fd4d442821851c878c21b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403181, "uuid": "cdcf7246-783c-4b7c-94e0-7d6e4919e703", "comment": "Malware payload (Formbook)", "value": "3acd90196dcf53dd6e265dc9c89b3cb0c47648a3b7ac8f226c6b4b98f39f2fc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403181, "uuid": "22be7823-19ea-4a75-8091-cef96832034c", "comment": "Malware payload (Formbook)", "value": "a4d4f31fb794bbf59be542f493aea9f9e3857d47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403181, "uuid": "a4c0b164-d5a6-49a5-88c1-530cf3244ee4", "comment": "Malware payload (Formbook)", "value": "6447659714f1d89d219f80f0543d93b1c1210c98bdcd6bdf02576b798010a871b75d1bf1d0232b81f34941c7b3e3410f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403181, "uuid": "b3651f8d-d19e-4599-bb91-636e4b2e78be", "value": "T1DBF109149BAC8337EAAF0BBADC7743831335F3919881AB8F396C62151D076500D6B7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403181, "uuid": "fa30646a-797b-4f18-8778-6827d72d2d9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403181, "uuid": "fa5526c5-a67f-4cd1-96d8-0729ddf8b7d9", "value": "96:K1FlqCSVw5PbMDDLUr39zf4trmVS0JTA5LqtCnl8HvPvmXzNt:K1CMbUnE3Nf49wSwA5LqtBPP+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403181, "uuid": "022b5866-73f9-4497-a4ef-0155d4c45ef7", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403181, "uuid": "4dcc3654-99cc-41fd-9da1-ba06b3992567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403181, "uuid": "c3174a9a-2df8-453f-9882-f7fb97a43759", "value": "0f60f086665fd4d442821851c878c21b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95018145-9050-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701438626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438626, "uuid": "52bb4886-9e05-4da2-a27a-f2d9e0678ac9", "comment": "Malware payload (Stealc)", "value": "a2da34f16556914cfd1218970c90e451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438626, "uuid": "80ba8ada-72b4-48b5-8941-2a86b8130f24", "comment": "Malware payload (Stealc)", "value": "3b29f950968c3e659a25e4d65085b3c2337db74cfcc88fb7172971b1c3f13837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438626, "uuid": "6b8b50e3-561b-493e-81b3-7fdf3ceafc3d", "comment": "Malware payload (Stealc)", "value": "9ac22b21244777d2d2b9ae22fb551f6a0b54f4f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438626, "uuid": "1b6689d4-f0d5-458f-ac07-3841adf9b0f5", "comment": "Malware payload (Stealc)", "value": "639f4565b8a3ac40e597952c9d88532485d35b9f19c11601dc8117fd9e325a1b0a5da05c99836ee2490b86ba1a1d5f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438626, "uuid": "eff87030-8910-4a4c-9f8d-e5f72366a10e", "value": "T1AF44AE12B2E0D472E11706318D66C6E42A2AFFA18F14AADB27947F6F5D312E1C671F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438626, "uuid": "72808409-5b72-410f-9b41-4cd05c6cf4e6", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438626, "uuid": "c16e4290-2d42-4890-bc89-407bb1b757ac", "value": "6144:pR2kdN6l00Ul/YbyRVZXGoMFK0OK8yL7Ve:pRQ00Ul/YmGnFK0OvoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701438626, "uuid": "69551ecf-261a-4bee-81f0-3dee4fb434c2", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701438626, "uuid": "d3a5b786-cded-4e51-9768-f25ffae11dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438626, "uuid": "a67d6365-5c95-49c4-a71a-cbd21b81a26e", "value": "a2da34f16556914cfd1218970c90e451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d113612-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413299, "uuid": "d7728b7e-3dc6-4d40-ae59-5347f3d5dc7d", "comment": "Malware payload (AgentTesla)", "value": "1cb48027023b81dbb379affeaf8d7dcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413299, "uuid": "b54f1939-4fc6-477b-b28c-7b505efc72df", "comment": "Malware payload (AgentTesla)", "value": "3b64f7763e13df83d98937c6e28a4cb90125c0745111effc3125ffc7ae9d18bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413299, "uuid": "cf937467-b7ef-4c9a-99a8-a1cfc6010349", "comment": "Malware payload (AgentTesla)", "value": "419cb2c717da6aaf9a521318f1d5315aef93d9af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413299, "uuid": "a17c5b9f-5c95-4d18-acac-abe61a440f16", "comment": "Malware payload (AgentTesla)", "value": "32d5b0625b3d8df0b3705e9747db510db76465f60d3aead00c37ce41e6a74e7fc9fd08c6cef45733fdd3e1492e0defd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413299, "uuid": "dba0cb21-33dc-478c-91d4-d7558c7bd5fc", "value": "T1ADF4E024F9F99712D6FAA3F2145052200BF6395AB43AE3290DD8B4DAF265F021943F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413299, "uuid": "9fe0baf2-85bb-466c-9d21-ea34bde2d764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413299, "uuid": "6caf50e1-f42c-41a9-b749-88fbc778fe68", "value": "12288:LSdI0+32BXAs19j1snY9YNi04M4eZL+eDwGMFE:LSVBdAi9JvdMFVHDwvFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413299, "uuid": "c1f307c4-63f9-47f0-8fe4-642df1f9d9c3", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413299, "uuid": "7d2a6660-7813-4f94-97e7-9e5ce8215333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413299, "uuid": "08d52ded-e2fb-4aa7-b1f4-379ca6760cbf", "value": "Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b739362f-901a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701415491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415491, "uuid": "0bd635db-b47f-4f74-9121-3e8f59e0ce64", "comment": "Malware payload", "value": "b664510e36653991163eb45c3e1cfbcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415491, "uuid": "9c722f46-b912-461e-a367-0a3c8db925a4", "comment": "Malware payload", "value": "3be83f29f12bc159aa27b4ead0d062e9d13e27031654fc0ac5b16f10488fd82d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415491, "uuid": "56965632-6515-4621-8e50-e722dc2ca9a2", "comment": "Malware payload", "value": "b56d2e9ece7114068b700fe4c96e12e2c094b509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415491, "uuid": "afed0768-12e8-4bd1-879c-0a1b190a64c2", "comment": "Malware payload", "value": "27253494c23a2df15128d8742bef16580e2c95255af3a7fd6d90be18fe12ef254ea85cd61516714b576fec6d2b33cf32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415491, "uuid": "1df338c8-1511-4473-a38b-2016112ddfb0", "value": "T1F4257CA8761071DFC717C9768A982C77AA20EDB6470BD203901F45A9AE0DEB7DF105E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415491, "uuid": "0d20c3ae-8656-4144-8c06-50dd53d77cbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415491, "uuid": "3389cb58-d7a9-41af-a89e-e884e745f5de", "value": "24576:MvRcf7XTKFHz+z7q7TDBGK8cWmgMYr5fOrnR2ccztLxviAW:M54yFTeq7TAbQba5fOPchLxvbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701415491, "uuid": "875e382b-065f-4569-848f-67cb411e01b0", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701415491, "uuid": "fd5b9b19-1633-423b-8e56-219eccb2e254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415491, "uuid": "75f1a7da-019c-4654-8e37-99b091f7110c", "value": "\u0411\u0410\u041d\u041a\u041e\u0412\u0421\u041a\u0418\u0419 \u0427\u0415\u041a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f50ad6-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1701416354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416354, "uuid": "374536e7-e20e-491a-bb7d-5a2a96e78a63", "comment": "Malware payload (ArkeiStealer)", "value": "31ddb76cee6b27419e729bdc4b60428e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416354, "uuid": "a15d15ea-f609-4ba7-b016-aca8f8e2369d", "comment": "Malware payload (ArkeiStealer)", "value": "3c8861781bc5c16b4490863e238c5dc72fbe6586a1ee36df8989e7993a9c46b3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416354, "uuid": "00dee56a-e4c3-44a9-bb84-a3bfad7be63f", "comment": "Malware payload (ArkeiStealer)", "value": "e7172ca1040c2afa6ba4d995af34de91439b7f8a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416354, "uuid": "cb23fecf-1cbb-4dab-b2a7-d95df71e54eb", "comment": "Malware payload (ArkeiStealer)", "value": "c94db634b11752ee6cca3d312ea3b700926098499c233175dc339d52e13919c7ac44866f23eafa9b52565df8ffbd6248", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416354, "uuid": "bc9c6084-0c4e-4800-8d49-7e4b4edf4ea5", "value": "T19BF6333E27A55F7CC5EE057A0B6168E1A633E93220E0361089576EFD4EEF7C5D02AD48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416354, "uuid": "e22d10e2-5ba6-44f7-9ca8-adddc3ffe20b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416354, "uuid": "d9d19fb2-c056-40d4-afe2-ac00b0ffe24c", "value": "393216:Ej3iUkEPE1GHoujdy1JbCVwqusx0M69g52Lm+Sk7Nl:amEs1bujM0WexK9tmov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416354, "uuid": "9167a8ed-2e17-4c56-bac8-c35ea7d6a730", "value": 16316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416354, "uuid": "2d2c7b77-9644-4cb6-bca5-7b1011bc57f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416354, "uuid": "1bbc0d1b-dcc7-423d-a369-659f3b73603e", "value": "kent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa8ccc1-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701413894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413894, "uuid": "e7cb08a9-95f9-4af5-8afd-ad339bf0b00a", "comment": "Malware payload (Tofsee)", "value": "f4592b71d5dadabf66ee3700e84edf8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413894, "uuid": "18e22d4a-e677-4562-848d-fbc8ad2a5d49", "comment": "Malware payload (Tofsee)", "value": "3cec06bcddcd94226a7436028917384f92a6921390cc1ee58548c3a51c448e5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413894, "uuid": "b4cc96af-5226-4bc6-b2ab-e99dc2d6c7d9", "comment": "Malware payload (Tofsee)", "value": "b32b3ecf9a3e82a0123998ce71857e53dac64150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413894, "uuid": "00137a7f-807c-4234-961f-3a2b59a6ed26", "comment": "Malware payload (Tofsee)", "value": "2353665b42e1d473697a912fad7d961e938d79938bcb2c8d1ef4331fc5617c2f28d4faf91d5a126ad170ffcaaf820026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413894, "uuid": "03a35258-3c1a-415f-8e4b-de2c0dd36d25", "value": "T1E464B54392E17D46EA278B729F2F86EC771DF6508F4977AA12289E1F04B11B2D1B3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413894, "uuid": "6692bc93-4662-4ff6-ba64-2377e7909a17", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413894, "uuid": "a91f1fb4-9c26-45e8-8aad-cbdf71f225e6", "value": "3072:nY+QUDdSe9eBtw8snC2H2/q2v43YAy4iD1nJ75VyUZ7ixF7Mu63jXdo:b/KMC2H2yogyFP9jX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413894, "uuid": "a26074f9-8419-4ac9-96a1-57e90d6da8c9", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413894, "uuid": "ee6ae975-b05c-40f6-b154-63f0f26b88a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413894, "uuid": "678c5b60-141d-483f-a901-a67e028975ed", "value": "f4592b71d5dadabf66ee3700e84edf8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52038906-9049-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701435507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435507, "uuid": "06729900-3fde-420c-9e80-b45d42bb5e62", "comment": "Malware payload (AgentTesla)", "value": "c378e81969c786a983545dd048bf8620", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435507, "uuid": "b18fe5b5-9e56-4d1b-8766-e9968cdd955f", "comment": "Malware payload (AgentTesla)", "value": "3fe770efe255e2b7225d6108878f3b5e78dc8b6d90a5d09229b4a42a14f7be24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435507, "uuid": "f091e850-c7ae-43d1-94dd-8ff5cc30896a", "comment": "Malware payload (AgentTesla)", "value": "d107abb6ee9e2537c18e9402478cb2819af48bcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435507, "uuid": "a643fe05-d7fc-454b-9b5a-eb2b2e31aa0f", "comment": "Malware payload (AgentTesla)", "value": "075746608f29aafee0dbd0cfded7b3f049625708eb112ccdd5387f4d3bb8488c69b98c6e5d2e78b04a1685b3770bfb63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435507, "uuid": "effa6092-2ba8-4419-8a38-b222859fa3b9", "value": "T16DD43304D02929B3A029A96715965513CEF30ED719DC48918D8EFE58FB0FFE1AAE0CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435507, "uuid": "42053433-2ac8-4340-b70c-5870cbad226d", "value": "12288:GbNN0vkI6YiC/V1CYI94Umjrr31F3uS8/VJe0hJNw8ZJtE9f1BFJJfoFNLF/:GH00eV1FIKHp1uSAzNwQE99BF3f2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435507, "uuid": "cc6adff8-dc7a-4db4-880a-db080f18c68f", "value": 648590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435507, "uuid": "6cf849be-120c-4759-8ca5-4987f49b3a9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435507, "uuid": "b976b80f-8c6e-4092-a2df-f76099f2213d", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe2bc20-9053-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701439826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439826, "uuid": "662a6cc9-2d07-4f80-be30-02b53dab788d", "comment": "Malware payload (DCRat)", "value": "dd013bbb8067a547c9a9af3a182bddb6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439826, "uuid": "9c553809-942d-414b-9fca-c8f48d67e07a", "comment": "Malware payload (DCRat)", "value": "40dadbe6e4e76a98d783977582f10b29fc5c0a7d96b2b6e0ff5d381ac7ecb84d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439826, "uuid": "532289b5-d7f4-42b7-985d-4864bb55ca15", "comment": "Malware payload (DCRat)", "value": "131dafd65663760ec7ac7bb238688d529b52d2c3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439826, "uuid": "f671c31a-7195-41de-9f82-e15e7a506ae1", "comment": "Malware payload (DCRat)", "value": "9923910d229ba357cb6cbaa5e4053c33ae539170cf787f5dee32422e2e7461bfa1f7fa3f46a17db629309c32b2e2ce5a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439826, "uuid": "c5f5fa6c-ba56-4b01-b627-4768a7ce890e", "value": "T1C1D6338618DE80F5EAC12970DA2FB7DF27B256E588C4CC28EDC52987F852F7250764D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439826, "uuid": "07321250-a9fa-4144-8e6b-eaedd8790b68", "value": "6c117346b0d0bffeaa7c20cbc489c68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439826, "uuid": "a3fe0130-c6c2-4299-86c2-988675d1ca8e", "value": "393216:/c8iduZtn9A2sJoe5XXgLReebgQa7SwBY:/6duZt9AfJougdeekQki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439826, "uuid": "033e3cd5-e964-497b-b208-c1903a241dc1", "value": 12642816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439826, "uuid": "0edc78a5-41b6-4e46-b67f-e586505ae3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439826, "uuid": "27b02f85-fea2-421b-b348-218b683e69d6", "value": "40DADBE6E4E76A98D783977582F10B29FC5C0A7D96B2B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07036bd8-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701422497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422497, "uuid": "6951342d-43c2-4cb3-b3a0-25b2098e6d35", "comment": "Malware payload (RemcosRAT)", "value": "4b32bbf3c93a65c6834d6f81a4c68a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422497, "uuid": "1e0a7ee4-8559-460b-89db-9505dc08713e", "comment": "Malware payload (RemcosRAT)", "value": "42a8ee6a8e2f9efccdac2959f5672d3512b63432baa50760de9f18d2ba912852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422497, "uuid": "7bf02976-b757-404d-a91f-956424905729", "comment": "Malware payload (RemcosRAT)", "value": "64a253fda8ccec3f0eacc762a23cc9453da5aec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422497, "uuid": "22c41417-63af-4b63-8a60-d0c9f1b295da", "comment": "Malware payload (RemcosRAT)", "value": "f440521bcc923edf2080caadbed32c99d4694b12cda5d6cb9eeadc83b4a9a67923916adafeb0835a315e6499ba01b0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422497, "uuid": "14fcef34-ae0c-425d-b12b-2c635ba565fd", "value": "T15B251252331BDB91D86F4BF7585485144373AD1FD8A0E20C68D939EF77B2302A8A2E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422497, "uuid": "7f426a70-56bd-4104-8acb-5d7076d6f5f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422497, "uuid": "602d17c3-eedc-4ce2-8af0-f206e1b4dc1b", "value": "24576:b2JLWGfsi0hvyLiR6e8/NTxGjs1Y8hwL1TDHw7+uUOg7lTt:b2J6GfSJyLnTN9Gj2YLh/w7Dgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422497, "uuid": "65388360-d2c5-4bfa-8f61-a292f4052da6", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422497, "uuid": "ff1f7d23-af68-4a45-9889-070d47d645e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422497, "uuid": "6b033861-c1a5-4da0-ad8e-246d37364b3f", "value": "PO-513211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5307c5fe-903c-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701429926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429926, "uuid": "50bf93af-19e7-4815-a43d-488383a1f97f", "comment": "Malware payload (Socks5Systemz)", "value": "ffb1d73a833079d84d4bb02384b45a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429926, "uuid": "5b93aa95-feda-4c55-af9f-f4694d103d47", "comment": "Malware payload (Socks5Systemz)", "value": "437d2b46f38b59637d58c165702c2a7f6138f91a3af15c073c357ed2d612e650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429926, "uuid": "6f1f0524-939a-40db-85a3-b6e08e6e07e4", "comment": "Malware payload (Socks5Systemz)", "value": "aa8b8a52c70ffede17b48e31cd864f70cf3acbfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429926, "uuid": "2a97f18e-6380-42fb-8df3-f8a6c4a3f5df", "comment": "Malware payload (Socks5Systemz)", "value": "8c37d557fadf3d92c8cf77477b5bcb0c034e8808660dcc4b08ffaf1c0f346eaeb4ffb4260973987664e3691a32160f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429926, "uuid": "bf503fd1-c25b-4ae2-b476-3adec509311f", "value": "T18DE5339212B3C436F891457248E8A44496D3FA214AB47D96250EC6CABB335D6F0EF37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429926, "uuid": "b647be2a-aa35-4f19-ad26-f45261cf304c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429926, "uuid": "42ddadee-68d6-4a73-9aa3-d21d8c3d82ef", "value": "49152:K2V9j2tB8nFGjZqzfN9VporsIKpeN+sivVAvtgUeYqpMqK9b7Bz/sI:LV9KBi9grsIKcNBivVA1g4yMx7Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701429926, "uuid": "30134830-7517-4990-a8d6-d49e718423e3", "value": 3102974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701429926, "uuid": "efeb9768-47eb-4dd1-953b-7671bb49550c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429926, "uuid": "8223fe95-17ce-4f35-a02f-c68df49e5f9b", "value": "SecuriteInfo.com.Trojan.Siggen22.21729.25654.12632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b087b5b-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413189, "uuid": "3240b300-c250-47b0-8e26-e6cb2145c7a7", "comment": "Malware payload (GuLoader)", "value": "4603b3b3b4ab4df6f9de5e6d5fa185fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413189, "uuid": "7190e91e-5d59-4bcd-ac90-722987b50f51", "comment": "Malware payload (GuLoader)", "value": "43acec52a82b408f6b5dc63f194f192fd83ce974960146540170b53090c39029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413189, "uuid": "df55185e-95f8-47f3-9ce8-db03ac9cd2f9", "comment": "Malware payload (GuLoader)", "value": "5521fce0bb45ee8c7a399446f4b588c7324d79dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413189, "uuid": "bd84b8ec-86ef-46bd-bd95-fac96a4b38cd", "comment": "Malware payload (GuLoader)", "value": "767fce8f7dbffd054845a76bbd86960224850825672ffd09653cc1a9e0f3b32adff1dff10d26ee7b619633e7401951eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413189, "uuid": "30f816f6-e3a6-4ae4-8bfa-45b814b1412a", "value": "T15DE4CE9239C975AFEC2F8A74031FEAB22A795CD07392486E4F40760D4C3664690EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413189, "uuid": "1d51033d-8b61-4497-9325-8b2c5358f0c9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413189, "uuid": "b2220684-eb79-443a-ba51-69b0a1cd7c4c", "value": "6144:RmOPAPZVheNA+ff03sP6IKC1J5zsGitKXtnIyglMbsgHvLz3ZST70mw21NKl1+Bu:knhe2easP6A1J5xi+nIR/On291YLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413189, "uuid": "35326408-b43e-4e4f-a535-a053eede9acd", "value": 670856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413189, "uuid": "7e159c27-9fc6-42e3-a00f-9b8c46baa2c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413189, "uuid": "041614a8-d059-4eb9-910e-6a029607f0c6", "value": "475128640_20231129152352507pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98003c2b-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435195, "uuid": "ec690bbd-7d87-4088-b7fd-d4188a9efe30", "comment": "Malware payload", "value": "f3a20fd7237e9b3a7dd6a62c3e107375", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435195, "uuid": "19b05604-7d1f-41a9-9cf6-d39049ba2ee4", "comment": "Malware payload", "value": "43d28915fbf7da76125b34a61523ad7fb9473dd7e5ed0990deded09ca03ff7ee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435195, "uuid": "9622f429-c2e2-4e25-acda-5b4bef633afa", "comment": "Malware payload", "value": "7cd3bc0e394e311055f0df9549d8c8abebd178b9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435195, "uuid": "0d371205-147e-42b9-a35e-79622a5329f9", "comment": "Malware payload", "value": "c0c07e3797a3831108d11d59627990bda911a34cb4e8f397dffd1f119509c517e71a09a235a031444a2ec595ab81e28a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435195, "uuid": "72afc451-105c-4863-b919-0e1b9d656694", "value": "T184560179731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435195, "uuid": "d3bd8cb8-31ef-4f1c-8b3f-432f6c00e97b", "value": "196608:/tDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJY8:lirUVis8O/0giAZ9PD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435195, "uuid": "6d3f1e83-4300-4848-8ef4-09f97c70cbc4", "value": 6364096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435195, "uuid": "3bbf8e5a-50a7-489b-b3de-c3204b7c2e88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435195, "uuid": "3a36e84a-07f7-44e0-a127-796ce4437f47", "value": "\u043e\u043f\u044f\u0442\u044c \u0432\u0438\u0434\u0435\u043e\u0447\u0430\u0442 \u0441 \u043a\u043e\u0442\u0438\u043a\u0430\u043c\u0438 5.9.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f93c832-9045-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701433678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433678, "uuid": "24ea1570-84e3-4633-97ba-eb107a123528", "comment": "Malware payload", "value": "7d27ed94ba01dc9c2761af0ed84c616f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433678, "uuid": "4a5fda88-e80b-469b-a811-5c18b0d510c8", "comment": "Malware payload", "value": "44cac5bf0bab56b0840bd1c7b95f9c7f5078ff417705eeaaf5ea5a2167a81dd5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433678, "uuid": "93889686-373e-4fff-8e8e-2224a82c186d", "comment": "Malware payload", "value": "c2d9ecb9e0496dd21e636a77fac370325b8ae6ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701433678, "uuid": "bf174646-de69-4f90-8b22-4309a9e9611d", "comment": "Malware payload", "value": "6e681bec387fc2f563abde57c72be7d9bfe5f98cbce76501e399d97d9c2f0c4e5ba438dc25814568527d2b4aa34bf43f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433678, "uuid": "3a4bbafe-e434-4a12-b77e-6b7e02aa5903", "value": "T14E9733064D2ECDE5F34E01FA5FE63C93538A22EC18851C766DCB4608B494EBD7623A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433678, "uuid": "c76b0242-44c7-4582-afb9-4cfafd64b7ed", "value": "786432:Y/kkp6DZnYmdRd9YtxYJI/3FIzaXEPfxUwsuVW9maOvMwL9koP+7:YckpeYmdiLeI/3gaEfxUwsuVvaKMwuj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701433678, "uuid": "655d4472-8481-4499-97f1-f8a88b697249", "value": 41121715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701433678, "uuid": "bbd5eb9f-07da-479c-9032-0f4f36e1837f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701433678, "uuid": "0bb35de4-7d05-4078-9c9b-3493c78c6222", "value": "Zoom-x64.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93d5811-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (Quakbot)", "timestamp": 1701416326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416326, "uuid": "3c7115b7-643a-4a81-b137-9751bfbe0d2c", "comment": "Malware payload (Quakbot)", "value": "eac138b49c6f90896c9af5cbc8fe38b8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416326, "uuid": "001638bd-447b-4f9f-9416-ab1b4d96779f", "comment": "Malware payload (Quakbot)", "value": "44e593c98acaf52aee91c09fe00fa196668351783fc8a623fc1da5325635130f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416326, "uuid": "e18b8205-b48a-492e-986c-bc10459a8cbd", "comment": "Malware payload (Quakbot)", "value": "c44a683c787c1d9f2ed1a016d9bd5bda3275342f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416326, "uuid": "2c266814-077b-4c29-9896-5865fd109165", "comment": "Malware payload (Quakbot)", "value": "0336235608b79c960e007b30fe799c3597504d628a5322662019a16381d673187cec44acbd71414cb85341cd247f8010", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416326, "uuid": "47643c8b-5591-48d1-9568-7a71c65943ad", "value": "T1CB032D12B9A4CF95E34949303E9BC28969A9BC6F9F1D928737B07F2DF8747608E11311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416326, "uuid": "db5d7dff-89ef-4b78-9dfd-94537de74056", "value": "384:t68NWgtQziS8px8SMDVvHLZTlteZoN0j:t68N5X3y9HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416326, "uuid": "83d2b0d7-c0ef-4e11-b781-d53efd04c7d2", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416326, "uuid": "90d3ffbe-0400-486f-8ef4-84636ad01fcd", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416326, "uuid": "f436c94a-449a-4b02-90e0-728a45947230", "value": "d12934-0202334.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e64e5c-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701403488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403488, "uuid": "1f670afa-cf22-46ca-9780-ce7850c9e28b", "comment": "Malware payload (AgentTesla)", "value": "76fdc05d428de82f705ccdd065cfff13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403488, "uuid": "48a5a923-5ce6-4b4b-9c01-29b695e51462", "comment": "Malware payload (AgentTesla)", "value": "47009c672adb7afb15740b8a01913ed3f80e3e8cdb602fd49f79d7a500ef1e7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403488, "uuid": "651aa582-fcb5-40d2-b91a-4c476f202c1e", "comment": "Malware payload (AgentTesla)", "value": "a369aa23c979770e323c86c307eb677f388a2c20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403488, "uuid": "867fd276-a24a-4899-aa66-f14d2bec413a", "comment": "Malware payload (AgentTesla)", "value": "547781f6da51b7a6465cfb140f3d18e110619f1903bcac3e3933075d876fd67ffd4dc44cff66c86df56e78c5840eb719", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403488, "uuid": "65df1c0d-158f-4321-95bb-0351f945511c", "value": "T1CED40221B0B82797D77997FA056090240BF26BEE636AD31C5CDBF0CB7565B084A90F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403488, "uuid": "dcf41111-1616-4c70-a48b-f317cb348e67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403488, "uuid": "a2464182-6fe5-4053-98ba-905ca13b66b8", "value": "12288:lq8oqyMKzwZhkNuCRGxSx4Wo4tf6Z89iN3deAuESjyTyk3k/StofxrUuqeuC:XRAzkaN3RAmza884EAeyTKCVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403488, "uuid": "36e5934b-3d79-4f83-9250-da0e2b06b790", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403488, "uuid": "3597f9c1-6225-4693-9485-17babedad5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403488, "uuid": "68780c82-6b07-46bf-a75e-a33645e8576e", "value": "76fdc05d428de82f705ccdd065cfff13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71909e3-900e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1701410310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410310, "uuid": "bb25de90-bc59-4bae-85b5-3f8670994db9", "comment": "Malware payload (Mirai)", "value": "da63021a0b5e80a797f6f458f6582bf0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410310, "uuid": "6ab7ab9c-ebe3-442a-8a7b-00872c012afa", "comment": "Malware payload (Mirai)", "value": "473c27b566b859db64165586ff7592c4cf0d450ff5868419ce85b15010a27a08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410310, "uuid": "5c42ad8e-8d74-42cd-8694-8b4b27818edb", "comment": "Malware payload (Mirai)", "value": "d9a4c26625955b07665c17d6756b10965245cd18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410310, "uuid": "483bfdb8-4596-41cd-b57f-80f08c304e1b", "comment": "Malware payload (Mirai)", "value": "0093f33032574a19f10b3d512b938e13da991f0ebabe1bbf8dbca8f861562320d94c9eed513af2ea6601b5813fad0834", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410310, "uuid": "b007977a-1aca-43b2-a4f0-1083dc72a07a", "value": "T13CF34D46EA418B13C4D6277ABADF825633239B54D3E723068528AFF43F8679E0E73505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410310, "uuid": "4fe3f8dd-e705-4e08-8d3e-fd791e7365bf", "value": "3072:H33F81JZa73XijUmHRaJJKh2e9k5SbVVqpVU7jD8eKRM/92eM:X3F81CwfRaJJKh2ea5aVMVAjD8FRM/9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701410310, "uuid": "54c911e4-cf42-4c99-817f-66cfcd787f52", "value": 171124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701410310, "uuid": "4576bfa1-e0fd-48d3-ac34-63d0e7867b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410310, "uuid": "d5e6344e-b74b-4b62-b1eb-28ea0df45fdd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb51d31e-9025-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701420329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420329, "uuid": "827a3dbd-92be-4883-ad4d-9f0489430a5d", "comment": "Malware payload (Stealc)", "value": "588a13b77a793d1b4c90a9702b0e5072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420329, "uuid": "87bf1c4a-d0d7-4523-8bea-6e2c490fc4fd", "comment": "Malware payload (Stealc)", "value": "476a074e0c4c3afac432983406efaa29f427f2a3cffa180c5bb808865b44a74d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420329, "uuid": "4e16d8b1-856f-487f-b69b-2c5b4180d2c2", "comment": "Malware payload (Stealc)", "value": "927d08cdc06fa993450a82aafd914cdbdf8e014e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420329, "uuid": "c7f8ee5c-0d75-4acd-9c3a-ac8f0eed576a", "comment": "Malware payload (Stealc)", "value": "c9120e5ca88e3212d602cbd6c28302039aecaddd9ef3bcf29ec67d3a97541f539b5a249f43473e67ccf77982b61b0511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420329, "uuid": "ff1d4002-50fe-47a4-8bdd-5f62f14f1ab2", "value": "T1D734CF2172D4C072E12769354832DAA55A3BFCE29B6186CB27D43F3E9E312D18BB4747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420329, "uuid": "93434dbf-deed-4a1d-8816-a3a7f0f4ec40", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420329, "uuid": "9944780a-58cc-4435-be3a-ac933088f2a7", "value": "6144:DJyqfBd7gUgOHt4CmX/OGkG1EPb9UmfHOO:DJytUgOHtPmvOGr1EPbLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701420329, "uuid": "8d1aeff2-4d5b-4b84-a379-1a5ef254c239", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701420329, "uuid": "8c6bcdc7-46b2-4201-9c90-4cb581442205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420329, "uuid": "7847e4b6-bf23-46de-ac3c-8881a5ddd0b7", "value": "588a13b77a793d1b4c90a9702b0e5072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af7d258-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442314, "uuid": "940b2c32-07e6-4b96-afb7-f8b401458137", "comment": "Malware payload", "value": "5df07c43f06727b523e617fa075d5615", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442314, "uuid": "608eb80f-d6cb-4d5e-900b-473db2f40767", "comment": "Malware payload", "value": "48960c0f7539eca57511c7701a5dcb75f6c8340ed17a47bd3367235f99940a6d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442314, "uuid": "2afda119-8071-45f8-89b7-08414fac3060", "comment": "Malware payload", "value": "5980348824c2e68a0e59145199d78b4b29e5af07", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442314, "uuid": "2b1ee011-f081-4bc4-979e-b4dcd1627a34", "comment": "Malware payload", "value": "d8fdb80a1f1868b8990a8d2f88508846c886271e55d8055baa053f9e591381b8e2cad60e4ecada198c9167a6cb14e990", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442314, "uuid": "b2c31226-660d-45f9-ac21-cfa30f1b95e6", "value": "T1FF560179731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442314, "uuid": "6b4ba223-cfcc-4b3f-839b-edd3230b5a78", "value": "196608:/SDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJY0:mirUVis8O/0giAZ9PDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442314, "uuid": "482d68a9-5d6c-402b-9b00-8df85ff114d9", "value": 6384574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442314, "uuid": "ecb56268-8c5e-4c98-9a73-ce936b90433b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442314, "uuid": "3ab91de8-4d12-410a-beca-c5e2d5a44e02", "value": "\u041c\u043e\u0438\u0424\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20906e0-8fe6-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701393175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393175, "uuid": "3bff8d02-5946-4195-a699-0c871e4096d3", "comment": "Malware payload (Tofsee)", "value": "002577e928a32cc049a70cc3dfd32f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393175, "uuid": "aab6a8d2-ebc5-45bf-94d2-5c4dc12ee912", "comment": "Malware payload (Tofsee)", "value": "489f26c346d2ff193ea6802b5c23e2bfa596960d2358d10ca70c60e590f61d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393175, "uuid": "25f544fb-5371-4f09-a9a5-0507576b87c5", "comment": "Malware payload (Tofsee)", "value": "3260f1f784d1423c622b895cd8df6198c10afef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393175, "uuid": "de40b91c-4205-4571-9b9c-5cd68fe33d28", "comment": "Malware payload (Tofsee)", "value": "d2ca9489cfaaac8350c411493131437e442162ad0c1548667cfc38e5aae430a3ecdf220843c2c1a33e8265fa9daaacbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393175, "uuid": "ef1dab5a-790f-4b57-84e7-a496e62d8f4e", "value": "T16B64E64392E13D86E92B8B729F2FD6EC771DF6508E493B692228DE1F05B0176D1A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393175, "uuid": "a7f8361c-999c-43e9-b1d4-5c3d687221f5", "value": "a8ca86a93d9814ac3826edb072ebc505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393175, "uuid": "cd8c8e23-caad-4071-98c2-21bfae52b347", "value": "3072:TTUp9FKYtnJVHdc+O4vVUfF3vjS2MA7215s6pJUMu63jXdo:U5KWJVHdhftUBbVMA72E6pLjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701393175, "uuid": "b86c8bb0-b22e-4acf-886a-3bf098fc3aef", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701393175, "uuid": "1aab0921-fca4-43cd-93c9-362a4816455c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393175, "uuid": "3d7aed5f-e6c2-412a-848c-414720bbd6cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbc6b22-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454851, "uuid": "279940e9-cb0b-4117-a781-b4efa158596f", "comment": "Malware payload", "value": "190cd7a56190d75d9ad4ff2e358a5abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454851, "uuid": "b0ad6412-0fb2-4ac4-ac0f-0696dec5efab", "comment": "Malware payload", "value": "490af4fbb975ac1874d60c19f828cf5626202f7d157277ccc71222615c9d7d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454851, "uuid": "506ea1bf-0a9f-4c49-a0a7-8aa66f67ac6e", "comment": "Malware payload", "value": "e0385d51f452b0b2b521eb196ee3f7c76dfa5602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454851, "uuid": "b7456d5b-a7a9-43b8-b9ac-b2164116c7a3", "comment": "Malware payload", "value": "56181e3de25ed931fa1b07d3511ff2b9529be9d41f8ba74bd64c532aed760dab840f97a7f2a742ac50d942693e9af498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454851, "uuid": "d31df9e6-9d59-409d-a076-bfc86820cace", "value": "T1F9357C1731915033D6B239354A2B42ADC92AFE261D78386A6BF59C483D31643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454851, "uuid": "0db5ac12-24b9-4d8f-848f-f86570556672", "value": "24576://iwHPhfykvkHee566vMW7lJB4mnkd1coq7WYLZ3Wu:HiqhakYZ4aXBN8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454851, "uuid": "062270c1-a465-4297-81a7-b232aa2d83aa", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454851, "uuid": "e182b0c2-cb8f-49e8-a7c0-ca0757b2eccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454851, "uuid": "b5cd5afa-b313-49f0-b1ab-aa61ceb2e7f4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3691.12811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bf2f05-9034-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701426541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426541, "uuid": "03c3a2fa-8f95-4d09-9368-ff81c7f80fef", "comment": "Malware payload (AgentTesla)", "value": "28efa090fe5af4333de11723d9a60599", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426541, "uuid": "2c3cc406-25e1-4266-9d55-7990e45937d0", "comment": "Malware payload (AgentTesla)", "value": "4991ad7da11f0a8fa7b06ba980a38c53dcdd188f4f81ff2eb532399df39fea00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426541, "uuid": "0009b59f-9759-4fa6-9f0f-5c6bd89b6d34", "comment": "Malware payload (AgentTesla)", "value": "e33a9eb83dd64dccec2dc231260aaf283bcd9892", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426541, "uuid": "d162fa2a-7fa7-40e3-9e53-16cbf868c0a9", "comment": "Malware payload (AgentTesla)", "value": "1998fa31f973c7fa6312c401efaf26b7738890648799dea4241245f14de1ab71aaf978e122503ba0c32b6573b0df91f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426541, "uuid": "87874641-49b1-449a-853a-00d6561ed524", "value": "T1E9F55B487A401C67CE7D21F3822A860429D3C46A270DEFBE36E795D9F70D6E3653E186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426541, "uuid": "fd0ef0ae-073b-4e20-856a-61c78bbc20e2", "value": "49152:6iSZ019738vfEG8K1i47LUNa9mmRNbJkdapc:6bZ0rvZiREj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426541, "uuid": "13c4a65a-ed5f-46bc-a189-3de3dc868770", "value": 3547136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426541, "uuid": "0303d926-0b92-4509-a8ea-9c48532b28da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426541, "uuid": "7c4fc6cd-c710-4378-912e-160cb8ba5717", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8dff33-900d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701409807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409807, "uuid": "0c319811-e461-43b2-bb89-3719fcad9721", "comment": "Malware payload (AgentTesla)", "value": "82d2326101678bb146c8b7a73f5e6c17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409807, "uuid": "2f093d04-ec1e-4151-bf6f-3a71e86d7790", "comment": "Malware payload (AgentTesla)", "value": "4a0dea975c92d7b1c0657ee82c983771b6f4e91bad4955cc48b95a71c2d82f3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409807, "uuid": "cc14e0d7-032b-4b48-a874-54a52a0778bd", "comment": "Malware payload (AgentTesla)", "value": "1dceab2e95bd2fd3cf51ece0f28522c719dd0451", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409807, "uuid": "afad2c48-303e-4742-9efe-ae9d60ee0ed4", "comment": "Malware payload (AgentTesla)", "value": "d0dffd7a7dc170672bc219964a5d203d5be143fa11929e7cb56bdcb5ee9581ab1a1e506c37b51b32911ef82239d169d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409807, "uuid": "3f3f5ecb-d753-4a19-b701-00eae0956a4b", "value": "T1FE341F037F88EB15E5A87E3792EF6C2413B2B0C71633C60F6F49AA6514522526C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409807, "uuid": "b7492c93-6e24-4630-a623-6ce63d53e6d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409807, "uuid": "f0336101-8f32-42e2-8508-7bbdfa071d9c", "value": "3072:T1RdFd0hNRFxHzb7lS/xp+pcXsH5GDvtMF7:TDrd0hNRFxHzHlSZp+eXsqvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701409807, "uuid": "fd5707aa-4977-44f4-8b32-8d3fabfecdc4", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701409807, "uuid": "697f1d15-1290-43ee-bd09-5341a4c4f0b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409807, "uuid": "d8edc799-a4aa-4fa6-8bcd-379eeaf1b8e5", "value": "17014098066c7b82cc06d0a48a81f4c0569763f205b3b256ca333f4137acde0d7007b6a208564.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d12079-9000-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701404187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404187, "uuid": "4e032b4c-ac4a-4334-981f-f8b53321a83a", "comment": "Malware payload (AgentTesla)", "value": "846d3857e84fef98d0657e0b6fb5f00a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404187, "uuid": "314f2e2d-d898-44cc-b409-dc1e5be9ef6d", "comment": "Malware payload (AgentTesla)", "value": "4a182c398c109d1c4863ef54ce1a34461547d9437e99c62d3f11853cebae39c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404187, "uuid": "334ac214-3f53-454e-b931-c7d9d89ead39", "comment": "Malware payload (AgentTesla)", "value": "d2febd1e758af38e32392d55fd28dfddf9d77868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404187, "uuid": "d0913388-7813-4497-8a4b-a344f0493bce", "comment": "Malware payload (AgentTesla)", "value": "c56d3efaed50b3fab4dc168f04bf91e70a882e0b1f18669a73bd6df39d59c1d0f1b87dbfd504a2ca27db0214ecc19deb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404187, "uuid": "0f009641-f56b-47e0-a3b9-f61cd245a40c", "value": "T1E2E412523369D792D47F5BBB2458780583F2B817A092E2184DD241DE6FB2B40DAE1FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404187, "uuid": "b7134fe2-620f-4257-ae24-95e592da1c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404187, "uuid": "104783bb-3480-4769-a4b7-32910bd53d38", "value": "12288:VCtgJIIUu6jhGy761DA38nKNYYjZslOyXjDT+a655cc2kbCR:2gJGukhhOO3mKNHryXP64x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701404187, "uuid": "0f84ad4c-1493-4900-9bee-eb862ae7170b", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701404187, "uuid": "89c625eb-0c5c-4a6c-a91f-bec4256b9fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404187, "uuid": "ef1207bc-697e-42a1-be99-d16a5f00870f", "value": "SecuriteInfo.com.Win32.PWSX-gen.23173.22456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1753f70-908b-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701464014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464014, "uuid": "a78be8ac-df91-45d9-98bf-bb2a3c342842", "comment": "Malware payload (Stealc)", "value": "31ad42b9abf3d56bb037d76f256b5aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464014, "uuid": "824eed57-db41-4b0f-a24a-8365434fc9f3", "comment": "Malware payload (Stealc)", "value": "4a6344d67c4ab2b8360bd3f1051506a0d61a327a332c20f925c68c26afd176bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464014, "uuid": "80da2567-f994-421f-8368-e1f6f1218a79", "comment": "Malware payload (Stealc)", "value": "a54a188ef1fe0c7e1dffc334338144b4fcced12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464014, "uuid": "dd61f481-9dd4-4b27-a1b4-f19836dc393b", "comment": "Malware payload (Stealc)", "value": "11b3cde79e2f1ca6df495658d01973486373f237b5104ebf5f6144c1e581f26b394810b0096b948d29be68706840a0a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464014, "uuid": "eb86b5a4-8bc4-43b5-93e2-ac26c2034e6a", "value": "T190546B1392E16C60E5164A328E2AC6E8661EFF518F3C7B9B1354BB6F09731B1C672F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464014, "uuid": "f4f35b71-5da6-41f5-97a4-4d31d999eac0", "value": "d3ecaa3ff256d295d638233f7023beb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464014, "uuid": "e8b4c163-dd71-40b1-9954-6d14831ff5d3", "value": "6144:Zxf7EL9C019aTTo39xUwpS0gUcVAu1b0BgCp6:Zx4T19aTTeXUyJcV6BhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701464014, "uuid": "46a52d80-da70-4357-a2b4-38f95892e5f4", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701464014, "uuid": "4f93edf9-7198-4c03-af87-51f1ade5733a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464014, "uuid": "62d4d39b-a4dc-430c-abac-46ec0368cbdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecb5b97-9085-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701461245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461245, "uuid": "1d678236-f812-42c3-948d-5455065babe8", "comment": "Malware payload (AsyncRAT)", "value": "61e7b11bbd166980e52a13de0ab51872", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461245, "uuid": "fa415398-a023-4aa2-9a26-88ece8a23753", "comment": "Malware payload (AsyncRAT)", "value": "4a880f082a6ded92d2b65ff46f3876ad5d15657c166a3290431c093f06430552", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461245, "uuid": "6b4363f7-151e-44de-abf4-1984aba94213", "comment": "Malware payload (AsyncRAT)", "value": "26ddaa5e33bb869af6b7550a261e267ff24d9a71", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461245, "uuid": "101e4fb4-d326-4087-b1b5-c19fc12988f1", "comment": "Malware payload (AsyncRAT)", "value": "572b003ecb15b251d3e4a940a2307cf5c105eff2444ebb4adede6ceb32e234389065c05ed8df1731bddf195e9f908a66", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461245, "uuid": "f12536d5-154d-48bb-a76d-bbabc944169c", "value": "T1B4233B0077E9C12BF2BE4F74A9F22145867AF6573603D64E2CC441DB5723BC29A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461245, "uuid": "adf9287c-9767-48db-8aa5-ce80fa558192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461245, "uuid": "421e7c3c-58ed-4ee6-b5e0-4438afe9e919", "value": "768:wuPfZTg4pYiWUU9jjmo2qrpKKodPIeK8yrcs0b9XCGGTEye7uunyWWBDZgx:wuPfZTgKa29+eKn0bNfIEyeiuyW4dgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701461245, "uuid": "4c8e982e-12b0-492b-a83b-8155cb09b212", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701461245, "uuid": "dac48417-a792-47d4-b766-991e6c4fb2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461245, "uuid": "54beb5f0-4441-4441-b2c1-e0629be3c6b3", "value": "bSc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8305164-9086-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701461905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461905, "uuid": "f1df9b81-57c4-441b-9d8d-632635face7f", "comment": "Malware payload", "value": "c57d5f4ec2992e6b06e891d09dcc3e32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461905, "uuid": "4f416d6f-d0f4-473d-9574-0a2988f147ab", "comment": "Malware payload", "value": "4b6f679ab3da317ee310d5bd482b41a77f5ebf1fc0d514d3595c3d16db6e7327", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461905, "uuid": "6bc438ae-f4b4-4788-bc91-cb90afeb8ab5", "comment": "Malware payload", "value": "f1627024fe4a922a43e2163d77da987918635ca7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461905, "uuid": "64a63f1a-3937-4dfd-a4d1-bb5ac267889a", "comment": "Malware payload", "value": "f252b4453cdaca78e7aedcb8c7c55b5be87e2f836693d1729d9e34f05697f4341ffa9437623cf1eed744b4ad1e7b8205", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461905, "uuid": "24777df2-4301-4a58-b95a-08d11f27664d", "value": "T183055BC2E68B51F0E1D849B811D913366BE2E1082F1794D3F678B9E489913D35AFFB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461905, "uuid": "6d336d52-93d1-4779-b3ba-c2d2d24e7caa", "value": "c92ab6a1d389cd499ae70ffa40b79e26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461905, "uuid": "ccf96f53-75d7-4151-9ba1-a242a18dadc7", "value": "12288:8g63h4h0gJBCq4l8D2HVoiFMAIW08gsMJJiJKoRMYBmXml:8g6R40wI8D21onA8DJioXXml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701461905, "uuid": "6ed63f74-c1f6-49cc-b57d-158b19dcc4db", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701461905, "uuid": "80b8a4a0-7ae4-4df4-ad63-d42911be8dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461905, "uuid": "edf1e9f2-bc5b-4b0a-9362-1eb19e94866c", "value": "SecuriteInfo.com.Trojan.GenericKD.68804356.7993.17877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae63c5e9-9062-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701446400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446400, "uuid": "01cf00f6-fc1b-4575-a059-2afe3ac2e1cc", "comment": "Malware payload", "value": "62c12d8e70e1e158c41f3e0b94c26638", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446400, "uuid": "c272aa96-6060-4779-a8b3-644e6ea54f00", "comment": "Malware payload", "value": "4bac3f557712c6067edb668ede41387bcbe7318c06c0d9b4cf9062721b8006ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446400, "uuid": "c37706aa-ddb6-4036-bb4d-39239c6f9c01", "comment": "Malware payload", "value": "72c895cdc64f89f9f0242a9f71d9a39a3fc13f7b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446400, "uuid": "1afe0a66-bb73-4de5-849f-16d9d063d49c", "comment": "Malware payload", "value": "a46bc7b66455ddd6bd4eeea30d6c93848c82d66e5b17cdd2022512a17dc922b3872b9a0c13bf984c44904fb87153ff67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446400, "uuid": "9371747a-d28f-4053-9232-5f4ec14ce6ec", "value": "T171B633FBB6F1D345DAA62FAB49D6C9EC90DA47478E51F9341CE10EE12C8E1C906BC250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446400, "uuid": "e966477c-7a98-4493-8af3-49b8f622dd06", "value": "196608:zGHNlpvIOG22ztsV8O5Em83t0xn3D5jdF+OcHsZXTZg6GXndTcHJNTD9A:zGtlNGNzttO5Em83t09D5JF+OJm6GXnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701446400, "uuid": "23579102-33ad-4ef2-8556-0de1fb1426e2", "value": 10651224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701446400, "uuid": "97181eff-44e4-4192-8c8e-6ee1f120225e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446400, "uuid": "7ee259e2-eba7-4b18-b394-27da1bae0184", "value": "Eseoa Onlyfans Leak (Photos & Videos) Eseoa-Onlyfans-Leak-14F073A0A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7700293b-9029-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701421825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421825, "uuid": "3aaf78f3-7a7f-4280-81dd-db4bb1e6df78", "comment": "Malware payload (DCRat)", "value": "495769f79b7cda163ed94f7b02392258", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421825, "uuid": "d1946092-d48e-4d94-b7aa-3fb5a3cbc8a9", "comment": "Malware payload (DCRat)", "value": "4c13d7949070e6361626b855d849afa3e4721b654a7906303bb5933645498c53", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421825, "uuid": "a4fbeae9-17d8-4132-be79-013a526c07a4", "comment": "Malware payload (DCRat)", "value": "bdf7c7ebf013c41fbf393614bf20223d30ca190d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421825, "uuid": "b3ac1ec5-c7cf-4979-b670-c40391a40ee9", "comment": "Malware payload (DCRat)", "value": "84168669532d18a0efaad72a730d5920c8172961d43257df81f5d40102114de94c1fb311d4c721c16d0dc3b73df51475", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421825, "uuid": "216353e1-3aab-4bd4-92d9-34719d698318", "value": "T1E8F5E1417E44CA11F0591A37C2FF55488BB0E84166AAE31B7DBA376F64123A33C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421825, "uuid": "900ff9f7-98fe-42a5-9387-3d537e5970ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421825, "uuid": "272b7abd-877d-468a-9fcb-b3fae4cfd720", "value": "49152:DMbFxuoCk6EFyfkc555BosuOcZQQZYo+UEVXB7MWr1C4wNccFoEPDFDcos+c:IBxjuF555jeQWh+nVR7Mi1CNxPDS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421825, "uuid": "b87a60a7-6ef3-4225-8ca5-d894a9dcdc1b", "value": 3371520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421825, "uuid": "90db9224-56a0-4b32-8cf4-931f0c2e100d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421825, "uuid": "a37ff5e6-3cc0-4c03-9791-2e8a0e06ea56", "value": "495769f79b7cda163ed94f7b02392258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adab385-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435200, "uuid": "86fc2426-eb34-4c73-9713-c2d27743f1a4", "comment": "Malware payload", "value": "740a7e12dd2d6b7489f8ee3b86431d1e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435200, "uuid": "cf930fa2-bfcc-4fa9-a9dc-4cd34ececb86", "comment": "Malware payload", "value": "4d3f49b3556878f374f55ea37bacf89022ba80d3245e9b428898983e06fd0285", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435200, "uuid": "58550423-f8b7-4063-b80c-87dbf608898c", "comment": "Malware payload", "value": "526df8305b416a579112369c0090e951519e8d01", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435200, "uuid": "581df90f-5b0f-4a3d-96c6-eed8994f4dec", "comment": "Malware payload", "value": "8da95478608bb89b8a9c09edae482963ecc2cc7bab683489a02b2967eeba2db63b483652cfc843c764d64fe228e2273b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435200, "uuid": "3127289c-bcf6-44d7-843e-7c24ef99bcbe", "value": "T1CA660174771CF40BE0738E321371814F75E485E55B62E312AB07B8586EBBD80A9EEE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435200, "uuid": "627ffc51-917a-4b42-b69a-62594c67ddd6", "value": "98304:8WzScOVXKYJl4ZCLeHErQfvPQnof6wzx7EX8uGlQvsBWRgsJatAxG3K/vtyg2k+f:8WEZykrQ3PaAxQXHGmvnXAGh/vtyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435200, "uuid": "ea8c1225-a8d8-45e9-8048-d03522514891", "value": 6749113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435200, "uuid": "5e3b8c34-a61a-41c1-8e2b-17d99c57cb50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435200, "uuid": "51b5f949-3268-4332-991d-ad91eda55054", "value": "\u0428\u0410\u0411\u041b\u041e\u041d (26.3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c4e333-9095-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701468048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701468048, "uuid": "224bbff8-bf28-4a98-9a05-176173be41f6", "comment": "Malware payload", "value": "be143cf872880e44907caf4cac3cc9d4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "PoetRAT", "colour": "#AEA5A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701468048, "uuid": "ac48c8dc-9af4-4899-9aab-03c9daec099a", "comment": "Malware payload", "value": "4ddae23da7181ed5e7d290080f2117e7e52e0003b12ef87c04bb5d95a212ba3d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "PoetRAT", "colour": "#AEA5A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701468048, "uuid": "83d74fb8-06b5-49a1-b8ce-7b2d04614dfd", "comment": "Malware payload", "value": "10fcc846ea09109fc6a6f277f4fcaa9ce409f94d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "PoetRAT", "colour": "#AEA5A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701468048, "uuid": "49c194de-7870-452c-81fc-cbfd597764cf", "comment": "Malware payload", "value": "aa3711846e1a81331c857050cc54cc88fca6f1aae3da853ded793bbe113306eb1049e1a40910e43457ea7fc6490bc0cb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "PoetRAT", "colour": "#AEA5A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701468048, "uuid": "238c0f5a-1468-4c43-bf86-4a3a4696cff4", "value": "T12C9423AF15188C20E49B3639D1365ED3F3184AC6063D9BB9C1C3E7768DF4A0AE9993C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701468048, "uuid": "fc374fad-8998-4c44-8076-de5aed9a87dc", "value": "6144:1CXxqx6HrqHiXObC6O6q8MFtW4F3q6mzLzMpgN5NvOMzv1wEmZQ:+AUrqHsOZhq8mtBF3dmFNXvhzN0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701468048, "uuid": "2342c84a-eb38-497e-876e-1df3c16f11b1", "value": 417981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701468048, "uuid": "f76ce9f8-0461-4a8f-acbf-6aedec05d8db", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701468048, "uuid": "2b5838d8-0858-40c1-aa7f-d141334c6cc7", "value": "Undangan dari KPU[616326].docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2b8c9e-9013-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1701412462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412462, "uuid": "9058cc13-b294-4a33-996f-c1771a5cce1b", "comment": "Malware payload (AveMariaRAT)", "value": "16909e93ed0d6eef47529009a87427e0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412462, "uuid": "2bc13284-1ecd-43d9-b4f3-543abb576e88", "comment": "Malware payload (AveMariaRAT)", "value": "4df8c432a1d5153c687b60c3031648c6ac198cf96b44cb15f1d28f758aa213e5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412462, "uuid": "b297b985-663c-4827-b74c-6fc59a2419e4", "comment": "Malware payload (AveMariaRAT)", "value": "06b11bffa4deb47b0e4d49d1f0344e5810f4bd15", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412462, "uuid": "2b15a7a0-d7c6-4393-bd58-8d9fd6e87e52", "comment": "Malware payload (AveMariaRAT)", "value": "2e0202367215c1265aec703a3637de7a5ded0c0bf0152fddbf40e31c1dad181cbc708e2ec8e356615b2cc597f73873e1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412462, "uuid": "a67f292a-ebe2-4544-8a50-edbc631a3e82", "value": "T182D4F141238D6FE6D92A57F728BD840C43FAED136410F19C8DC532DA6A31B91E963B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412462, "uuid": "59be0c8e-60c1-44d6-ac9a-c72004cee6c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412462, "uuid": "b66bb10c-30fe-434e-8940-73826921267c", "value": "12288:cCCUJJIHJ4qAaKBpXLIgaxJNOmaD/90VSyO:UUJUJ4qAaUpXTeJNOmICVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412462, "uuid": "da91ae15-889b-4317-98e5-08a13fac184e", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412462, "uuid": "39e32615-efda-4a9d-b585-fc3e2a45882b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412462, "uuid": "9d7a39f7-522b-4f01-b54c-ee36529feb1e", "value": "Rechnung002387723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988d1f72-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413292, "uuid": "3bf43d86-66f5-4dce-9c8b-9277888151a1", "comment": "Malware payload (GuLoader)", "value": "a07c7d3cf0559935a2f64a2037742a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413292, "uuid": "991eda85-95f2-468f-84d6-d068d0e9e50b", "comment": "Malware payload (GuLoader)", "value": "4e9678fb857d27009ba6cc82e9693667092a6adacfec5b2f4f3864059d3ae8d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413292, "uuid": "457ab458-c0c4-4267-94cc-cbd43c6c8750", "comment": "Malware payload (GuLoader)", "value": "ee9e6a6623d3dde71a5f7f88b52f18974e17b3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413292, "uuid": "7f8f2581-7187-4994-afdf-9624a15cd7dc", "comment": "Malware payload (GuLoader)", "value": "fb4f590246858b4492977ff1c268944ec3323985ce9abc4abd217004ddcba111d5fb27fb55bc3aaed29c8cb5e074cc42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413292, "uuid": "c3b54989-b345-461f-bd92-3fbb75667f94", "value": "T139E4CF9238DA766FDC2F4A74031FEAB22A755CE0B391486D4F80361D4C3658A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413292, "uuid": "00c24015-b846-4565-a6d7-728df9b4257b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413292, "uuid": "17975648-20d6-4f43-a7d5-e6bc73a243e1", "value": "12288:6cqnhe2ecMUxRs+mgdk1PcSj8dm17zOckylak7iI/dKX0HOK:6PhemPJO8CKdOT73dy0HOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413292, "uuid": "4ad16c13-448f-4e2b-9953-a958bdc79dd3", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413292, "uuid": "e2596c14-f0a1-472d-9522-ad158ce8c4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413292, "uuid": "b38b16bf-d61d-4554-bef3-ca4bc88dd64a", "value": "Plyshaar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c82813-9052-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701439648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439648, "uuid": "933b5e4f-3957-4d38-8758-664fb4c90b2d", "comment": "Malware payload", "value": "c1812bffbea4b1dec69815991dc9cb88", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439648, "uuid": "9084b5a6-6b00-4e14-8ab6-51d8a6300bfc", "comment": "Malware payload", "value": "500093fffc4d18f40cd47b34a01c65f65ee988e69cb61ee12faf5aaa55d96506", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439648, "uuid": "c22db689-0317-4879-8e9f-c16e3c063c83", "comment": "Malware payload", "value": "242e48c048c98caa40a26b5185cb5b4600d60e30", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439648, "uuid": "80f38690-3341-4523-8ef2-138a6832ea9f", "comment": "Malware payload", "value": "0f84fc5bf3f002cc76263c3ffc6e7a3d6527166a1d9bf0f84df33e3769c74d23b7b9435f6bb6caaf171d6266cb3dad47", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439648, "uuid": "e6b25296-9402-465b-9f57-57cc71c60bbd", "value": "T1E06523063B995353C4A5ADB180DF052443E0A7D76672C28E6F8D3A5CCB93BC3AE41BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439648, "uuid": "dc4ee15a-2d01-44e3-9366-56a99ae7a27a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439648, "uuid": "94ace837-1362-4b23-bc92-2c4d0b45c8d9", "value": "24576:D6tXTq4EtXAPA7WUhbwPsxFgenqfyemjg3Lb3aYo2ItvY1z:D6tXTq4EtXAI7WQBFgNx3brkY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439648, "uuid": "862c3e04-566d-4b7a-b963-d41145a7eff6", "value": 1537608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439648, "uuid": "a2091034-55a1-4f50-a835-219365c0a2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439648, "uuid": "72731d43-620e-48a8-b8a0-294d16641492", "value": ".Transferencia realizada desde Banco Santander 01-12-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37715b8d-9073-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701453502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453502, "uuid": "1aa77260-20a9-45d6-83da-53badb0674ff", "comment": "Malware payload (Smoke Loader)", "value": "59f534de566b597c05e4107fa88a885a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453502, "uuid": "17d25571-d00c-4efa-b0e4-2e40347be296", "comment": "Malware payload (Smoke Loader)", "value": "5002697db7303e3b0d00b43b0ef68d043bfefa7141205f44b5352e14e95f8773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453502, "uuid": "7eb2909e-96f4-4e64-bae9-d6a79d69092b", "comment": "Malware payload (Smoke Loader)", "value": "0aa0ddd70fe69b87dc93d8582673f98d9bbf77d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453502, "uuid": "0b29875f-374d-4b7d-a4cc-e1f52b536234", "comment": "Malware payload (Smoke Loader)", "value": "5d19d8be27d24e0bbe64dafdd9995096ddb30e5e4e1280063bf3397be03a577ca6013ea0c60054088d6eb91030df7026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453502, "uuid": "f4f9cb83-26af-4d12-a4b9-5177f65fb7cc", "value": "T1B9545B1262D06C61E5164E328E2AC6E86A1EFF518F3D7BDB13146B6F09731B2C672F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453502, "uuid": "94350288-808d-469a-875c-eaf5df6c6faa", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453502, "uuid": "4dbcee4a-2e21-476f-a630-4f4f2e4ef27e", "value": "6144:6l6ekUVg0UOfGCxnbXVCy6wKSWrsBJIp6:6bg0UOfpxbXVCuDvByI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701453502, "uuid": "ffd1c0b0-86e9-4cdf-85c4-415bac5ce055", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701453502, "uuid": "35d21d90-7e9b-4437-936e-41c1ad105dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453502, "uuid": "4b3f5159-9fcb-480e-b1f3-93181f533e3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66301daf-9027-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701420938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420938, "uuid": "30310490-cb96-4be5-bd60-2b66a85dbebc", "comment": "Malware payload (Stealc)", "value": "f104cda5b630712f2a089cc5721e9e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420938, "uuid": "0b1e110f-bf73-4c1c-b4a3-7bfaac278187", "comment": "Malware payload (Stealc)", "value": "5422d127b342135a6064e8f87b66d7586551d2208fd21cff5a0c73f6161bded7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420938, "uuid": "99f3f7b7-f32d-4796-a6f7-e7428fde8531", "comment": "Malware payload (Stealc)", "value": "e103bb6a5cf9b60ebec5b44e69d7c043d8f2bb82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701420938, "uuid": "bbd030ad-fb44-427b-9f57-5e39bd67fdc2", "comment": "Malware payload (Stealc)", "value": "2130a8980d63ca0a3be8debf8373a321460cbf9eb24cf3cc85704107af988ee000ca53b271e4a870cb01eb48e4f65fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420938, "uuid": "c68730f6-b178-44aa-9dc3-5ebf7acee0cd", "value": "T1DA34BE3236A0C072E16359394971CAA55A37FCA29B6585CB37D43F3E5E322D28BB4707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420938, "uuid": "487e29c8-6303-4beb-af9a-199bcd5d324e", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420938, "uuid": "50ad9061-6a68-449b-9c4a-0413bbb35881", "value": "3072:5/8oF2VTT+VjH/HBG/AgO/UOdZSDie7wTipr+b3n/KpEwywCl+:HKTejfHcIgO/UOnI4mprWn/dHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701420938, "uuid": "9e6bb4fc-00df-46e3-bb81-0d6d4812ea00", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701420938, "uuid": "1aa18483-df3f-49b6-a080-a5fede64521d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701420938, "uuid": "b67f3d88-af37-4d0e-8b7c-7fc0a91309a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c74746-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701413306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413306, "uuid": "51a5c66c-7dd2-4cb6-b2ed-1b1e5a71b335", "comment": "Malware payload (Formbook)", "value": "69b7807fadee8b246b1a4f1fd8f22ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413306, "uuid": "a12e4490-d187-40a1-bb21-9ab93587f86d", "comment": "Malware payload (Formbook)", "value": "5485b48416b0245aa21eae044bb2325a0e102681827134bfe8f4344edc0f5e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413306, "uuid": "29a35c16-0df6-4ed3-9d04-d35e8529f7c3", "comment": "Malware payload (Formbook)", "value": "b3377d785dc6c2c2c21232a5629c3dd7f1b52774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413306, "uuid": "7b3b79ee-2b53-4e41-8628-8163108dc437", "comment": "Malware payload (Formbook)", "value": "4135865b5b6b89542442126a375d8d6d778efb254f33968409086c1aebcbe97363cfe88a6246be17570b13a503cf3d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413306, "uuid": "b30e36bb-10ee-4653-aca1-73ad0dcdd30d", "value": "T1E674E008AEBEC193D4D31F76B4F51A9007B17BC2297ADA4919A87152F42138725C3FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413306, "uuid": "5abca316-7533-4c76-afcc-3b1984d0366e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413306, "uuid": "af0f53fa-20c5-4a31-81f9-d364ca973b42", "value": "6144:7qiXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXfXXXXXXXXLXXXXXXXXXXXXXX2MfTUve:OiXXXXXXXXXXXXXXXXXXXXXXXXXXXXXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413306, "uuid": "2b9c55a6-f574-4278-ad52-b774a9be4be9", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413306, "uuid": "e5e16343-66f4-42c7-9de2-89803534b83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413306, "uuid": "d431e7a0-4268-4d22-9819-fa0c3f18b38e", "value": "Payment Advice Ref-GLV407423235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b2260d-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454869, "uuid": "7e75fe16-8cff-4338-94a1-970505c5a9ed", "comment": "Malware payload", "value": "80c83d4f360407cb58ef57d86fc75f24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454869, "uuid": "f049d933-00cb-4404-996a-37358a35819f", "comment": "Malware payload", "value": "5490798acd3eb1a09e25be3bdb3302d91fd8b3946aaa28c1cfa5cf7e7de879c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454869, "uuid": "916db955-9b3b-4e5a-90c8-f577088b921f", "comment": "Malware payload", "value": "bb78e5ce74e09c09abbb263ba01c14b3868c44de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454869, "uuid": "9e2c4bff-3a00-47c2-92db-b483255c6a84", "comment": "Malware payload", "value": "bac94d9146ef41e648fb8babac101927bbcce1a1588aac7b6f902a33754edef11f0a3c46e71fd2bae97467c255bc5727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454869, "uuid": "2b8ac071-7f64-491d-bfa5-3df26f0c47d0", "value": "T10D458D65EA8240A8D24B60B126A71F392F75D6C32E35DBFB067CDF645E63E21ED23110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454869, "uuid": "8d6526be-ef4e-44eb-b831-73aad0e8b205", "value": "12288:yJ/o3k0aP1Ky2VthsN4M9NsVMyFcAqS8naersJOv4WZm:yJ/o3kvP112VthsaM4VVFcAqS8aenv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454869, "uuid": "3700656b-9b1c-4401-85f1-2dfa01e8e951", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454869, "uuid": "075dd39d-27fc-45e1-b1be-6821a7f8c15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454869, "uuid": "38b59156-2246-47a8-a4d2-eb47fec427d3", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.1119.28880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05351e98-9072-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701452988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452988, "uuid": "9e4daaf2-c386-4d6c-9aec-d31c9ae92f74", "comment": "Malware payload (LummaStealer)", "value": "3d8936f5a6d5848dbf9cf05788c804ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452988, "uuid": "d761c21f-45dd-485d-a1bd-4e6a758c5e77", "comment": "Malware payload (LummaStealer)", "value": "57761213dce66bcfb7b0453d9aeba25fb386974598ac92193f34ed29eba758b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452988, "uuid": "4334c541-b85f-4ac6-98f0-f6e83be74e38", "comment": "Malware payload (LummaStealer)", "value": "b82a50c3e2d8be5a164b643ce0fc12578611d3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452988, "uuid": "794cf4eb-e552-4cda-ab14-379f0e70f00c", "comment": "Malware payload (LummaStealer)", "value": "9a2933220bdcd8dd5a8d12ab07e38bf0a1fc60d6d26d4454e2ad30ecdff99990977e06ae3c3bf8eb04c3a7d36a0b687d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452988, "uuid": "9850ed02-a30e-44da-9bed-4dbf1d8740da", "value": "T146C48D0DD20A91B6DE4544F2DEB12C8854B889A7AF81ED7CFD4C121B2D1B5FCA3DA274", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452988, "uuid": "9742553d-9c99-4957-ba80-54ec64e4de75", "value": "dd57e6241193db02ac9b4aeea2df893d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452988, "uuid": "019b3ae8-33df-430d-8f4c-00d0c9d73e7f", "value": "12288:OBAHNam+fgfr/b/Diq9nMoHi6l17sIeK1:RHNajOqq9nfH9sIeK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701452988, "uuid": "c31fae3c-37eb-4e9a-a468-9f3343050b8c", "value": 575192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701452988, "uuid": "ef1a542b-40aa-457d-be24-c13feb7dc229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452988, "uuid": "f228fe8d-19a0-4c2c-8849-1af9578b8db8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa47dc28-9041-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701432219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432219, "uuid": "939017e7-3e35-4d11-9f26-2b5b91b386b8", "comment": "Malware payload (AgentTesla)", "value": "9909b7fa1c4775d623fba3eb6ed5c098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432219, "uuid": "bb7733ae-5506-494e-95e1-817830c444a7", "comment": "Malware payload (AgentTesla)", "value": "57bcf0394886e8bd03578d317aebab8af7195e007dd1636b266073b282b43848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432219, "uuid": "a1f7b57b-7354-4284-a7a8-f5d159c1029f", "comment": "Malware payload (AgentTesla)", "value": "a3e1e6920380078228c21c2d4f728ab30667a0ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432219, "uuid": "5f4c2d73-314c-429a-a352-5cad27ee663a", "comment": "Malware payload (AgentTesla)", "value": "5a12e278efc79eec628170d62454173ea426059ac12232ea3797a50be1d97d415a963dc69071b1c500116186d446f836", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432219, "uuid": "5e8eb68a-b5a6-4954-9e8f-d14b5fd013cc", "value": "T13CE4D010A1FD2F62D9BA63F1047856180BFABC99A839F36D4DC5B0DA2671F410A53F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432219, "uuid": "4bf71759-1904-4cc8-a13a-47a25d98f946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432219, "uuid": "06c52944-3004-4ab6-8525-793aa884f37a", "value": "12288:c+dI0024k/zu5uDYtmsd4pHZ4USxJN5OVHSqT6m:c+/024kmuDImsdu4UULQyqOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701432219, "uuid": "8a916059-bc21-49dc-aaea-5d48852465de", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701432219, "uuid": "0bee85e4-ae3c-4b20-a258-d3809f468755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432219, "uuid": "98fdb0aa-fc59-4b69-8897-ec2b7dd1c69f", "value": "Rechnung002387723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970b5a6b-9047-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701434764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434764, "uuid": "dc262d5d-84ef-4f29-921f-7192a926c7ab", "comment": "Malware payload", "value": "942ea4c617b238dca82d1ad2046ad169", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434764, "uuid": "97adb8c4-d7c0-41e2-af0e-1e2279aee7ed", "comment": "Malware payload", "value": "586020db0bcf7bc5ade93c0a3bddb7c0b4a425c78489e5b87c84f9cb18263534", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434764, "uuid": "3b930ee2-e4fc-4a69-a89e-159ee36d6077", "comment": "Malware payload", "value": "1c66891eef5a9e5b8bba37f109073fe670cc0382", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434764, "uuid": "0b01cf1d-30fe-4967-b0b3-516e0bcdd4cf", "comment": "Malware payload", "value": "83842ebca56a644d9525683a0e463021c9846855c6e43535fac9d47c52235e8f8fa471529d213b7705f0ca7462f871d7", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434764, "uuid": "cc958123-145b-469d-b981-8dfdbee5b99e", "value": "T11C95CF217686C437C97E05302A2ADBAB567DBD604B7204DBB3C83E6E2E705C15336E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434764, "uuid": "31da10b6-84e6-4e13-ba86-95801d2b3b65", "value": "49152:LVkldbW8zBQSc0ZnSK/uxtZCZKumZrL/01uG5I:wo0ZnPux4KP8AaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701434764, "uuid": "3e145ab1-4e7e-46a5-a775-7844d524d5f7", "value": 1982976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701434764, "uuid": "3ee572b9-8d89-4616-828a-bfd12d3b735f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434764, "uuid": "acff0f7b-598f-4103-9616-048c70c9a784", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c4f9e3-9086-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701461908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461908, "uuid": "05d3f686-91d2-4936-9ea0-07b03b00b5c7", "comment": "Malware payload", "value": "52f9999b069071d296d62a84b3b4a096", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461908, "uuid": "7a652db2-e9b5-4584-8e40-428774c7b756", "comment": "Malware payload", "value": "5868b70700c4b313b95d7309bc8b986b4aa36af7906c66c5da2d832827670077", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461908, "uuid": "29d6db9a-8b20-4724-a927-6cf548be803a", "comment": "Malware payload", "value": "bae4edbb69a87c57671ecb84f1cfb723749179db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701461908, "uuid": "ecd219f0-cb41-4f39-8c16-ab8ce3e87ac7", "comment": "Malware payload", "value": "caea5049a47a468c2f3aa975f08732d54beb4ca659385530431abd72184dbdf0b24ac549b7c90b2f3e9372df7f64e598", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461908, "uuid": "24985de0-ad48-4a17-8afb-37c83de8557a", "value": "T1B5521811EB9C9A23C5BD953E64763B0103B1D763BC12E70BAC8864247C1A7E46A113FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461908, "uuid": "0236571f-d216-4d53-b8f6-b631e853aef5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461908, "uuid": "fa685b01-bb9a-42a4-ae24-8a7f554e8596", "value": "192:WBi7BvwcBBt/7L8znJZ8CoQbZzNZzp6TkjTGzsJkssyggSw8oKEBV:zf7yrB5p6TkjZusi0/KmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701461908, "uuid": "350a0327-f2d0-46b5-83f6-f938ca2ca8bf", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701461908, "uuid": "38277672-8236-4146-bb97-b98c9a871c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701461908, "uuid": "a41c18c0-0cd4-4769-ba77-c9ab963e59b7", "value": "SecuriteInfo.com.Trojan-Dropper.MSIL.Agent.6560.18276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005b3c90-9029-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701421626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421626, "uuid": "57e2e051-fe0d-4b26-a0a2-4a246046b24c", "comment": "Malware payload (Tofsee)", "value": "9e93e282ed9483fa5278557953accc51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421626, "uuid": "efc1867c-6184-4190-9472-f7e58f5db56a", "comment": "Malware payload (Tofsee)", "value": "58892f621a5b05339536004b2102cac88ea63b2148b784ea7a4745c27633444b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421626, "uuid": "ab72a42d-649e-4a48-9f45-8d0711e2a03c", "comment": "Malware payload (Tofsee)", "value": "48f5f7ab95997f0482c1f5259e8e4ca7d96df2b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421626, "uuid": "673f305f-1734-4664-821c-8f5f32928c93", "comment": "Malware payload (Tofsee)", "value": "43a3b0be167bfa66fbfa7027ace410619ae0fd8c9cdf4f7de3a11e711d1c156cd6c4b7b25c32b4d1bbbb680413a8e77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421626, "uuid": "8bf2a40a-623c-4122-bb5f-0a28f5493ed5", "value": "T1C534BE2276F4C032E1635A354971CAA51A27FCA2AB6196CB37943B3E4E31AD1CB74707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421626, "uuid": "1140fef8-c670-4038-b324-f4e13a312ba4", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421626, "uuid": "886e87ed-575b-42ed-b5c9-8e44fa0050f6", "value": "3072:s/5SqeWVD3RRzOpABGPwgOnNnSU59mTYlCroDan0/3gmvfg3kwjwC/b:ABJ3XO6cYgOnNnP59mUBa0lfJe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421626, "uuid": "b0f47e36-e8d2-4f1a-8905-c1241da20298", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421626, "uuid": "6b08bff4-07ae-47ad-a129-da5316a4f828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421626, "uuid": "49ac19ee-68c7-4f71-ad22-deb69aed74a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf5a81b-907b-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701457244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701457244, "uuid": "88729fdb-cca9-4b3e-90dd-a87a964ae4d2", "comment": "Malware payload (DCRat)", "value": "2c68191a67907fdfc52f85c49c25522e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701457244, "uuid": "c18fe635-a5f8-4325-ad45-21f208ed0325", "comment": "Malware payload (DCRat)", "value": "5a88e1cf7081af67c11376e6d7ea126742031d9c56ae0338ab34cb610b6faa1c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701457244, "uuid": "09be8565-63aa-42ef-9f5a-23d14fd35919", "comment": "Malware payload (DCRat)", "value": "a556c55f8dc18066d241b220351c4473aedc8521", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701457244, "uuid": "ba5e094e-ebe3-45f6-b419-e3987c1c1c43", "comment": "Malware payload (DCRat)", "value": "b30638162aaf07e3b3e88b9a38d1aa79f00146fe02b5754ba740f2d9b8a32f3d3b8fb14fdd52f333ac325ea3d63f2be0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701457244, "uuid": "40a5228c-a465-4da6-adae-9d69b01b6909", "value": "T17406F14A95725E73C299BB36A4D7191E82B4C7267922FF0B396F10D96D063309F022F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701457244, "uuid": "8fcbb962-27e9-49e6-9b36-5aa4ffca681f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701457244, "uuid": "205592c8-6640-4783-aa96-c5d4c2a8215e", "value": "98304:05dU3/LM9sOETwMarvbAefnfi00ZIES0YYAO1G:05dU3/LMSTFIvb1Ys0YIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701457244, "uuid": "95007c06-b429-47ec-a5d0-233860b70c1f", "value": 3672576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701457244, "uuid": "b1e13299-14f9-45ad-92e6-aa5fc5d2e4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701457244, "uuid": "b44a6664-4f1e-4a8f-a43c-b6850fdee0d4", "value": "5A88E1CF7081AF67C11376E6D7EA126742031D9C56AE0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab216d7-9032-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701425509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425509, "uuid": "334af0c7-39c5-48fd-92ba-b4fdf9fe629b", "comment": "Malware payload", "value": "ab32f84729c647ec3dad850bdea6776e", "object_relation": "md5", "Tag": [ { "name": "CVE-2020-13756", "colour": "#A6D8AA", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425509, "uuid": "c6ce2d9a-b6e0-4982-a96f-2f9b7a989b4c", "comment": "Malware payload", "value": "5ac41a71643dd322c80b8f0c297ca916aee07345b9fc301caff5df7ea453cfa0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2020-13756", "colour": "#A6D8AA", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425509, "uuid": "fc0c4632-2391-4124-9d21-766fa500d6f6", "comment": "Malware payload", "value": "b7e8192c6c765cd19d69535283fc3f1572ddac3c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2020-13756", "colour": "#A6D8AA", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425509, "uuid": "6dcf0ee6-5af9-4e68-b126-dcf1d4db696b", "comment": "Malware payload", "value": "74604ab97a4e795117142756e01849bd8bc17353b681a6b045477a9a7431fe318e95e02acef7bd083568319f86c0840b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2020-13756", "colour": "#A6D8AA", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425509, "uuid": "ea78a258-e674-46c8-bb35-4a1fd6e1da83", "value": "T14273C80DC789C9070666B8F5B0229B4FF141D314E6424EA3FBA8D6A779CB87065B52FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425509, "uuid": "464c38b6-ba59-405c-a2ba-70c56d634250", "value": "1536:pT6Dl1b5VPeKXoJangd/1eI6eeFEeeeeeeqyKeBeQenw5Rl:pff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701425509, "uuid": "670c5415-2c31-47f3-91a4-20b35daa1d25", "value": 77433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701425509, "uuid": "f517bb15-2f1d-40cf-94b9-0595a33b18d0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425509, "uuid": "ba79e8ef-12f1-4569-9a4f-b82a7f8c9cdd", "value": "ab32f84729c647ec3dad850bdea6776e.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740c140e-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701422680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422680, "uuid": "8a818207-19f4-4382-bad2-62ab6387e03b", "comment": "Malware payload (zgRAT)", "value": "97aad1b740159056b4765d3cc1689d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422680, "uuid": "9d0d65f2-7637-4f95-ae34-08ffb7e71142", "comment": "Malware payload (zgRAT)", "value": "5b614a4b5b02994b6900991eed28ee0a76a753d9e134eab400cccfc9ecd37e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422680, "uuid": "63d51084-9f80-4b44-ab24-bec82aed650d", "comment": "Malware payload (zgRAT)", "value": "c1143579024c008809e0235959386e2b9441f773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422680, "uuid": "ba671b30-b4ca-4fb3-807a-4621d1aba421", "comment": "Malware payload (zgRAT)", "value": "76e955aff489bb8fcf2bc61e7ecaff31511697d3996aafd62598127fd460ed87d54cb60a9da0b29255c6be5a3ae97475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422680, "uuid": "126ae067-1c85-4775-ab5c-d22ce2b8c5cf", "value": "T14225E150A7CE0997F16E06FA9331172483B9A217B357F3476AF2D6E80D933854A853CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422680, "uuid": "2fda58d3-e4a9-4595-88a9-cf20b5ea2ab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422680, "uuid": "8cb0ece2-c89a-4778-8acd-798b54581010", "value": "24576:0zdTQ/xBJyNrtjK3d0DbxUIBlA9DERHyK8zubL:EmBPRoRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422680, "uuid": "0c0f41bb-ce64-48e0-91d6-f7c69ae2b12f", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422680, "uuid": "fa3772ea-dd13-4586-9e3a-3d99a5412946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422680, "uuid": "c8d95f33-303b-4241-bb16-33a4d3409871", "value": "SecuriteInfo.com.Win32.MalwareX-gen.1541.20531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919947f3-901f-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701417575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417575, "uuid": "f754b7f7-5dd8-478b-a596-c4f9a093d501", "comment": "Malware payload (AsyncRAT)", "value": "bde342385fe65a18d2add644092dda20", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417575, "uuid": "0a3b6138-f7f0-479b-a4a3-fd6d08bf42a7", "comment": "Malware payload (AsyncRAT)", "value": "5b68d29d1f99009dac38774dd8d9182fc40cc9163516bd3bf2c8024f5478aee2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417575, "uuid": "804c8159-5c37-4ff9-8807-f47ef8a4aaf6", "comment": "Malware payload (AsyncRAT)", "value": "7e73fea1bce09055cb25e38c4f6089549f733097", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417575, "uuid": "c0708c56-0bcf-47b0-aa82-868bd628b75f", "comment": "Malware payload (AsyncRAT)", "value": "af8d967c85d17e9b9bb31207f7f80392ca5fd27744d4fe2ca06179ebaabf32b83fff7ab57b9b4340bfee8a1f41433caf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417575, "uuid": "d9da8518-fe7e-4a31-a789-d86bfae6e342", "value": "T103134F02B3EE1A48F1F36B9C597A05650E3BBE656939D25C00BC654D0FF3E418DA1BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417575, "uuid": "0223c572-dfe5-43dd-8971-ff18f4c4a2c6", "value": "768:JgkWb5U/RkVYCWb5U/GkVY4VP2Wb5U/RkVO:JgkWb5U/RkVYCWb5U/GkVY4VP2Wb5U/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701417575, "uuid": "27fc40a5-4319-40a6-88d2-118744994b6c", "value": 43860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701417575, "uuid": "52ef3344-43b9-4cef-b308-f04d521911dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417575, "uuid": "4b519a23-f397-4c96-b05e-da3a6e190a17", "value": "REMITIRA_A_TRAVES_DEL_SERVICIO_POSTAL_AUTORIZADO_copia_de_la_demanda_con_sus_respectivos_Anexo_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0677d6f8-9014-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701412617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412617, "uuid": "29988de4-0f0f-4a7b-9b5d-23ed9d1bb6b0", "comment": "Malware payload", "value": "3a7f658be61055aaec95b72716ec407f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412617, "uuid": "fbe9145d-ca36-4ce8-9457-2cac4039c52c", "comment": "Malware payload", "value": "5b7009299c0649556347e2c2724d6278bce47daf526fa8ca71d5b56860cdf732", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412617, "uuid": "f13fb1bc-635b-4928-92a3-ddea2c16fa1b", "comment": "Malware payload", "value": "416e896e23ae7bb41f9c104f15628a0f866163d9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412617, "uuid": "70ee3524-1de3-44c0-b3a0-444ef488c9b6", "comment": "Malware payload", "value": "d7c542c01ef66140e071cf7adad7d4554c14b6b680ebc26760805bb485ae2a07fd3038f46111257ecbd5d4508207f56f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412617, "uuid": "a3077f0d-76f7-41b6-9735-1c2b696c8cef", "value": "T10835DF51AAB1EFE5CB2083BB9200BE331FBDDEA21466F5081D5DB1C91D76F308A41A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412617, "uuid": "cb5c3cf5-2e42-4841-87b0-cf901763f3d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412617, "uuid": "3e0b5046-736b-478d-99fb-c51fe7e0c94d", "value": "12288:ifLYYZXTym7BmFHWA8EbjliW1CV+mYYAnqDIyyPIZylf2P72pwfw9H59FcXFmIeo:GXTKFHz4bwqxyPIG2PSwUHTG4Ijhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412617, "uuid": "69ab8aac-dee9-4abf-8b3a-e86db858db34", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412617, "uuid": "64d3b6ff-faee-4a13-aa53-f7e748c247f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412617, "uuid": "1d49893b-6579-4a51-8da8-1d3875ffc768", "value": "DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04274e1-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412043, "uuid": "cec3eea3-9265-434b-9090-88a6f0004040", "comment": "Malware payload (AgentTesla)", "value": "7f95cf594a94913c3a7411bfb5b31ccc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412043, "uuid": "0848ef58-b85c-4d99-9fa5-aed32aa572e0", "comment": "Malware payload (AgentTesla)", "value": "5d8c0938cae4b390ad96caae4ebbd81e488dff7210646eb5917455e3d098aa57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412043, "uuid": "39bc97a9-f76f-435f-b299-dbe7a6d48704", "comment": "Malware payload (AgentTesla)", "value": "b2a04b2f7a26f83356ea8c2184c18303d85ae901", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412043, "uuid": "49d5527d-cb88-44e0-a78d-7cf2acf2ee80", "comment": "Malware payload (AgentTesla)", "value": "0602a015d8487211c5d635ab48cce4ff1a20133d243d46ad4783e6bf6c00657b60a45180341c96147d910ee46fab06be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412043, "uuid": "b0c3106f-bdaa-486c-b11f-c4af6ee35d82", "value": "T13BE4126123198372C67E4BFB6489540987F2A81BA460F31C9DD300DD3A717A1D9E2FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412043, "uuid": "d292fae5-9150-4a0a-8359-1df37cc0dce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412043, "uuid": "358b3118-53b0-4ee6-8ba5-583f6c3e8438", "value": "12288:nCMYJnIDWmJhA3SGCioHoEYX+yBGxsVzevlz9M7d3g3Dixxt+ByY9Kq3e:HYJJihYfCioHrY+ySs03CxQIYIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412043, "uuid": "5d43466b-66b7-444a-a464-e1450df12f38", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412043, "uuid": "836544a1-06e7-4795-83f5-cb8063f1ce37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412043, "uuid": "07a54b68-7af8-4b7b-b6c1-b0af1d25c4f4", "value": "SecuriteInfo.com.Win32.PWSX-gen.31416.14430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51862604-903c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701429923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429923, "uuid": "fccde26b-3fbf-4016-98c4-163f5d6878d8", "comment": "Malware payload (AgentTesla)", "value": "da1d7932229b720f188bb1586de920db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429923, "uuid": "b5fa31a1-e568-47fc-9172-389479550184", "comment": "Malware payload (AgentTesla)", "value": "5ed580a1aa1981a142791f7f00f62dcb95643e30188ca4852391c34ce658060d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429923, "uuid": "6781e212-da3b-4b1d-b8e3-86a5c7874a1c", "comment": "Malware payload (AgentTesla)", "value": "82028dd1c32fafee8ea4351a108b2d1f29cedd33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429923, "uuid": "b7c4f42e-79a6-4e09-8057-54ff82a40569", "comment": "Malware payload (AgentTesla)", "value": "95491d460814c1ae04f2490ad5c56eeefe38a70875ebba91463dd471b628987a9079fc85884a149c6bd0882ed3023a71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429923, "uuid": "3c4e2bc1-4c4c-4f25-9c14-45fc5feb0eef", "value": "T152F4F124A1F95F52CAFEA3F1104556140BF6749AB97DF31D4DCAA4DA22B2F004A82F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429923, "uuid": "4d668d60-ab33-4009-b017-50680b47b6f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429923, "uuid": "16f31036-d56f-4bbc-a43e-34a1d146b2e9", "value": "12288:P9dILHw5do+xUI3LcZ/lHDAuNp9ZzNzuj+/k0SCbNOX8hoSOATdFsv:P9ycdo+b3LcRlHDAcpLzN5/k0SChOXi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701429923, "uuid": "999b47d4-b57d-495a-8324-46cdb3059566", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701429923, "uuid": "ba1b8cf1-8a3d-41ac-8240-f4a36b9766b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429923, "uuid": "46840164-927c-4b9f-be60-005c22c74166", "value": "SecuriteInfo.com.Win32.PWSX-gen.32559.23239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb723c7-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701413889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413889, "uuid": "4ca91b4a-178b-4231-a99f-a88e109dedc7", "comment": "Malware payload (Smoke Loader)", "value": "6993fa07ab7881fbc915d91dbc77c51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413889, "uuid": "765e3154-7f26-4d5f-90ce-8968020681c3", "comment": "Malware payload (Smoke Loader)", "value": "5f9234210d08bd7c15c45d258c8db0e3d8026654ab69ade712cd6f1773d22a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413889, "uuid": "1fd9ad96-d9e2-4fa0-8762-e881061b325b", "comment": "Malware payload (Smoke Loader)", "value": "5bdac5670d4a9fbb9c4688a1e7483b391f8fb8e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413889, "uuid": "fa1f9443-3b47-4103-8669-aff7ce45d696", "comment": "Malware payload (Smoke Loader)", "value": "744d2a4a7c629e96207b09e584d2ab115f9d5a5cc7aa3671e260e3d81d90a54ea7bd13357a888e593f7c46c4ed9d4dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413889, "uuid": "67a02dc0-6edd-47a1-9c49-e18040162c5e", "value": "T10D64E65382F1BD44E9268B76DF1FE6ECB75DF6508E8A776922189E1F40B01B2C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413889, "uuid": "34511249-14ab-4bd9-b0e8-165283a03325", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413889, "uuid": "9c38a01e-efa4-4a8b-b35f-51d36083cce4", "value": "3072:rJPIipPaZJWVVHHHHqlnYFBB7rTuAizaT85zntjUX35U:FfpiHSHHHHiYFBB7/uA+aTaKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413889, "uuid": "3e125147-d971-48a0-806b-cca396291972", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413889, "uuid": "e2b23afd-c6b4-4b11-bce4-1d026ce7562c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413889, "uuid": "030d0346-ab32-4b79-8d59-b7c955ddc929", "value": "6993fa07ab7881fbc915d91dbc77c51f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fa1eb2-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413742, "uuid": "ae1283a1-ab61-4273-8d1a-495f55da5545", "comment": "Malware payload (AgentTesla)", "value": "7f4f6e3789449c78b61f26d679cf5a2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413742, "uuid": "df76829c-f7fc-4361-b792-1149b8af4cc7", "comment": "Malware payload (AgentTesla)", "value": "5ff36a084b23be3de1baeb6953f2d0488d8f1ea257d1b83d64ad8fb64bc8dc39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413742, "uuid": "c319efff-3879-4ebc-abd1-04e63a7925ee", "comment": "Malware payload (AgentTesla)", "value": "377ca37dcf869dbc2c6207a4dd383f85b9f6b65d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413742, "uuid": "75b53bd0-4414-4d6b-b081-7dbc1d242b76", "comment": "Malware payload (AgentTesla)", "value": "0bf464a6ef85a28809c1d173dc0ebdd45f18b6abeae16122fdc31eb49d5ab9669ac4b1da8cca33856e28a4301410c9c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413742, "uuid": "aecaf39b-1189-473c-8167-1e97a8bd7c5c", "value": "T113E412852398C762E53E9BFB69E0940093B3F827A420E20C4DE644DE6FB1746D592FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413742, "uuid": "ff8ce7f1-3828-4c61-969d-66a1272d7385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413742, "uuid": "5295adde-199d-419d-8e9e-92d8ae7d7da2", "value": "12288:GCB0JiIeS0K36xgYG86Ox2nzNwqIH2kGX3DwxV7ccqidnuB/LhYcvwfqIrs9:l0Jis36aYv6Ox2xkGaxqFmcxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413742, "uuid": "f42c6cbd-3e7f-4681-abac-102fa3ad2c82", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413742, "uuid": "6c319432-7ffa-47b1-8f74-0d6085315270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413742, "uuid": "eebb75ca-6da1-4b55-9cfe-bb9090ef3686", "value": "SOA OCT-NOV 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898b9ea8-905f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701445049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445049, "uuid": "a4bfb4e0-a04f-48eb-b270-7cd1708e25d0", "comment": "Malware payload", "value": "5a5b47e8be61b21d221325e7d52ceaa0", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445049, "uuid": "5d3d8090-5cd0-4dc7-b73f-66b698d98b59", "comment": "Malware payload", "value": "6190cdec260bcd8341901743b2ccf384b4723e08498610fec800c4ab25816337", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445049, "uuid": "b766424b-8a9c-4f8e-a8ce-33efcf43e29f", "comment": "Malware payload", "value": "30c2a30a9d642da80d65279d4bbe458b8aac6c42", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445049, "uuid": "10a3369d-c840-4e84-b98c-d1b3f1791607", "comment": "Malware payload", "value": "707c7a07567ba2bd6d1827ea7cea6d03ed1c06b11607c6f0cb1c16e1e8273e85d4954d5cfa16c3c4d4e0f7005c5c4792", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445049, "uuid": "90bf209a-fc1c-406c-932b-cdad8823cb35", "value": "T1E2B423C7709D53BDCEDF7EB2D1873BB1ED2B42A756232B0D0F9A20E5596B28B1116006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445049, "uuid": "cee448de-bcf3-4cc7-8348-e13950479f9d", "value": "e27e863878b286ab3210255a9ebcda55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445049, "uuid": "0da873f4-cc8f-470a-a157-f4ce2f2fb593", "value": "12288:wjQnmCnJfKxhAfaeWvbVPtEeUA6AIYsOTzX805:wUnBnYxef7WvplEI6800", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701445049, "uuid": "723a5fd3-6b03-4147-878d-88277bab33bc", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701445049, "uuid": "7c0e083d-b00b-49af-82a3-b4d66f992eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445049, "uuid": "c13b34cd-3977-4bd0-94a5-885962689c26", "value": "cbc9f1d5-ac5b-4bc6-9c44-04a49663d469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a427d019-9013-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412452, "uuid": "bb066c93-12d6-4d01-9d64-f042e63e720a", "comment": "Malware payload (AgentTesla)", "value": "b93651f3c0395fde4b9cdf16d78808a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412452, "uuid": "e300269f-0d98-4cf5-a6a5-354666d8f2bf", "comment": "Malware payload (AgentTesla)", "value": "6228505d8b5589a8b844eb392624cca72715b7f57b997a641cdc3614d39260fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412452, "uuid": "89ea0b2c-fc2d-46a1-9ccc-0667d4d1cd65", "comment": "Malware payload (AgentTesla)", "value": "f73862ace26b8d28bdf1e994ba8a55b1dda06334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412452, "uuid": "6628f4b9-73ad-4d39-ba4f-77434b0d9de7", "comment": "Malware payload (AgentTesla)", "value": "152ef47dc1c57f8c777a1de64504d492f2621dab3a74264452bf1a77b184168cd200d2748eeff5eb4716a2cc474ad21c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412452, "uuid": "9bc04cb5-161f-439a-aaef-0823a7428aef", "value": "T194F4F11853FC4666FDFB6FBCA4B425101BB6BD225876E35C5A80A0EE4672B108E70737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412452, "uuid": "efc74eb8-5e67-4be6-b229-2c6beca92755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412452, "uuid": "157abafd-f995-42e5-ba2c-eafc836d624d", "value": "12288:drbwLijB6+6ODydZZ8ZEoIQJcf95AmBHseP2i9SQtZILwobADA:dnQ+6VLobc9umtseP2i9SQtZI31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412452, "uuid": "62d5b72c-acfe-4c26-ab09-36f91fc52219", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412452, "uuid": "27f58cce-7b5c-43b2-bebe-fab1aeac20fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412452, "uuid": "46670a5f-9901-4a53-ba09-c3903e38ca72", "value": "Interbank Transfer____________________xlam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12746711-9017-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701413926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413926, "uuid": "d5619357-6b92-4292-942d-82e3889df72d", "comment": "Malware payload (Smoke Loader)", "value": "df050f3c62e0cd51c99bd795188d0797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413926, "uuid": "b699dd2a-efcf-4419-9a27-0af23c96acee", "comment": "Malware payload (Smoke Loader)", "value": "6368bd094f648a12bcdd609edb833cb5ca3aa7a70efc0cf7e0dcbc71e80ed51b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413926, "uuid": "89dae0c0-c78a-44bd-8fa5-29a6014f945c", "comment": "Malware payload (Smoke Loader)", "value": "01fbc73b3884767e4890384c1fcd17669ad22a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413926, "uuid": "70382a2a-5fa5-486a-aaba-d02692ff3f31", "comment": "Malware payload (Smoke Loader)", "value": "f10174330376442ef683bc428af7a08cf10e5c84ca0ac2e8b43d45ebe336a9429854e27b7c59c08fd7b4c54f13aadfa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413926, "uuid": "01a18a6e-46bf-4dcd-8049-d73252460ba5", "value": "T12264D54392E17D86E9278B729F2FC6EC771EF6508E497B2922289E5F04F01B6C163750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413926, "uuid": "3a0bf11a-8b42-4cf8-aba2-fba3824bb68c", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413926, "uuid": "d04b2cc7-7215-4ad6-b026-e13b55396e72", "value": "3072:075W4Xch4X5FGdZnVfu9R6xR9lkay64UxIzq5eEVzMu63jXdo:wR4EYZnxu9kx1kp6dI1EujX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413926, "uuid": "686192fc-2bb1-4109-84ba-804a67fb58b0", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413926, "uuid": "f4c78bed-174c-4580-8373-68c9c99e875d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413926, "uuid": "7204783b-b94c-43d7-bd2f-7d843a53b93b", "value": "df050f3c62e0cd51c99bd795188d0797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f87bc5-902a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422463, "uuid": "27c5e49a-9d7c-498b-9e90-6ad51bc71731", "comment": "Malware payload (AgentTesla)", "value": "911ee8d3ae10e1a0c9d613ff404bfd47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422463, "uuid": "8a0faad4-85af-46eb-bd96-c8bde04f88f0", "comment": "Malware payload (AgentTesla)", "value": "644246bf014c8fea9b5a32d11eda851b6e286bb7495ee2b08cfe83be83542ed3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422463, "uuid": "e9e10d25-3687-48f5-adbf-4adf2c7423af", "comment": "Malware payload (AgentTesla)", "value": "b6867c4186d36cedc563f218841eb32b7956cee6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422463, "uuid": "07a310f9-b9d4-4df1-a475-78986e71f85a", "comment": "Malware payload (AgentTesla)", "value": "8cec75ca98bdf6ad8956fad5b286c40df364d2488997483c3b8864f2d3d40b625925dc3863be964fb619c741f2cf545f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422463, "uuid": "57d5c734-3c09-4ec3-b0d1-ae3dfb652493", "value": "T1E1745BA137D889D7F19E02B490119A0647B7D2B7E897F746786C66F88F8B3C089791C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422463, "uuid": "2e9a4b17-8859-4032-bb57-f4fe78fad036", "value": "3072:WQ53wnXOm8tSA4M/msYWkVHF6++4mNMa9W6dfukJL4G5e911rIV3tQZ+vXoxltnV:WQ53COs5W3cG5eRUVRvyepzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422463, "uuid": "cd949d75-8c94-4c92-9e74-4e15f3afef44", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422463, "uuid": "d52dc5ea-08a9-41e5-b17e-7360784ba87a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422463, "uuid": "395ecf17-a5c9-43fc-b5e3-48ca91f24b56", "value": "Scan_20231201_085902_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5e34a3-9024-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701419717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419717, "uuid": "88ed8948-84d4-400e-86fe-6e8713e6b8af", "comment": "Malware payload (RedLineStealer)", "value": "f52aa52b309caec3fcece580e71e5e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419717, "uuid": "ff0980d6-8e4a-4ba6-8d26-350cb1fd5eed", "comment": "Malware payload (RedLineStealer)", "value": "64dd2b0b471dcec3c1868a9d6a0d27eee4f0257d32654b32223033390e17f645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419717, "uuid": "1757469e-1278-4a79-9c30-a51440f2d07d", "comment": "Malware payload (RedLineStealer)", "value": "61a4fb82e65cb86919c9e510f79b155371d6dbf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419717, "uuid": "88800ef3-cde6-4857-88e3-fef523865a2b", "comment": "Malware payload (RedLineStealer)", "value": "107c52afd0276296b391849293ccfa1c5a30248feb058aae42c45d840c9c667b7aa8244f764a25d17473d929b0c0b5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419717, "uuid": "4d49a4da-bab1-4f5f-95aa-fbdcf8817779", "value": "T1EE34BF217294C032E26759350971CAB94B37BCE29B618ADF27943F3E5E316D28BB5703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419717, "uuid": "8796f4ea-c315-4a00-8c39-b71da95fd508", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419717, "uuid": "8fe91492-1c69-48c7-bb22-fd27c2eb213b", "value": "6144:9saTqrVU2gOtMzhLeqpOX/7ZTTAHfZln:9sM2gOtMV3OX5T2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701419717, "uuid": "db5d0a57-86ad-42ec-a1b0-c392de104332", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701419717, "uuid": "b664f9cd-38c2-4fcd-b749-a98567dfa035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419717, "uuid": "f1204df9-2993-46d1-b08b-6e7506586b57", "value": "f52aa52b309caec3fcece580e71e5e61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eba15ab-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1701413114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413114, "uuid": "aab4db02-baed-45ed-969b-927430f6241a", "comment": "Malware payload (SnakeKeylogger)", "value": "1084ff6f3f1d09b33f75632bdf343e41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413114, "uuid": "38ed5f4f-8f3c-425e-af26-ddaf56714096", "comment": "Malware payload (SnakeKeylogger)", "value": "6538b6fc2c7e69090d82f6bf8fa1da3cf1cb764e39076ec34b034e2898c6ec25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413114, "uuid": "98d95ed8-7e8e-4737-b4ff-68780160e299", "comment": "Malware payload (SnakeKeylogger)", "value": "f8961ff9a2d3fbbabcaa69d3c381593e53706161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413114, "uuid": "b668b1ce-85a0-494e-a067-4f930ce79000", "comment": "Malware payload (SnakeKeylogger)", "value": "b2568e6e3a6f45b28bb1b480fce26213e39c3d589b40e0d41e9e8b82232ce79548d42008277ace26c2929b70e48e2233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413114, "uuid": "18923246-a9ff-4c4b-ac20-1c8b4d28f346", "value": "T120C40209B5BC6F22E8768BF99975614087B5A43F3131F7AA4CD230E90A71F144B92F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413114, "uuid": "f2ca794d-8c9e-44e3-aec7-9d1f6218c784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413114, "uuid": "3400aa06-bd0c-4bf0-be8d-c57eabc88780", "value": "12288:9HcDKsWptwVk5TjdU8eZ2elb28NZwfF+R8irNszueopoxb3d:qDKsWptwVkxJU5bBb8irNYeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413114, "uuid": "bcabc4a6-33ec-4022-82bb-f857194a2e5f", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413114, "uuid": "7a4d0ed6-223f-4486-a23c-2dd9ad0db872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413114, "uuid": "7471172c-8822-4a46-8f71-c8479435dca0", "value": "hesaphareketi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab909f-902a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701422429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422429, "uuid": "0ca18cc2-a28e-488f-9e93-9b8e6f91fb00", "comment": "Malware payload", "value": "3d2228df8f11577d4c6b1e780f91e989", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422429, "uuid": "dc05af0b-aaec-46ce-9a7e-05b67f9a1c48", "comment": "Malware payload", "value": "66067e9dc0d21c4159b20ac5115c8f039c109de68105e189f74e742c629672b6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422429, "uuid": "642c9c35-da8f-4c8e-960a-0a43277edb72", "comment": "Malware payload", "value": "6d25e5cf04e72cbc85bf6bb101282c25ce97c93d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422429, "uuid": "9e954f2d-ff7b-4a21-b816-48e00af4f447", "comment": "Malware payload", "value": "a8fa61892697773364c2b160e75c62edc0363632343a3448206fb486c00e9476a59def0178049b568802fac1d95f5e81", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422429, "uuid": "f37615a6-352f-4994-b34b-136d69416239", "value": "T10504786DD34B42698F625337AB1B1E4542BCBA7EF34152B1346C433933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422429, "uuid": "725fdc45-3f9e-4369-badf-a1d37cfc9e3b", "value": "768:/wAbZSibMX9gRWjtwAbZSibMX9gRWjSZST5spmmCou+a6CcZEPpvO:/wAlRkwAlR7Z5pm1MCcexm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422429, "uuid": "e9bbedef-bad5-4453-be67-1d7250359309", "value": 174687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422429, "uuid": "b9637f8f-4298-404c-9bfa-48dd9636a976", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422429, "uuid": "b9e569d3-a704-4d74-8bfa-a1ee5779cdc2", "value": "TEKL\u0130F \u0130STEME FORMU.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0eff0d-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1701412145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412145, "uuid": "292d9f7b-b65d-44a0-aa27-88d73a7bd5a4", "comment": "Malware payload (Loki)", "value": "b78736e82d053e9903d37db5bc7fb4fe", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412145, "uuid": "cd6bc03c-9e1b-4088-b7b6-b31e2e637c13", "comment": "Malware payload (Loki)", "value": "67af5616f1b4d62aa6e351560024b5691291661bf0c8133709403e6932c26fae", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412145, "uuid": "173ee463-eada-44a7-94fd-773e30407e22", "comment": "Malware payload (Loki)", "value": "3ef816cde86617bcadd089b050b49d63981e5907", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412145, "uuid": "97dd7694-59f3-4a24-9f1b-b95ddb5a65b3", "comment": "Malware payload (Loki)", "value": "04f534f8e7c804f33db81691d7cd8b92e5cb858a67a4729206aada94705c96b0d43c826923a7e857687ec828484f3b8f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412145, "uuid": "cf38576f-119f-4302-8372-df45b5b11b03", "value": "T19D55E0039804DB83D50D87F9BE434AE81F1A6F19E98569EF10663FCF3E31A624D9A11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412145, "uuid": "0cdb2e84-d15d-436f-804c-4a2311fe5d0c", "value": "24576:Aw6/UZyuCfg8WZw6/zZyDCfg8W6tXQtHUzscoQ4xvTcqJvv4iYuwxf:b6/GT/S6/VC/apQqsrQeIYvv4iVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412145, "uuid": "70b1ea0d-e5ef-46a6-819d-aafa9ac83585", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412145, "uuid": "5ab6bf72-2fc0-4688-a122-b879bbe24ce0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412145, "uuid": "270701af-7a5e-4325-9c60-45f00df8f587", "value": "SWIFT COPY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7faf83-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422529, "uuid": "90584ffd-7b74-46cd-ac2d-4e53ec01edee", "comment": "Malware payload (AgentTesla)", "value": "f9b1a13cd14eaba6c7e18dd17a2d274c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422529, "uuid": "336e90c9-29b9-485e-bc7d-5527b370d646", "comment": "Malware payload (AgentTesla)", "value": "6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422529, "uuid": "cc18e02e-aa29-43d9-8a94-73122308b097", "comment": "Malware payload (AgentTesla)", "value": "bcecb8013d3fdc4715789eb20e91f2e7fa22fa54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422529, "uuid": "b60ce267-e4fe-49e0-ab64-ba07a8984862", "comment": "Malware payload (AgentTesla)", "value": "3af885b31360ca9bb92e44cbc257d3b8e0c1baf72f02b8589e50cd732fe0f9bea73f23e70f5cf4c8f391645ed15b1f6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422529, "uuid": "e7c351b8-4b1e-4bfc-850c-3790c292892b", "value": "T1E745A403B6468DBDD3C7A776C5EB0C305B7CE9816623D70F398A635A292BB779844603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422529, "uuid": "5fef9010-cd51-4cff-abe6-94ab6e3af078", "value": "24576:T1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:8KfRdtsS0e4GIV3GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422529, "uuid": "fc4ca02d-6ac0-49b2-a7cd-2e46b8211721", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422529, "uuid": "6b8f0469-7559-408d-94f4-2f00ffb0df4d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422529, "uuid": "3630b87e-4dc5-425f-8436-392c7982c0df", "value": "ORDER FUZETEC PO2311-000031.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecda5e8-9050-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701438535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438535, "uuid": "05b8af03-cdd9-43d9-8e1d-18a81c7b46bb", "comment": "Malware payload (RiseProStealer)", "value": "63de00cc272f7f0edb1669c406f97d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438535, "uuid": "39e1f02b-3fc7-4570-8964-17bc5f91076a", "comment": "Malware payload (RiseProStealer)", "value": "69cebec49aad7594157deb014e52b24580e3a6e05476aac000fd0cf7b1c3bd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438535, "uuid": "b14db381-eee9-4a76-a23f-b47164c5cbd1", "comment": "Malware payload (RiseProStealer)", "value": "ca46c7257e26654586d6348f7aaf618f208693bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438535, "uuid": "862da49e-1a5c-44bf-b970-b31ea79807f9", "comment": "Malware payload (RiseProStealer)", "value": "71a37f806ca7194d45384158e7822c7785a73705458d7fe778fee7336561146c6d11cc7809cfa24011bca498ff70f3da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438535, "uuid": "e1e273f6-b28d-451a-bd6c-257db1a63b2b", "value": "T1FD563377A3160045E0ED883BC6273DE831F262359787ECB996A65DC86AD24E1F703D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438535, "uuid": "1da5197a-a3b4-4a1c-84fd-229c9b3c0172", "value": "4badf5cc096c479bb9d07f7fe1f1b22c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438535, "uuid": "06d614ca-fe8a-44c3-a7d5-0edfc14b7ca5", "value": "98304:jvV1BrPfhSqGzb7Jd8TGEjC6SZgeWxhLIzMwoUXYhLNfAMfv2goJMAWB72ozS2e:jHJPgqobVd8TQZaxRIHZCZoJMAWBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701438535, "uuid": "30e78db8-09bb-42d3-8d1f-e73aff7c5496", "value": 6467072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701438535, "uuid": "0d4e8d57-7fee-4421-b53f-1d09a1a31732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438535, "uuid": "3a20e514-3dde-4852-9c49-b23c78bdb2cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4df329-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454849, "uuid": "f5da7106-1b24-47e5-b99f-6b57a8f1d52d", "comment": "Malware payload", "value": "1e0f83264ad8f4029cdde7662459d7a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454849, "uuid": "fe6811f4-1022-445f-9b30-09b5b0d79276", "comment": "Malware payload", "value": "6a50640aa72459f05a74eafcc0e3a317eb5f20034dd9e3949b603903700a924a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454849, "uuid": "19cbb5fa-1e65-468e-9fb0-9104ea4e7a99", "comment": "Malware payload", "value": "fbe0e56f01e6de8f4d71a3a2ac00c81c6befa6a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454849, "uuid": "58bdfb5f-b7af-4319-8874-bdd5523c25c1", "comment": "Malware payload", "value": "fb5638027417fc097f4052c0276a05738255b8616424a68800317ce3b41001b5fb337fa82ba35290b2936ce425e91f4f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454849, "uuid": "deced9fa-a6dd-43b2-bb26-b8c6b7659208", "value": "T199A4E31B3AF1E8ABD14C0B330D5A83F88AB6BCA14C52850FF759BB6E1D361515D32672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454849, "uuid": "f8185b7f-3585-4645-b536-cb938675f237", "value": "8f5cdf990b813b979d585c1f03df25a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454849, "uuid": "9422023e-c572-4419-af32-5a760e0f7d23", "value": "3072:ZyS3GLqG5CntWLzgt6iCaU57R7sf3WIx9Fz20pk7u7UUkYPkPLAoJ:Z5325CnteJpsf3t9CAk7u7UUWPLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454849, "uuid": "06d48742-ba37-4040-8671-ca3481eccbdb", "value": 475039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454849, "uuid": "f32cdfd5-7c4b-46b3-b2c6-41b232d353e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454849, "uuid": "4ce6ff8a-c2c3-4c32-8731-adf6147f783f", "value": "SecuriteInfo.com.Win32.Trojan-Stealer.BlackMoon.D.15889.2304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5006830f-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454831, "uuid": "447eed7b-0cc3-4e57-825d-a126ecb16b9a", "comment": "Malware payload", "value": "6fd2713db5c4df44a60fdd2f6409aa12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454831, "uuid": "f1fb8849-50b8-4e2e-b1b4-5627f28bac42", "comment": "Malware payload", "value": "6b1c6935ffa41fc75a47de1f36fecb45df1196cfca0eff2a76c5ce8695e83afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454831, "uuid": "d047f418-f4ca-4e1d-9c37-221b68bbfc96", "comment": "Malware payload", "value": "84dd1d4d454f10e2d3d105b82d496f486a5027a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454831, "uuid": "a95bd08f-af9a-409c-821e-b38cda9846c2", "comment": "Malware payload", "value": "fbe2078545bbc5a4fc46027759ee9bc0b2519f69bf3ffbb42a38878ef3c048d5b91ec6dde49b3364b7e8543383072672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454831, "uuid": "9633c6d6-b903-4bf8-99ef-3401019d998b", "value": "T109A5DF33BA51C4F1D21F26B205E353346FBD92468A708AEF660EDD7D5AB31C29D27122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454831, "uuid": "7b730924-6e08-4c69-a95a-f892e5ba287c", "value": "24576:R2qepJKNTBbFOMeGnKZ+TNlqPbKSPVE5WVKuGc6jE0wpZPP:R2qepJK/85SNOKS+WVKuGc6jEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454831, "uuid": "e4e27eab-db70-44af-bb74-c9c63cf87ef1", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454831, "uuid": "abb0f638-d32c-4938-a1eb-12dc6c2368fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454831, "uuid": "a641dc6d-f831-401a-bd39-9781b34fa97f", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.5480.22766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702be0cf-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701422673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422673, "uuid": "f8255cc3-3083-477d-a958-75a0a6f542e8", "comment": "Malware payload (Socks5Systemz)", "value": "b3830115aef6b81c757b2e3c65fd6c67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422673, "uuid": "334b9aef-4764-4c6a-bb87-9bc9411cc7cc", "comment": "Malware payload (Socks5Systemz)", "value": "6b4c63887d935d393d151f374fc08880dc3fb6ac9d9fb6ce4a7bbf3dad367316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422673, "uuid": "d84ed4ae-367b-4ec5-a367-d801aaea32c5", "comment": "Malware payload (Socks5Systemz)", "value": "be4048d4c06508b6f60a917246447f305930e62e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422673, "uuid": "ea427e49-3355-42ef-a53b-115c56a93882", "comment": "Malware payload (Socks5Systemz)", "value": "7622e557bb8178ade60044b3df8270ac403501b0d0a5e151bb0481ce6b4dbb549ddabc9b7393931eb82dbeb6800e6c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422673, "uuid": "d581e00c-2e2f-49be-882c-e6a3ba907780", "value": "T179E5339212B3C436F891457248E8A44496D3FA214AB47D96250EC6CABB335D6F0EF37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422673, "uuid": "1096df6e-c07c-4b04-b734-3b298124973a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422673, "uuid": "3d3046d0-fd18-446f-8431-a14a0288b900", "value": "49152:12V9j2tB8nFGjZqzfN9VporsIKpeN+sivVAvtgUeYqpMqK9b7Bz/sI:wV9KBi9grsIKcNBivVA1g4yMx7Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422673, "uuid": "8b1bcdf4-0e1c-413a-bad5-77e69b7bae32", "value": 3102974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422673, "uuid": "7ee47804-780c-4785-b33a-4b47b1f48304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422673, "uuid": "588ce867-a623-4084-870a-8a83f19deec1", "value": "SecuriteInfo.com.Other.Malware-gen.29528.21579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcd379c-900e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701410240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410240, "uuid": "e4d567a1-8e40-447e-b241-de5dc76c461a", "comment": "Malware payload", "value": "6eab60c49af978843682f22dc2867a6d", "object_relation": "md5", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410240, "uuid": "d03aab5b-d302-4ba5-bbd3-dcc86e52117c", "comment": "Malware payload", "value": "6d82bb0ae5e6fdb9f60182b0d3189dec4be0cfb535fb303f09fea69aaa668428", "object_relation": "sha256", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410240, "uuid": "50e47ce7-61de-45cc-8191-f70a8b7aa684", "comment": "Malware payload", "value": "c441863097e7cab51728656037c01ffa257ffcbf", "object_relation": "sha1", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701410240, "uuid": "4f9bedaa-df74-4ab4-afd1-b6fc8e3f6f6d", "comment": "Malware payload", "value": "b4ad30557d686dbcd39ad96bd915dd10f8da7e759c1e781cd8f18c9e566a196920c744eaf57d62017c0dfa6a469104ec", "object_relation": "sha3-384", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410240, "uuid": "d396a8fd-a8bd-4e0a-80d8-699c9edea308", "value": "T16071210693E88767F0B60730AEB347572BB0F8805F738B6A59C4421D7DA12641E31FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410240, "uuid": "5177d96c-7b04-4517-9128-783406c18c0c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410240, "uuid": "793d10b7-1f84-4290-af9e-d52c7be119b0", "value": "48:6I/zxyQLXK1tgu0OVgJU97bb1ulIa3kq:9N8MWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701410240, "uuid": "d269a1a6-981e-4d94-868c-b1bc6905528c", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701410240, "uuid": "c58536d6-1cfc-4405-aa64-404b1cc8a666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701410240, "uuid": "9b912e72-27d7-46f2-8aca-355e535b1f08", "value": "znbtgukc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdd0d89-901c-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1701416386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416386, "uuid": "56c83f74-6f9c-43b3-8eb2-b65c064dc8b7", "comment": "Malware payload (MarsStealer)", "value": "59788e9764eb60d5f0ff277b646bddcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416386, "uuid": "b57f69fd-016d-4cb2-8baf-628c767a95dc", "comment": "Malware payload (MarsStealer)", "value": "6d8628ee670cea59d5314f18aacb449b858e9194a78d4256342999798b54ad13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416386, "uuid": "c31047e3-b95d-4321-97cd-de29ed1dbf7e", "comment": "Malware payload (MarsStealer)", "value": "a0de45f730a0d85616336f7405b5cc9755d97d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701416386, "uuid": "980a55db-d821-4648-8642-a1637ddf0e73", "comment": "Malware payload (MarsStealer)", "value": "d6393152d14afe22f8e131e985e6d0739f10cf1f326046a9f55ed29db12acf61e1905b79ebdc9fb283a3fe1d2dee736f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "SMB-89-23-98-22", "colour": "#9292A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416386, "uuid": "d2262c37-aac3-428b-ad48-9b3abcd514fa", "value": "T1081733097B30F66DFAD0C13A2442A77D05829D794B1B469336A3FF2E7931ED0DE62918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416386, "uuid": "6ad4cd38-455d-4b47-ae57-54b25af96641", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416386, "uuid": "677fe5ae-7bf4-47f7-8602-a2239536e5f8", "value": "393216:knhZ0V6XSs2I0rEGgESPd4nCpDDqNZ3VGtdw1ASBzLR:knr0V6XSsx9ESV2oKNZ3Ve+Ag3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701416386, "uuid": "b618f411-bd3f-4d43-9cc1-90a064533ce1", "value": 19767808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701416386, "uuid": "250f1818-9c12-4878-b3d1-cba070f156e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701416386, "uuid": "6e96e8e5-8a78-4701-9bfa-b8509526e0c1", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8876c7ec-902a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701422284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422284, "uuid": "5bb67b71-ab47-403d-bdca-2da4b49baca8", "comment": "Malware payload (Smoke Loader)", "value": "7f389f67e0ffdb8135354756663bc534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422284, "uuid": "b5af4f5c-7fb5-4d1c-9613-5de28627c34c", "comment": "Malware payload (Smoke Loader)", "value": "703102ba6531b3745bdde3b5c0d6a8c828a87fc01d03ff5d4a282eef28a7e094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422284, "uuid": "4534ecbd-9a28-4951-abe8-1a9e3faced15", "comment": "Malware payload (Smoke Loader)", "value": "0868ca128020adc5420c7b551b74403b43fa6eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422284, "uuid": "578fb508-6375-4505-b56c-f3594dd40298", "comment": "Malware payload (Smoke Loader)", "value": "1cc178650babd871e0b9855619d0b6664be6cae096a379900311bb360891526140eadcf276255513776a1c550411e590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422284, "uuid": "90b06439-5a2e-4e55-b6d7-170c42b898c6", "value": "T1BC34CF21B6E2C032E11719354961CAB51A27FCE29B2196CF27D43F3E5E312D18BB8767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422284, "uuid": "5fc66c84-d09e-40df-a1b3-67084e1ea070", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422284, "uuid": "08956bae-94a3-4d40-b67a-c0fbea684ff3", "value": "6144:bW8mKsNWoAwUvnY7HuuAOwQuIUGOXfXH:bWNNAw+nYbuPQXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422284, "uuid": "00cd7673-85e2-4282-997d-4f27bd62bc79", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422284, "uuid": "00ce1504-dd43-4c0c-b51a-67f208a0a2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422284, "uuid": "cf650253-5943-4f23-aeb9-85fc5839678e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b00149d-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454850, "uuid": "37aa14e1-43d9-4000-8f4d-8c8132bf33eb", "comment": "Malware payload", "value": "049b5c394820d435fee03dd7d18aa244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454850, "uuid": "42a2a3dd-3bd4-4027-8968-f69e26be0ff7", "comment": "Malware payload", "value": "710c204b6e934940407ada88860f8b86b12524f1d154a75f3653477de34483da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454850, "uuid": "4091725f-cc87-4aa8-be64-7b3b4c0c3955", "comment": "Malware payload", "value": "3a667674d5eb81c05aa6c05fea035a864bb759b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454850, "uuid": "aaba4ab6-6841-49c1-b015-8bd9c80b0e73", "comment": "Malware payload", "value": "dcfa1587099e1a2a194b8507a1a4f9c743345c846985b4edc40ca04ba85491fd08c4648de05cb9289c9eae10c4cec9f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454850, "uuid": "61b9b8e5-85f4-4b6f-a5e4-2123b78c37b5", "value": "T10D94AE2A3BF2C033D15346328C1AC75D97B6E9912E364583BFD40B0D6F652D2AF2B691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454850, "uuid": "032c2ece-f2e3-4a0c-ba98-53b81dbde8b6", "value": "aecc132c544f3c61432952f119bfec10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454850, "uuid": "d1fd0108-3dad-4f76-bc2e-a6092d4c5615", "value": "12288:a3UFhxu3cVgcYFTiKL7rXgOM52JZY6CZx/2lo+j:aE8iy7zgt52JZfCP+lo+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454850, "uuid": "cbe94460-6705-4bda-aed2-48acfab2d32e", "value": 448704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454850, "uuid": "74d813c5-71ad-4635-b2db-651fd29872ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454850, "uuid": "8640efdd-6d05-4cae-9ff1-36fe0a969578", "value": "SecuriteInfo.com.DLOADER.Trojan.21691.8567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e2a86c-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454846, "uuid": "f9022ff0-3e36-410e-b4c8-5c0cb0e11799", "comment": "Malware payload", "value": "d220b09a4529983daeccde8360236e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454846, "uuid": "41b35594-6afc-4d62-ae0d-b4b4a13cf00c", "comment": "Malware payload", "value": "719a6da4e6f62fe880ebd7a1e4712905241aff3e9e5ebbf294a4551af653a4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454846, "uuid": "6ca697d9-b180-49ff-afef-9c602a17b737", "comment": "Malware payload", "value": "a57f76cb345711229f2242ecbc5a445b18db8e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454846, "uuid": "47333718-a66d-45f1-9712-adac15f00564", "comment": "Malware payload", "value": "7d7d83e3c50e3017fa729f2aec4b289b7b1e59d0987e1d3acbabdd012b451bf67717e4d177477c88a42bace9d9e87711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454846, "uuid": "e32cecea-0c2b-4a9b-8c69-674c46dd652a", "value": "T11F45AD223282C076CA6311705419EBB9ABF5EC204F3249976BD41D5F7F24ED2AE3D786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454846, "uuid": "d92be558-d8d4-4c90-9fa4-62e9d8fb6170", "value": "432256747a2187fcf2459dfa21265ed2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454846, "uuid": "9120e9ce-b9c0-41ed-9130-5fc59ff67722", "value": "24576:6HLrN0A1GimtLsasyJzDBIGfBUWNs7/UtCOIx6A3ZLY4lA:6HnN3GDs6IGfBUEM/qC4A3/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454846, "uuid": "86634d0a-2f72-49c7-95b9-93d76806cf89", "value": 1189488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454846, "uuid": "7db59c0b-d233-4303-a14b-cc87e925a635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454846, "uuid": "5ad3735b-7b0b-495b-a0de-5bb8ab1d837b", "value": "SecuriteInfo.com.DLOADER.Trojan.4223.32600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4911f594-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454820, "uuid": "2b707ba9-747e-4324-9478-d619343d6e85", "comment": "Malware payload", "value": "e34ab07fb1ab03cf872ee4199b71c748", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454820, "uuid": "44c4ec1f-2da1-4a6b-ba90-d4787053d3fa", "comment": "Malware payload", "value": "71c603b0b142e4a5e6eb839149737eaf38328d1ac8e7107d4a720a2560b5c8f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454820, "uuid": "bcb09962-bfa0-43cd-9aac-3021915e73d4", "comment": "Malware payload", "value": "989335419de6d20c335718a4c57efa6c4de4ddfe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454820, "uuid": "278c1905-f4c8-41b2-a40b-a1b65d6eea46", "comment": "Malware payload", "value": "073948244c8faa05459680a4414d9da2a4f82d3e161a5322de5881157d5cc13ec603283921c1cc12eeaca8488762711a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454820, "uuid": "f9452978-17ba-45df-8e95-171174b178e3", "value": "T15B0672303FD12754E5A95DB51FD06AEFAAA7AD0BEC429A4D108C1522CEF037ACFE9504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454820, "uuid": "25e31d0b-34e5-4463-9f81-0d14fb784066", "value": "9e7a9f8dbd6e73b5c4c4a6421ce383c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454820, "uuid": "6436b2ec-04c6-4a46-b88f-bb7b2ee0ff72", "value": "24576:boeE4SiRR+7eV3tWh43Qa1TOyZ1KckVTfNU2h3q+G:ayRgextWh4d14FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454820, "uuid": "657fa8f5-6056-4ffd-b5de-76f87430c8fc", "value": 3920082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454820, "uuid": "5d30afa5-932a-4380-9409-9376179b04b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454820, "uuid": "43e154ae-9797-4a1d-b1d2-b64f8e2504eb", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.26228.19671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd951c3-9038-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701428466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428466, "uuid": "ff6269ec-4cc5-4348-8579-7d0cd5eb8b2f", "comment": "Malware payload", "value": "a377d92101121294088e02b01624f19c", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428466, "uuid": "1c44c75b-319f-4c18-840f-e9c320a05dbf", "comment": "Malware payload", "value": "71d4fb44b8216847d9316171bcaf918464d6e93b530b9d44cfbbf2f9a46449fb", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428466, "uuid": "102c8cf0-d6e4-4632-a6e0-00d53dcfaafa", "comment": "Malware payload", "value": "2a317a0224bfd34926c4f707145113def0d7cdfd", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428466, "uuid": "85c41070-ecd2-42cf-bc98-2e899c5e2125", "comment": "Malware payload", "value": "035b08f2bfb9adfa2e70a27a920036d80eb0ac4ab2c40199501a165b341edf879753d8e72f6e65813ac35f4b68b82aba", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428466, "uuid": "d6a930bc-50c7-4a91-bc33-64b54ded0013", "value": "T12C42F91A5BE44278E6FF5F765C32A6410672FE08DE23EE6E08D0D0094D73558CAE1F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428466, "uuid": "b7cd3351-5ae1-4a91-ba59-7e2a8a7ceb4c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428466, "uuid": "cbc7261b-6dcc-4dba-8059-a569b659e9c1", "value": "384:lljfXZBZ4qmniNOwZJ7ZaruCchr+eohkksrOHvkv:llj/ZBZ4qmnaDNvhr+eDksyHvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701428466, "uuid": "3c3e4b7b-c1fa-4d51-958e-b377e29578d7", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701428466, "uuid": "aeb32c76-fa6d-41d5-aaa8-eb418c17ed47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428466, "uuid": "1abf2f18-7e8a-4087-ae47-67d7e4be48e4", "value": "170142845905bc63be9d511930cba6a05bf6ce9de1d4505edbd579224846577e0793407dd0796.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68927735-9000-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701404192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404192, "uuid": "325ab217-fd7a-4664-b9a9-9b83d32f1f1b", "comment": "Malware payload (AgentTesla)", "value": "5a4980cc44d65dc43660be3bf0c4c21c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404192, "uuid": "d6916717-0eef-4185-a995-8a4438bff959", "comment": "Malware payload (AgentTesla)", "value": "722d2203c16ee92a4ca9476191a40da3ee3cbed17e0b810963ffb1d4e08c887a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404192, "uuid": "e1e8bdc7-fa1f-4474-bef8-5a2bccedecbd", "comment": "Malware payload (AgentTesla)", "value": "a3e4eed4dcf4147719d5e351dd46cf81926aa522", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404192, "uuid": "65bcfca5-0fc2-47e4-bc33-38fe8ebc9400", "comment": "Malware payload (AgentTesla)", "value": "eb49606b86ef4fad70913e784bb7eac4bf4987cff02904c357be47db07553d1d3f191d632029b26d26f37b24f67ede87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404192, "uuid": "04508e76-3251-490f-885c-577e71646770", "value": "T1BCE4121A23599317DA3FCBFB6084504483B3B92B6464E7194CE240EF6B72745E9E2ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404192, "uuid": "fd7d7dea-85a6-46ec-8474-03a40ca25a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404192, "uuid": "7a1caf78-ed93-4f8c-86bc-6845f5824943", "value": "12288:oCZVJvI+P3fWtsRI04OWmSfdbB8LhSKlJoXQVOILoZ7mrooTCFBUs5x:TVJL3k6h4OLsKVv4Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701404192, "uuid": "fdfc08d2-7561-4ead-a337-84dd0e57e952", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701404192, "uuid": "495d7ee5-568a-457e-b7c5-0b9f0d38a18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404192, "uuid": "9b67ee53-36b5-4466-91c5-eb3e60c4199a", "value": "SecuriteInfo.com.Win32.PWSX-gen.9041.31818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519e05da-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413173, "uuid": "26e14749-8f9f-4775-be0f-de73a2206d0d", "comment": "Malware payload (AgentTesla)", "value": "5cd7722aadafdc8813169f79fe26cd15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413173, "uuid": "9c383a3c-8bc6-479e-90d5-eeedffe1cc7f", "comment": "Malware payload (AgentTesla)", "value": "725c43344564a051e58bc34bc3d2d54df05a2eb8edf522be7f0eba70087d3094", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413173, "uuid": "b038c121-52bc-4dec-8efc-74239a434947", "comment": "Malware payload (AgentTesla)", "value": "a6eb9a2e6333bbcfce98d68764467e1c82b1d093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413173, "uuid": "70e5b166-1074-4c25-ba80-7cc2ee906565", "comment": "Malware payload (AgentTesla)", "value": "f9da37820c1f2a788ba76ad7740c50c7b5ecc7ec892490ec786f6ff6af776390361329a5424d8bd3cb1f589129b05122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413173, "uuid": "b6a70e6c-4914-450d-9a76-73b18618aac7", "value": "T1B805DF3973F487DADC6983B66595801883F05E6DDEE2D209EE807AC53011FE01A7DA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413173, "uuid": "9f6f94c8-98b1-49f1-9a9b-64c3dbc558d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413173, "uuid": "113e1eb7-a419-4997-8349-88b4419053db", "value": "12288:dhm1E6jD/paxJVZJToapvT/8uJ+nW9Kja0JTDYEy7P3ATsNcrZXY+opoxx:3m1tD/paxJNfvTUK+nagbmyZ/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413173, "uuid": "bf8ebf6b-a93f-4b9f-9304-454fcd29a0c0", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413173, "uuid": "ea9eff66-9548-4951-be01-433b91070915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413173, "uuid": "0d35ff50-85c2-46a9-a65b-91222804f9b7", "value": "Hesaphareketi-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8259792f-908f-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701465653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465653, "uuid": "a53f04ae-db09-4dc2-8755-e56cbf912f4a", "comment": "Malware payload (Stealc)", "value": "01695f1475ade0efe3f83b981e35f9d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465653, "uuid": "8b40ddbf-9147-4cb8-9683-55c71d96c773", "comment": "Malware payload (Stealc)", "value": "734b498e35de442a0cbb8c2cb2e037dadb9976d596584097c288cf1b18ae9e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465653, "uuid": "8cefe686-ee19-4f6e-a0f3-47409d4565a8", "comment": "Malware payload (Stealc)", "value": "8b6a52bbf2d98852a7c4d721867404e27d3e8e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465653, "uuid": "884e9657-0c4a-4365-b1b4-ae72345dabaf", "comment": "Malware payload (Stealc)", "value": "05289d3ae778b60a400aba8c1722b4c6ac8e3f1328c0e389f50094e4333776f78423e3367c6026a2b938c3280f987eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465653, "uuid": "1572b312-ee2f-4f88-8c7c-5b916a4ba728", "value": "T1F9546B0352E06C61E5224E328E2AC6E86A1EFF518F3D779B13586B6F09731F1C662F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465653, "uuid": "e447209e-b9e5-4803-98db-ccbff3a1c1e8", "value": "d3ecaa3ff256d295d638233f7023beb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465653, "uuid": "c5e0b955-89bb-4436-8869-1cf3396a0639", "value": "6144:98fb0LdL0V9azDdVPpfc9U3lUmN1JQdbzBagPp6:98o2V9azDdVa23lZNHWBaQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701465653, "uuid": "5764eacd-2ddc-4ff6-bc52-414192ea8e75", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701465653, "uuid": "4bf87dd6-9208-459c-b54d-1ea92cdce382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465653, "uuid": "c4409063-7b71-4ff1-a572-9818a41147a6", "value": "SecuriteInfo.com.Trojan-Ransom.StopCrypt.14278.25208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb78c5a8-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701413887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413887, "uuid": "19b47b3e-689b-414a-af77-744c2e40f63b", "comment": "Malware payload (Tofsee)", "value": "3d4b04ef5fa77beaeef043f5a0fe5912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413887, "uuid": "dc236b1f-8646-47cf-ad70-322c7a09d307", "comment": "Malware payload (Tofsee)", "value": "74d8ea75eaa0b08203bd607fc7b03b96ea3c45f5fda7d883d8587db4b85c1bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413887, "uuid": "3564ae9c-d389-4c19-ab54-0f4909f1dfce", "comment": "Malware payload (Tofsee)", "value": "ad07caff0de5987592a648fbb9d4f240c088ac2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413887, "uuid": "5c489c6f-31d6-4ad9-a022-bc45527a8a0a", "comment": "Malware payload (Tofsee)", "value": "5de262c5f157edb7f2dcc39bb23389a96c9d83c72cdd867f4b16ebbd3d4ae311b5b435d4a1d4a17c5c193b605d86207d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413887, "uuid": "13957033-1142-4755-998b-1f8b2de59457", "value": "T1F764F71382F1BD44E9268B729F2FF6EC771DF6508E89BB6922189E1F04B1172C263751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413887, "uuid": "2affde69-17eb-4ba2-9b50-e4746341c814", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413887, "uuid": "86419743-8dfa-4fa5-8ab9-dead638d0340", "value": "3072:FIc+GjPykq8OdTpVbv+XeC6jRxK2s2mUn5wMT2UXdZ315U:mw7yFB1v7jjK3hMTFNhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413887, "uuid": "da5d9417-32d4-4e26-b987-9e6764531c84", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413887, "uuid": "6f011db3-7632-4526-b69f-165624efb9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413887, "uuid": "fa7f4691-7f4a-4030-a71a-0cdec799b303", "value": "3d4b04ef5fa77beaeef043f5a0fe5912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af257b8-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413215, "uuid": "36125e35-b7f7-497a-9f45-b2ed702ff7b7", "comment": "Malware payload (GuLoader)", "value": "f3e3af5fb37a4c309b57e68c76ae0826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413215, "uuid": "b328440f-0069-4360-8c29-df70b594ef04", "comment": "Malware payload (GuLoader)", "value": "75ae0b4fd0e8a7c0bd54d849c37a5197fe8c10023649946efaa4ca70478c37fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413215, "uuid": "c4a313ff-4907-457b-9629-6fae3e359d88", "comment": "Malware payload (GuLoader)", "value": "a352e62892f885186eaf19d7bb58266d1216378a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413215, "uuid": "a94bc139-cf49-4210-8221-adc88d09abb3", "comment": "Malware payload (GuLoader)", "value": "8ea81f86e8e28314b9a8e56ad0a469075a993e028f87e20236da3842abd7fefccda021102353579a4b0b459fb59ea030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413215, "uuid": "fabc39fa-f73a-4a7d-8389-c6b14be7b637", "value": "T171E4BE9279DA756FEC2F4A74034FE6B22AB95CD07392096E4F80760C4C3254690EEED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413215, "uuid": "06502772-5607-487e-94cd-8148aae1ea33", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413215, "uuid": "b25eb888-816c-4735-82de-e0a17d9a4725", "value": "6144:nmOPAPZVheNA+ff03PQtQrpJOHIKKonvbSnhqNqgdXhFa0Xxs3Q1N6VoLz3ZST7Y:Wnhe2eaPyGqnTSfgayO3Q1uon291YLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413215, "uuid": "93c14ca4-4b00-4a18-82ff-45c9fe1e1e0a", "value": 683984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413215, "uuid": "d4ff7eba-d1d6-4047-838c-c9b4636b56c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413215, "uuid": "f7210588-66bd-49e8-a6d3-1e73aac017aa", "value": "recibo vencimentopdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2169bd0b-9057-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701441439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701441439, "uuid": "196c94d8-f6c3-44ad-836f-9d2945b4476c", "comment": "Malware payload (RedLineStealer)", "value": "5c500ef899e3653b6f3530f761d0350e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701441439, "uuid": "aa992eb8-46fc-4f26-8107-d86229960c3b", "comment": "Malware payload (RedLineStealer)", "value": "793002404c567d5d433cbf47625e9ee1da70c33b454c33fde052a6ee04367dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701441439, "uuid": "894fa5f5-a34b-407c-b3ea-c48b2b6ef27b", "comment": "Malware payload (RedLineStealer)", "value": "095101f6a064a7e18bff134c17599fa0c09c3c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701441439, "uuid": "3bee46b9-2f85-462f-a96a-916ccc149f60", "comment": "Malware payload (RedLineStealer)", "value": "77af68ba3afd53374f30aa8168c95d3fcb3806e98e85b59962f1977b7d0a31412128cd72df079741a91575b3063499f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701441439, "uuid": "bc9ad830-7433-4e62-9306-98e3b49edf0c", "value": "T1DF358D2175C1A172EDE220BE43DCBE2E825D90B0071755CF0A9857EAD7507E3BF326A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701441439, "uuid": "7a609774-7a6a-470d-a687-42f3f5ad7a8b", "value": "8b3d38bfa096aadadaaee726c01bcb8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701441439, "uuid": "fad34189-c05b-4567-bf4a-f661d9373231", "value": "24576:1ffwMbe9GN3OaVUMi88A3pNNOawg+4XB6ejA:SGN3OaVsSx1NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701441439, "uuid": "ab0e4f97-3176-425f-b7e8-258edf322cb7", "value": 1100576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701441439, "uuid": "d3e5e0f6-adda-4168-9d4c-9763e57ad946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701441439, "uuid": "1852d3fb-5c19-451e-9b58-9b7ae9093b41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5468dc6d-903c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701429928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429928, "uuid": "270e8a92-3c1c-4135-89c1-e5b4a9105311", "comment": "Malware payload (LummaStealer)", "value": "6aba36e729bbe2d37e270e7f192519c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429928, "uuid": "86e57637-8609-4311-afe6-e22de1c65449", "comment": "Malware payload (LummaStealer)", "value": "79890f76db2b45a3347bd0d065f60d51f835cb2a2780a3d8093d48f386cccd9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429928, "uuid": "01967507-7080-4f5f-88ec-60e9b01f20f3", "comment": "Malware payload (LummaStealer)", "value": "d6d0b53c9ce774e8da74e22ed2f37648b2288811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429928, "uuid": "604c53b8-daff-4571-995e-ec6374bef930", "comment": "Malware payload (LummaStealer)", "value": "251874c9f557dfcfa019de0abefb3b4157a4ad2528059867c624158ef7e8394b2cb657a33cde4233a2ec2334e315b319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429928, "uuid": "1fd1c5f9-40b6-4ab6-b4b7-035782d519d7", "value": "T147367D027E51DF27F129113BC5EE594413F0FC289AE2E72B36B8323D4845762B8569AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429928, "uuid": "981bbbf5-7a50-4577-b562-28029a3e1ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429928, "uuid": "c02a72b1-3b75-41e6-9793-dde56c134b4d", "value": "98304:CIqRyEQl6OBHkC/AwoxREH1W9dsl/mewtKdBm:CJrOhZtogHo9+weZBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701429928, "uuid": "17ec1313-e9d7-4fb5-8b73-05f6b1e08266", "value": 5103104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701429928, "uuid": "f977084e-7ee2-4c0f-85a3-40ac68ecb662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429928, "uuid": "1bd932c1-5397-45df-b06c-51091124d29c", "value": "SecuriteInfo.com.W32.MSIL_Agent.GZN.gen.Eldorado.23744.21242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e97056-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701413475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413475, "uuid": "f9df0715-7b99-4077-be50-5c078738ba26", "comment": "Malware payload (Stealc)", "value": "73c9f8e907f5b31e4583d928e833446d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413475, "uuid": "3b2a1942-923f-4397-9784-138f98cab2c4", "comment": "Malware payload (Stealc)", "value": "7a5adde924262ecd4fa4d627b02796d7d338104bad89bf2ddc019b678c30d740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413475, "uuid": "f29d0b5f-f191-4d6c-923a-af007c6b6599", "comment": "Malware payload (Stealc)", "value": "3cfb8e1138a759bcd9444acc0c1337afa538058c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413475, "uuid": "b6a3a935-e7c2-4f2c-a400-37c45914437e", "comment": "Malware payload (Stealc)", "value": "7a578b3af400d70d90453ed624142d6a61aa9097cbac6a2c67f93e1eb995aa98f59d1c15a982df2df0cf77a30e833c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413475, "uuid": "995a7ee5-aee4-4bca-8549-98c4b42ff517", "value": "T18C34CF2176D5C032E11759394871C6A55A3BFCE29BA186CB37903F2E5E312D2EBB4707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413475, "uuid": "11c9f668-a384-4ce4-839f-908d71ed1af3", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413475, "uuid": "895987e8-4831-4bab-a30d-7358db7e0bce", "value": "6144:uw6fYT2I4wUvNsAc6Lmo1LAxUNBu17r8fck:uwJ4w+NsAcWmo1cObgrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413475, "uuid": "15a6ba48-5275-435f-a1e1-64a1fdeee587", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413475, "uuid": "c73504c3-960d-401c-bd70-8ad7e9497521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413475, "uuid": "8dde6eb5-dbd4-46b9-92e6-dc081257adfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2ed645-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454853, "uuid": "678bf33f-641f-4245-b1a7-c61502297d0d", "comment": "Malware payload", "value": "b0d26c8ae6986206262671149e1ad425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454853, "uuid": "c36ba0e1-e362-4166-be81-5d7305e5fe71", "comment": "Malware payload", "value": "7b25ea79b678ceba6fdb0ff4d60a52c2ea4e2abb542f2b53b617d940abd7fd83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454853, "uuid": "42c16fe0-3603-483b-90a9-a3b13b926298", "comment": "Malware payload", "value": "7c4e1a49ed7bfa6ec44347b69874f9bebed9c11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454853, "uuid": "cdd33a6c-489f-4837-ac29-d3567a48ed94", "comment": "Malware payload", "value": "5811d292128ef18a1952b2389edd0e494f8e75a877a3c324dac8840a41b304f604ee9a9f81776fed76a378bff9994b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454853, "uuid": "ef3bf468-3336-4d7c-a099-829b3b4957c6", "value": "T100057D22B2D14477D1732F34DC2B86A99D36BE402E28A9863BFD1D0C9F7975139392D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454853, "uuid": "91bcf3ae-aa62-44f2-9d88-bfc1f339c216", "value": "12288:dY9BUaGslCIy8ze9BOJUdY3Rr80dtMtCnAkDbuW0RK:dYnUACIy8TeIm0L6CAW/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454853, "uuid": "b81d24d8-4f3d-470e-84af-314ba913bdc5", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454853, "uuid": "2415892a-6bee-4761-b58c-7f092aaa9a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454853, "uuid": "2bdb302d-e3b9-4182-950a-34a55bf7e2d8", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.23672.4610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efaa9d0-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454856, "uuid": "28bbe9db-48d7-4a12-84bf-5a1da8bba2e9", "comment": "Malware payload", "value": "311fd7a7a1db566cd0c411650b38109e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454856, "uuid": "2a6c1588-5087-4ed2-8d2c-084be6eaf45c", "comment": "Malware payload", "value": "7be17c7082c5171309e61663423fde0d7ea864066214ae449fadc34ec4f0cc5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454856, "uuid": "32ae82be-1f16-4840-987a-81ddd329bcca", "comment": "Malware payload", "value": "3a12c0e270b94c1968d5b77bde339c56826d6110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454856, "uuid": "498ae132-4ca9-4bfa-b09c-22ee6390a5bd", "comment": "Malware payload", "value": "cd3b50ec1d2810faac64f70d869f129f35ab2b746962f0cf8edd5d04a16c66fe279003a13e981cbfc810a4c5fa11a3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454856, "uuid": "a80210ff-6890-45fc-ab50-c551261ebf13", "value": "T160357C0732915033E6B279364A1B429DC826FE161D78345A6BF9AC483E35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454856, "uuid": "93a6e2ba-acd4-49bc-b17a-1bccab55e089", "value": "12288:jGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3f:jKvzcrnyaLO+3Yb/wQeAh/7RN1nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454856, "uuid": "6cdb24e8-ae89-4d26-80a8-4d0ce1b31aea", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454856, "uuid": "fd362b52-d4e4-4115-a8da-1fdc543a3dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454856, "uuid": "cc4dd419-afa4-452b-a656-76db6db03b35", "value": "SecuriteInfo.com.BackDoor.Pigeon1.13337.23135.18156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3501218c-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442331, "uuid": "8273f06b-10bc-4591-9e2f-28b598944858", "comment": "Malware payload", "value": "0e3a07581be07c38b93ee0b3e3cf2c41", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442331, "uuid": "d5e2db43-886a-43db-9719-adb6f6e50260", "comment": "Malware payload", "value": "7d0d8d8485f2269511508824194ef39de4d036e819fa7024e177125235fe8dca", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442331, "uuid": "e60210f8-11d4-4f5e-a535-a0502c4f6165", "comment": "Malware payload", "value": "5d92a62b251f45715769b6b68d846af061a26625", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442331, "uuid": "61c1b580-e5f9-4dc4-b43d-d629fb4ffd82", "comment": "Malware payload", "value": "aac5b1026be971306418fcc1f8d1027744fd3874c23901de1c7e4a4bc4ba433b861fa39d7557f5f9023140b8c45af99c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442331, "uuid": "9a940197-8797-4c25-a712-75e4319ddb49", "value": "T1FD560175731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442331, "uuid": "e1c224ec-4ee4-4999-aba0-66eac3316efa", "value": "196608:/VDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJY3:tirUVis8O/0giAZ9PD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442331, "uuid": "8de946d6-48b7-420f-b5c9-c03fbc9d87e3", "value": 6372282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442331, "uuid": "37dd844e-0c17-49c1-aabe-eacf64b22995", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442331, "uuid": "6c88fbd6-b7da-4521-a739-e969d6c9398e", "value": "ST\u0410R\u0422.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6104399a-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454860, "uuid": "da77c182-f188-4e1d-ae3e-1cd34a0671e1", "comment": "Malware payload", "value": "aa580db3d4300da67a292db3469f8eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454860, "uuid": "5f02ebe4-7b69-4ff8-8600-65e256b927b6", "comment": "Malware payload", "value": "7d2f0f1d4df1903740631dae6f63492d5f29d8075ad659730f5eeeca37fd44ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454860, "uuid": "e82319e0-80b0-4001-9e70-821532b64192", "comment": "Malware payload", "value": "b73ba13a8081e582078575309fd6da490046fa48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454860, "uuid": "4f97e666-3288-4a5d-8a4c-233fbad2647b", "comment": "Malware payload", "value": "4fac8cbfd2a6f5ab162505308f45435ec99d1e5dd1f978c22236887af24e8b9ccc80a4c98e6c13bcadbb290498e0d665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454860, "uuid": "e5d54e7c-c3bb-4797-ac83-48d414a5d22e", "value": "T169156B22F7919135E0510A34297A9336B637BE353571D24BA3CCDE1C6EB36D2B52832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454860, "uuid": "17594f70-642c-41c7-b44d-32c336b5f94d", "value": "7059520883c9b27084f30d0198c7f646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454860, "uuid": "23874393-01c0-455c-b996-d923c23b377c", "value": "12288:EWlJdmaMVv0x30mLjZpztKyqjTZ/kZz/dtUQjZpz6Eh1CJG6ZMhkZzmPseWjFYL:E3v40mVodkZz/dtUim0wMhkZzMkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454860, "uuid": "dd96346b-174a-4de0-b7e9-97c3e7ac83b4", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454860, "uuid": "cc3967c2-ba9e-49b5-a74b-ef6476b5621b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454860, "uuid": "99b0c3a7-4608-45b8-aa44-d5d5e337b2ba", "value": "SecuriteInfo.com.Win32.MalwareX-gen.15883.678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d39f2f4-9011-11ee-8907-42010a9c0042", "comment": "Malware payload (Phonk)", "timestamp": 1701411421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411421, "uuid": "a5fd5553-68b4-40d3-83ba-07eb01856e35", "comment": "Malware payload (Phonk)", "value": "972d3ec6a976765bee7f681e6884c13a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411421, "uuid": "00ffd63b-d9e5-4c47-abe6-b55a1a3c3017", "comment": "Malware payload (Phonk)", "value": "7f1fbbd646d475c2d875426a7a5128e30d54b98ae31ef9b7e484211f787770c7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411421, "uuid": "767dc3b0-ad16-4ba1-b914-d6b409eca3b7", "comment": "Malware payload (Phonk)", "value": "e80ae6a00b1eac69ea79dda90e1db4de315382c3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411421, "uuid": "168bb503-65d5-4d9f-9fbe-e50a5963a70b", "comment": "Malware payload (Phonk)", "value": "240ca4d943e952d50896a440edc60b0cf1ced08f070ccda418ab79fea79d53b229b32b2f60f97cd4cf7171c2e35e326f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411421, "uuid": "65bbcfd9-e292-4edb-8188-20c5d8e47df5", "value": "T1CBD5495C7A824C7BCE4901F3998E45281E92850B1B45A65B2FD38ECF932D6F7C9CD28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411421, "uuid": "a0f0c30e-8f7c-43c9-a769-81e8a115a407", "value": "49152:MOSiu1jUYLWycEC/7iYMEw+NgCwM/8ry4561q/D6e60:xIyU2Z1qV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701411421, "uuid": "f5970c9b-1083-43bd-b9d1-52a14c4a832e", "value": 2906112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701411421, "uuid": "e5c1d77c-a9d0-4da0-a1ce-a33f9fc77ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411421, "uuid": "49d0a6a8-1f55-422b-90da-fd28560bd7d9", "value": "972d3ec6a976765bee7f681e6884c13a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be6523f-9003-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701405566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405566, "uuid": "65d9abf5-2071-4680-ab15-7c4980a19024", "comment": "Malware payload (AgentTesla)", "value": "e91cc13cd437b2cafd949440fd277a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405566, "uuid": "fcb1298b-9e00-4062-af8d-04d13292fac8", "comment": "Malware payload (AgentTesla)", "value": "7f448e7539ef2dcc167a97bb2744c12d8d412fb0eda46cea638d452070c70d4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405566, "uuid": "67cfe325-a0ab-4a7c-a80f-aa45503a30d4", "comment": "Malware payload (AgentTesla)", "value": "e9bd3493467962968e4c2851293a16b1e35e7837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701405566, "uuid": "55e1ab5f-23ed-4d09-a7f9-47642b677e0e", "comment": "Malware payload (AgentTesla)", "value": "32a0e86b990abe0634ab14cd9fc8ebb0efa7c82befdda52968153d5baa9ccad9587d60afafbfa406373ca9e1347cf44a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405566, "uuid": "13dec6b0-8229-4ecc-b8da-d1372c5f95e1", "value": "T11FB402543399C766D67F8BFF6884405483F3F5236860E21C8EE244CF6A72750AAA1F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405566, "uuid": "9d2ce998-5875-489d-ad10-496e2da69c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405566, "uuid": "87144f30-a60b-47a9-bb70-56871984d56a", "value": "12288:6CM2J6IqUYh1PkxAXqMNzGAlCFDNdbBz/Dn7NG:82JGHRGm0D3BLD7NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701405566, "uuid": "b0e01966-4e6b-42eb-9e3f-1d2aa772e281", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701405566, "uuid": "1e5a9c25-5c8f-435c-9558-362f0c3c4ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701405566, "uuid": "4544a604-fd76-4f3a-ba3e-fc7f74796b01", "value": "e91cc13cd437b2cafd949440fd277a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392d9b75-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442338, "uuid": "d360a928-7865-4307-8d58-0b95a576ba34", "comment": "Malware payload", "value": "111c62f9b0be00701639b7e3042b5375", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442338, "uuid": "27e9e9e4-422a-4ce2-b54c-eec32d7a8de6", "comment": "Malware payload", "value": "7fbff8edd1776824d37676ccd8f8baffd2c09d252b95af1a77a733d2f74a5922", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442338, "uuid": "a46d18d2-ace3-45a5-83a2-183f42f0cd36", "comment": "Malware payload", "value": "5a9c2edd4234bfc135ca4c1a272b19dcc1913390", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442338, "uuid": "7c071374-34e2-4173-8f59-4d9e12dfb062", "comment": "Malware payload", "value": "c4712a43624f32dfa1506d9d8697bd53fbc4b06d4500b97ea256be8e71e80ce549c7b54071e2c8704de9018914698a9d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442338, "uuid": "0912ba07-f5d4-409a-8f88-3d217dfaf3a6", "value": "T154560175731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442338, "uuid": "120410cb-8e9f-49b9-bcdc-09a2fdc99282", "value": "196608:/rDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYzh:XirUVis8O/0giAZ9PDXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442338, "uuid": "474ad9fb-14fd-49ae-b3b1-a84290d729fb", "value": 6380476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442338, "uuid": "0f70371c-c7b5-4f81-8036-d514ba49e9bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442338, "uuid": "a4f128e9-ce7f-4783-a6e9-dc4b97aba6e0", "value": "S\u0422AR\u0422.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b27c76-9067-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701448529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448529, "uuid": "68e3ba67-3ec5-4293-838d-85f3c9bdebbb", "comment": "Malware payload (Stealc)", "value": "295740a3a47e65241b90908d9079f902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448529, "uuid": "62c28961-7c33-4403-bd7d-e066f764a840", "comment": "Malware payload (Stealc)", "value": "80364d5d47fd955294cfab44b6b80469eda7c17ae3c0090b01b93f843f14b3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448529, "uuid": "0ac03c4b-5ffa-4505-8ba2-cb1d6cacd909", "comment": "Malware payload (Stealc)", "value": "61d8e1a8747a576892b8d7bd83cc75b2c68571c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448529, "uuid": "92cd3f01-5253-4840-87a6-05b6558a04f1", "comment": "Malware payload (Stealc)", "value": "8bcb90c1888cc03a183121db866ff55f82ad3daae7d260f499cf104a603114dc0bec1799c3b8ced7f9966bca99eb3486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448529, "uuid": "3231fd81-0447-4bf4-b327-a5d47f429dba", "value": "T166545C1292E06C61E5264A368E2AC6E86A1EFF518F7D7B9B13146F6F09731F1C172F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448529, "uuid": "f1916076-a390-4f8a-9abd-3948f795dc1d", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448529, "uuid": "0275ec99-b14c-4f9d-b2c9-c5a7108d51a4", "value": "3072:RSNry9DrldTfRcBDrs0UDqLCWXCKDOysIsDjyoXaUhyWLHpY+oO3Eglb6C:RSor/fGJA0UDqLTyeYDjyoXrLJLUgp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701448529, "uuid": "909b31eb-e545-4eda-a5cb-3592e3a67fc0", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701448529, "uuid": "ba1a6edf-289f-4df8-a048-ee29e724ff50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448529, "uuid": "7973e9ac-5494-413e-9bfb-8d924cbd1e69", "value": "295740a3a47e65241b90908d9079f902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bc3441-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413314, "uuid": "6b963417-3a06-44b2-9823-b5f5cd4fde12", "comment": "Malware payload (AgentTesla)", "value": "ac45ab0fd984c1fbe4caa1624409d419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413314, "uuid": "acfae8d2-1075-4b4f-8265-78c2855d85c1", "comment": "Malware payload (AgentTesla)", "value": "80432177df79f70a80d85576936ae972ba85c1c7d949ceb263a97e54b4b48c1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413314, "uuid": "77c5265f-7c99-46eb-82c7-4785b4966414", "comment": "Malware payload (AgentTesla)", "value": "08cef5d01f69628db280ff96fae998165cf1ba54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413314, "uuid": "8b549976-a184-4b12-9370-b6b8d3640d31", "comment": "Malware payload (AgentTesla)", "value": "c89ab5f89c00ef01cd83f508dee7a79da803d47cee39e3bee7b30b7ade80d748b21f76a7515ad82ccd9d1605751ec11f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413314, "uuid": "049a0531-2762-4707-b30b-d8cd0422f8c3", "value": "T11EE412447FF48623D0A61BBA647201F013B5478C4137E7091EED36FAE927B572642E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413314, "uuid": "e50029fa-beae-4fbe-9391-6f240d928f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413314, "uuid": "d372bd87-0bbc-4894-9b6d-2d96e65847f6", "value": "12288:OA31vjJGGna1bOLcOEYUWQczCjAz9C1rOe/KGZmw+XJsK3usIf8sWHJU6:OA31LJ1na1pXtakjwe/K6x+59If8sWHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413314, "uuid": "921b082c-19dc-4f1c-880d-ec3e3d4a3a62", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413314, "uuid": "850ff175-cc55-4a25-ab4f-83bb7da77d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413314, "uuid": "70e4f92d-3250-4078-b1a9-02c9f69f61cf", "value": "Proforma Invoice No.42037 _PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d28872-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413182, "uuid": "80461809-54b1-4705-ace4-4348953ae44f", "comment": "Malware payload (AgentTesla)", "value": "20612ae6c9110e64d058facc7cf27e48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413182, "uuid": "11bf0456-f2fe-4db4-acf5-3fc68d363b4a", "comment": "Malware payload (AgentTesla)", "value": "804c033983bc6ce39e5e8bd3c5ceaac31b2e6010f34d899926017e7538197191", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413182, "uuid": "a87df593-6e26-4f41-8aab-a120c9041fc0", "comment": "Malware payload (AgentTesla)", "value": "3b42373cba38720a83eb9d6f6eb21f07dee2c7bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413182, "uuid": "d407c9b8-44de-42ca-8009-58c95e5772b3", "comment": "Malware payload (AgentTesla)", "value": "c6ae8ad5c37ff7b437c6f235a5957feb6ab2a9f0a6bb0e8fca9b81dfbbf884dbb06f4f945c8a82778f756e504599a5b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413182, "uuid": "d0827cb6-475c-4bb9-a2bb-f170609bf1e7", "value": "T1EEE413416EC6CA22E06A13B728E2712217F023AAD153D95D09DC3BD9D43A35B7417FFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413182, "uuid": "3a084c7f-b015-4a6e-a656-bfc885cff01e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413182, "uuid": "4e1a32db-9638-4bc3-80b0-3fb7f007b141", "value": "12288:wqfLYYZXTysTVMYRPA+uzi8GazjlsqMgi6CgGly/tC3cQZcSI2zTsosU06WvQTW:jXTnSY9tQlygLp8y/kfI2zoz6Wv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413182, "uuid": "cbed3456-711b-4129-b7d4-856505c3f9a6", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413182, "uuid": "67b58942-1199-4181-b294-d069672ff266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413182, "uuid": "bff56d37-118f-4a5f-83a0-8199ca597ab2", "value": "Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591724ae-9032-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701425641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425641, "uuid": "fa8565a7-a469-4838-877d-6cf1620330b4", "comment": "Malware payload (DCRat)", "value": "52777aabd6cbbed35e69f47b2cc9ae7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425641, "uuid": "9853fa2b-c94e-4e07-8dd9-a131c825e8d8", "comment": "Malware payload (DCRat)", "value": "80cc02b76df0e84c09c64a9ecc3f746e4a776dde0abef216b9bf528ec2ddba4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425641, "uuid": "0affce7c-007d-4a5b-97b2-6fca3308a005", "comment": "Malware payload (DCRat)", "value": "50ead8da7464d84e7e59ada9324d87f8e7cc41cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425641, "uuid": "e5d8ce30-53cc-4e4e-9d8e-16ecfc4b247a", "comment": "Malware payload (DCRat)", "value": "8dd709e9a49a22997200bcb3f448674d2795ad98b3f32fe82a66799f79783f961e5db4bac496181697969ac80f882bf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425641, "uuid": "a740425e-2b89-4e51-90b6-5fd3be875a5d", "value": "T16FB5BE027F48DE11F0091233C2FF494887B49951AAA6E72B7DBA376D541239B7C4D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425641, "uuid": "adebc5b9-81ae-4ffa-8542-47f0e2787712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425641, "uuid": "62244e34-707e-4b89-835e-8c628d45a5cf", "value": "49152:2pehPe6Iql/U7Ina2pAOHRFkkvnBTGY54kXk5Kn4Z:dhPeB7opAekkRd4kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701425641, "uuid": "fb48bb27-8a41-4fc8-afbc-86cd13a800be", "value": 2463744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701425641, "uuid": "1361b883-41fa-4c31-b941-be017ababf4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425641, "uuid": "389a119d-b35a-4c55-a17d-63576c94bfef", "value": "52777aabd6cbbed35e69f47b2cc9ae7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc537227-9047-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701434854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434854, "uuid": "aaa5315c-72f5-47cb-8370-d65e9d901ba6", "comment": "Malware payload", "value": "c03b20cd32dd10b67e4b409be3f5a2b2", "object_relation": "md5", "Tag": [ { "name": "Web shell Choper", "colour": "#93F1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434854, "uuid": "6383adf0-0b7d-463a-a763-5f4c84f9a9b0", "comment": "Malware payload", "value": "80d5940fce9fa80f19592a4ef6079ba0da0401096579c7dcf3e3f993161d03eb", "object_relation": "sha256", "Tag": [ { "name": "Web shell Choper", "colour": "#93F1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434854, "uuid": "3a48c355-29a0-423f-8973-121eb4581408", "comment": "Malware payload", "value": "6dde12cabdcba750315e0b76627a6ff04515e730", "object_relation": "sha1", "Tag": [ { "name": "Web shell Choper", "colour": "#93F1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434854, "uuid": "362c8be9-f663-40a2-b861-756e4899d7bf", "comment": "Malware payload", "value": "f1214123007892d185c2b8d91aeb317aec4df57b8116e2b7d5fcc2c146744963e80f723690c1fde00648b96b2d8597a5", "object_relation": "sha3-384", "Tag": [ { "name": "Web shell Choper", "colour": "#93F1D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434854, "uuid": "0719ad4a-d44a-4dce-8400-81c2ddc4a113", "value": "T196D0A79D186A88B0F4D4C40D51286DE851404176109DC520498EA746DD5FBD80071776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434854, "uuid": "9f0c5ad5-508b-42f7-94b9-2562f7e6e716", "value": "6:jFHeAH2bxxaC14RP9VVNjifV+OwUD27WltRzn:jdehbxx7899jgV5hD27Ifn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701434854, "uuid": "e03b770b-fda9-4db7-a54f-49aa6513c90b", "value": 233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701434854, "uuid": "57f9c97b-b88e-456f-b18b-d6c5fd15c7cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434854, "uuid": "c5402c63-869f-4212-bde0-4bf1e63c9ce2", "value": "AssemblyInfo.aspx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad72d64-900c-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701409511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409511, "uuid": "81747174-127a-43b9-b550-14c9aa8ee4bc", "comment": "Malware payload (njrat)", "value": "17fc57332de8f4662c61dcaeed9ad4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409511, "uuid": "3fcfb075-27d3-4625-b597-7045c4fa9409", "comment": "Malware payload (njrat)", "value": "80fe1dc239ac2d5833c3486d1535a563f3f8ef2fb4fec3b9e1cf969675961873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409511, "uuid": "b96a4082-d9f3-4cf8-a548-b204d38b0ff5", "comment": "Malware payload (njrat)", "value": "a83e40f9f42fa4ec2e714a5f8f5bd997c35e61f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409511, "uuid": "4ff258f9-2612-4839-9730-ef3648bdf394", "comment": "Malware payload (njrat)", "value": "b0f64d9174658fe2ec497585968f93b28d0235cf0b13f5229ca00c1fcc529dbd93410b4b43180743dc9aea611d4a54b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409511, "uuid": "1169ecf2-da10-4e21-80d4-f64114f1e942", "value": "T1CEA22A4E3FB88855C5BD177489B59A110370E1870523EE2A8CC560DBAF73BDA2D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409511, "uuid": "841b83f5-1efb-41ab-b203-7daa3d477cd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409511, "uuid": "0ea92b6e-fad5-4310-849c-c702f931d027", "value": "384:r8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZen:vY+sNKqNHnSdRpcnuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701409511, "uuid": "be2a0788-6965-483b-94da-983ee347be9a", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701409511, "uuid": "10aee322-650b-4666-90e4-8068836ad931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409511, "uuid": "08100f4d-e1a6-49d8-a4a6-01dcd47d7458", "value": "17fc57332de8f4662c61dcaeed9ad4b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334103d9-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413122, "uuid": "59467e5d-a1b9-422c-97bd-ce15adaf9e58", "comment": "Malware payload (GuLoader)", "value": "629e4fa79e47c11beadc0157477b39ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413122, "uuid": "8f57de71-1e71-4098-838d-bf88f56e425d", "comment": "Malware payload (GuLoader)", "value": "810d4ff14a76e479612f4d33f51ea256ac7b1733951f323c91093cdac6c8e634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413122, "uuid": "88afbb8b-b341-42fd-ba0a-d5fd52be694f", "comment": "Malware payload (GuLoader)", "value": "e84e44a7dc0997d70fa12d65fb54e3c47e2a7687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413122, "uuid": "64d73721-9257-49b1-9008-788948b24fc9", "comment": "Malware payload (GuLoader)", "value": "5e36c1ae70b351fee58060015dd2c0d4013175fd0d348e834fbafd328a874ec98f81f2bfaf47c2de7e63e86a3f5e01e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413122, "uuid": "429c6c25-e24d-4ed1-9ec3-517863bd38d7", "value": "T1B4E4CF9239C9316FDC2F4A74035FEAB22A755CE0B392096D4F40761D4C3668A90EEED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413122, "uuid": "014b8824-b9fa-405e-9989-9a86de8d5bd9", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413122, "uuid": "a6e5d9f8-ce07-457e-a3f3-63ae904a56d9", "value": "12288:4cqnhe2ecSFT4GlSQai71s8Lbscdm17zOckylak7iI/dKX0HOnd:4Phem0cVQtbCKdOT73dy0HOnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413122, "uuid": "4df45e73-1665-4628-955f-e15304ae10e6", "value": 669840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413122, "uuid": "12775a81-ee7d-45eb-a3de-6ca0bddb23cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413122, "uuid": "6c7a2228-3769-4079-940b-9ea7ce4c6fe6", "value": "Ticari Hesap \u00d6zetinizpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf52217-9087-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701462285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701462285, "uuid": "d08e7bd1-59c5-4573-979a-5d5fbe4db1ee", "comment": "Malware payload", "value": "3e6c1d86e7f12c050b5b02f2ab2aff7b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701462285, "uuid": "a40ad205-2668-4684-a8a2-c576c794f480", "comment": "Malware payload", "value": "8151443fcb1474b7e058c55829dfa55b4185d12bcbc9bb0770d1580371f2f00e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701462285, "uuid": "e64bcd5b-1999-4d5f-a0d6-9b1bae3e9a07", "comment": "Malware payload", "value": "fc0529bd7398d88234648b190a060853f1b72166", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701462285, "uuid": "f8116882-7bc5-458f-a32e-421c3178fc9c", "comment": "Malware payload", "value": "807f795393648a49d676ca3736b6f94bb990db4c328ba2af380cee0b31465e6c05bfac3e40f6132022ab3a10e56d9701", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701462285, "uuid": "bada399e-737e-4bf7-8895-2292edcbc273", "value": "T153813AB496B75308FA043F778D9F4188B84810F93112405A2AF296686F9CBCD1FBA17E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701462285, "uuid": "d62075f9-5d8a-4418-9f75-941d974db7a2", "value": "96:vGf5sFyWTT4iQ+XFe21INe8ulEsHcffLpempfYOry/gy:vGf1WP4wFUNe8fsHcXomphregy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701462285, "uuid": "f3e43260-5102-4ba6-9d0a-3f8fb90fd578", "value": 4064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701462285, "uuid": "e4ca50ea-099c-4129-814d-8f6520f6906a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701462285, "uuid": "6300626f-88d4-4d90-b99a-dc73592bfd44", "value": "cve-2023-45124.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5db61a-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701403502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403502, "uuid": "17e2a3e4-a8ed-4fc6-ae5a-d9540d139e99", "comment": "Malware payload (RedLineStealer)", "value": "eaad66db4f0065db8b94dd32d6995023", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403502, "uuid": "b6fcf7f6-12e2-44cf-837e-b9f7edfa368b", "comment": "Malware payload (RedLineStealer)", "value": "818548554a542cca316c3c496473effc71bc26da3bdb9a7c72d4f955dc29f9c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403502, "uuid": "252a71c6-79b1-4aed-87f7-c3315544dfff", "comment": "Malware payload (RedLineStealer)", "value": "7f0749d506a50d27a7b0b441b9f31e19d26b237f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403502, "uuid": "241fc7db-821a-42eb-b67c-d291279f43e3", "comment": "Malware payload (RedLineStealer)", "value": "e77f7a2f7f74435b1c8419e3bb01fe7192fe7278fb006b5fc70fa6075b547413b7c752dcff87346691a0b29bb1b59eec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403502, "uuid": "c144e72a-b8d9-484b-a428-94483fdfe867", "value": "T11495127ABB48D154D81DF432B41EC5A04FE35C7EA49E5D93208C7B9EAEB22F0091B635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403502, "uuid": "9e0bc269-be3c-40c0-af3f-005d82d7148c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403502, "uuid": "d8e251f3-1158-4fa4-b045-7da46f6586f1", "value": "49152:WTghG09oLP5OPevOYha8rOiBlbVB3AwU:Wshm5OPeWYtBBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403502, "uuid": "f9580fe1-fcba-4307-9cd4-1ba9fe56a2dd", "value": 1903104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403502, "uuid": "6aa074ad-cde7-4fc5-b8e1-101ab634a880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403502, "uuid": "89e4a72f-17b4-4dcc-a3d1-0cd7a9736ea8", "value": "eaad66db4f0065db8b94dd32d6995023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2018174-908e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701465330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465330, "uuid": "0747e0fe-7495-4d8f-a27d-ce5efa08ca46", "comment": "Malware payload (LummaStealer)", "value": "14b3e55d2776df8a4744acf43fcee4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465330, "uuid": "6f01afd9-8c84-4a51-b5f5-6bb56f156180", "comment": "Malware payload (LummaStealer)", "value": "81a24987ee32d3abcf358e33b8a4806d7a8516a67ca19efdcefbe26a7e736586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465330, "uuid": "1e516dd1-fe52-411a-bf9f-95c16c7658a7", "comment": "Malware payload (LummaStealer)", "value": "3798f0359f1f6ce4a2608e7c48f4708cfece1683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465330, "uuid": "add63e58-5068-4a2d-bf79-ffad4e774217", "comment": "Malware payload (LummaStealer)", "value": "8c7b3d6ebd52be928ee93963693b1f2ab3e34262f05f439f06a0c35bd0673207d2b38f9762b787c7edfaeac8f0365c65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465330, "uuid": "9481d760-fb21-4459-b0b7-c9dc003852ed", "value": "T103546C1352E06C60E5664A328E2EC6E8661FFF508F3D7B9B13546B2F19731B1C666F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465330, "uuid": "cd2a23b0-6445-4000-bf33-e68a8eef74fb", "value": "d3ecaa3ff256d295d638233f7023beb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465330, "uuid": "a1bab7ec-4a84-42e3-bcf3-5516d3168e43", "value": "6144:noMxkL98sV9aTBUJp273h8W7KiIRrKbzBdup6:noR9V9aTBUfIxtejkBgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701465330, "uuid": "a3c0824d-5510-4535-9788-a011e36afac5", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701465330, "uuid": "646c5d79-c430-4922-88fd-1372c1d1caee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465330, "uuid": "49528c08-7556-4d07-ba9f-45aed592fac3", "value": "14b3e55d2776df8a4744acf43fcee4cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c410e9e3-9063-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701446866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446866, "uuid": "6c6853bd-7ab8-46de-8df6-ecb004efe484", "comment": "Malware payload (AsyncRAT)", "value": "30378680f9c2d3b061ef60040018c4f1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446866, "uuid": "3f3f7880-24f4-4068-8d11-26385ba4a33d", "comment": "Malware payload (AsyncRAT)", "value": "81bbf492816fdf74123d81ae5f01d85764f9be418fe4930e7c569fcdff1b3787", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446866, "uuid": "a0c81d3f-fb04-4723-a776-b0f72ead9664", "comment": "Malware payload (AsyncRAT)", "value": "9d04d51e0aaebd285158afb51fbc7ffbc649f636", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446866, "uuid": "be88bf51-b648-4bea-88a9-7bac58efa7ef", "comment": "Malware payload (AsyncRAT)", "value": "761e7e1722d519a1f6f46549ccb8983a1d3e242679cea13eaaae538f998ca57abc99e47c71c270f8f652583f1ff1348a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446866, "uuid": "7ea7b825-92da-48d6-8daa-0a5dd5c9ef26", "value": "T121235D4037D88136F2BD47B4ADF2E64582B9E2676903CB5D6CC814EA1B13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446866, "uuid": "c4585063-da1f-4138-9f3b-c1055b97edf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446866, "uuid": "a744e2b7-b41c-4582-9c7c-dc39982c5c0d", "value": "768:4q+s3pUtDILNCCa+DiptelDSN+iV08YbygeGfjYz4dCvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1RjYzMCnkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701446866, "uuid": "3dc6fbbd-a5f2-44a2-a3f2-516d365153a2", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701446866, "uuid": "f74f95b6-fefd-4906-a98d-3c70f79ba6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446866, "uuid": "c48f5247-ee08-4a7a-b341-78f439925235", "value": "bScr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4ee7c6-9041-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701432246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432246, "uuid": "25ac589a-9b9f-425f-ab2f-51165971e18c", "comment": "Malware payload (RemcosRAT)", "value": "14e62f6b8877254660d0fc2cd8c6fb3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432246, "uuid": "698771a4-6007-4ca8-8b8c-09de9879bcc9", "comment": "Malware payload (RemcosRAT)", "value": "81c7aaa41463ab95e180bdca4997b5ef54a97b107e425ff07bcb6edc8be52727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432246, "uuid": "05e3c71d-757f-434b-b477-f4650441a41e", "comment": "Malware payload (RemcosRAT)", "value": "7d359533a36396e5a0005bbd979eef7165c216c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701432246, "uuid": "6366180e-0c66-49d3-980d-693b324cb387", "comment": "Malware payload (RemcosRAT)", "value": "3212a75820700b6e31c104fa6809beb24fe71e25e8d9cbba137456a333ba495653dff3d669c198d7af4892473e919a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432246, "uuid": "8ffeb578-4b18-4db0-b68f-f88bec5ce02b", "value": "T1008423272DE28A36D745C7F100B3A67FF3378975812346434F805E3653B2D6A9BA5127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432246, "uuid": "727f6006-c7fb-40f1-85be-a92f9d8448d5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432246, "uuid": "8d3371b5-f6af-435c-9aa7-8ec3f3b9f742", "value": "6144:P8LxBsYA9YEjMVUa4/qxZ6grzhWqu7F/WMQ7zX7hLFe/d9iKCd1f8SLWWXx14z4Y:xYAF2UTCxIOzmRVQ7zX7BCd9mOSCWhCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701432246, "uuid": "6e276db0-5fa0-409a-bdb4-f81f374634db", "value": 376017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701432246, "uuid": "ea668d02-61ce-4e1a-9a3b-98f5b09aa086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701432246, "uuid": "05046e8a-4dfe-47d0-a109-93d09743a76c", "value": "FACTR876500900087000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc3ccce-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413304, "uuid": "8ba6e898-fff8-4fde-9228-fcaaaf23a38a", "comment": "Malware payload (AgentTesla)", "value": "66bf2e596e00b818198a8966fc6cc177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413304, "uuid": "9646c47c-d26d-47de-96b8-fecf1cb03c5e", "comment": "Malware payload (AgentTesla)", "value": "82364f1c145709d6e5ab34a718fae2eef082f0b3d174a90d41d52c1e149ceafc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413304, "uuid": "c5c4d834-cb30-4e0d-a592-4919ee70b472", "comment": "Malware payload (AgentTesla)", "value": "69573a8c25d3191045f93dd2c9f577455e46cecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413304, "uuid": "f2ba32de-3318-4477-ac00-bb6fa4beb062", "comment": "Malware payload (AgentTesla)", "value": "31d7c0d332235ed30706a185355f409bb47a004b6eb31caa45d740f81f789a75b65a04bb9ee43e861c07317ebb1aa4c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413304, "uuid": "4722eede-5c5f-457e-8281-8eacf9910c34", "value": "T14905DF143ABD2F13E07957FA0822252007F965AE103EE6D81DD171DBF5B0F172A86E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413304, "uuid": "0ffe489a-d4fc-49f9-9d09-e06552d05c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413304, "uuid": "2486fe5d-319d-4ab0-9428-3cf8060d2b4e", "value": "12288:AeXQmbCpZKPzUftUshogoBJQkzFeEFC4M0qG5Tl:OeUftFhoFPFeyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413304, "uuid": "7e113065-c631-4fd2-bb12-5fea11616b3d", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413304, "uuid": "2bf8b565-bc85-4818-b4b2-ae0c83562595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413304, "uuid": "6a80ad86-2fab-4f83-b94e-6e47bbc96609", "value": "Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231128_84014609_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b48116b-9014-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412625, "uuid": "406ee7dc-0fb5-4c3c-97c3-8b6216e001a3", "comment": "Malware payload (AgentTesla)", "value": "1cced94c2f3295856386a392a325da66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412625, "uuid": "44cb63c8-0e74-4e7f-9abe-20b53c4be9ad", "comment": "Malware payload (AgentTesla)", "value": "82654c49112053c84ca03dad9fe70453d7a0565da3b0ce398cb884807827f992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412625, "uuid": "d9e5a731-de2a-4c78-8992-f7ebef46212b", "comment": "Malware payload (AgentTesla)", "value": "dcfae48899f023345cc40c719c44667901800915", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412625, "uuid": "8ef46c57-52bd-4e09-9e6e-e47716eabc03", "comment": "Malware payload (AgentTesla)", "value": "2748d4f96ec7b9adc86a961d0790cfc5bd179e6487cfb1913d1609a4a7b7e391d42f506c52008165f315968c57a5e358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412625, "uuid": "1ee75a0e-e706-4076-a32e-c2fed3b8c251", "value": "T139D4239E9F234C6EF61B297120014C80AB477D34587D23D078964E6799E73FA9A68CE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412625, "uuid": "e74c1a6c-8c9b-41c8-9d52-cf0dec5dbadc", "value": "12288:8qDEDDicPcVmotix40XvlFPGAAvjh6zIFS3iXb7Ze94yaoTnkcu7HJtGUNwN:jSDickVV7cDGt6zhiXICyJ4cCHJtjN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412625, "uuid": "6e6b8b65-7693-4dcd-98a2-27adcda5ab7e", "value": 618836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412625, "uuid": "c93a16e0-a0fc-4cf0-b502-3abc486b83c8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412625, "uuid": "5b203b36-c4aa-4276-86b8-8b6363807f37", "value": "Nuevo orden09.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976365bb-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413290, "uuid": "97d1d100-9a67-4a86-849c-f3ba00b915e0", "comment": "Malware payload (GuLoader)", "value": "60011dadd611f785dc861521f4a46415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413290, "uuid": "77f0fe1c-1f4c-49b1-99c5-c6064f44995a", "comment": "Malware payload (GuLoader)", "value": "82fd233965ae1f0eefd1dd06a8a8979ba250c53275593b031b35ed014f42ca8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413290, "uuid": "7f492db3-834f-43f3-b0f7-c20c55d28325", "comment": "Malware payload (GuLoader)", "value": "24747cd72f57e84bf2828bafd02663414a56dc56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413290, "uuid": "1aee4907-c503-44d0-8ac4-96f313c444ae", "comment": "Malware payload (GuLoader)", "value": "5c3f013a1cb0b945e2f922c373f7dfcea178913f35ca6c3d1a99bc58f5889d984c5fb8145c0952827a8e8398ea65481b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413290, "uuid": "8aa27696-74c1-4784-9e20-fa83c490b29b", "value": "T166E4CF92358A366FDC2F8A74034FEAB62B755CE0B392096D4F40361D4C3664A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413290, "uuid": "09b7af41-dffd-4bbd-9bd8-86c20280aff3", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413290, "uuid": "d82496f5-4c1a-473a-8ef0-b492209aeb9b", "value": "12288:ucqnhe2ecQez8N4/aw9ldx+LG1d2mxuXgAa/y1dm17zOckylak7iI/dKX0HOS:uPhemQeV/awtNCx1CKdOT73dy0HOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413290, "uuid": "4f3584a8-6547-4dd3-86ef-191013f97e76", "value": 685280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413290, "uuid": "2a788fd0-cce9-482f-ac50-4241bd9748c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413290, "uuid": "299daecd-297d-4662-8f53-53a02b79dc56", "value": "28112023135515pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce80863d-9054-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701440441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440441, "uuid": "f0c4c2ca-e430-4e31-a923-d59cd5097146", "comment": "Malware payload (AgentTesla)", "value": "bb3154deaa6ca591e3fbc500413cd7ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440441, "uuid": "13911715-5ae9-4a17-a040-51051f0ecb8f", "comment": "Malware payload (AgentTesla)", "value": "838f85e54553bfa5d9d22fc3a2a4348034ff566ea0c5268853b81ab976ee45de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440441, "uuid": "a425abce-8b47-487c-94b4-9678f2fd64c5", "comment": "Malware payload (AgentTesla)", "value": "c75855e2d2adf272a761256feb89688fb9154dff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440441, "uuid": "5a11396a-d94b-4f59-a70d-2c4f40c074f0", "comment": "Malware payload (AgentTesla)", "value": "64b640e2f2a432370256433dd6b42fc29b7f2a2bb2df4e72964d9df89d85e6efae26bc04f222fa431c8d8798771751b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440441, "uuid": "c103d151-05de-4083-846c-dbe041d9ead2", "value": "T138F4F14233AD9B03E4B64BF9249170A483F6629E7075F2591CC235CE50E5FDA4AB0ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440441, "uuid": "3332f409-bcfd-4ee3-bf11-5c2057045b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440441, "uuid": "c29b98e7-c448-4d64-8d76-18f0701e0402", "value": "12288:KIe6QH05HCmtbC+GBxhBWgxRaA9xEm4E8rQWKnn4lISR3Zg4M:0HACmh7GB3BWdU+e88n4lISR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701440441, "uuid": "4154918e-06d1-4f6e-b299-da22aef10ee6", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701440441, "uuid": "0d08c30a-b61f-4c75-9f02-6678b322a846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440441, "uuid": "a45df556-b243-4d49-9460-6d049d38f41d", "value": "SecuriteInfo.com.Win32.PWSX-gen.15872.18159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e77ce1-902c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701423090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701423090, "uuid": "7d453c3f-8748-4f2e-a0c4-ee2152e6f4be", "comment": "Malware payload", "value": "9711ffe3cace7b8f367e68c2a42e59fb", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701423090, "uuid": "471d577c-cbee-4318-9593-c0340c19b287", "comment": "Malware payload", "value": "83ca53918af3ea659d767e489a1e42ea97879e3e534f68c4edc7d0eb77f44204", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701423090, "uuid": "c563a1b6-bf0c-4120-9fc1-fe52c8189b3e", "comment": "Malware payload", "value": "06a412ed34980a7ab5abba3411254165cfc4a19a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701423090, "uuid": "b8b738a2-353f-4c33-bacf-04b7c2635def", "comment": "Malware payload", "value": "55759ab9f651034d1b91e7ae7c5bd7477d78ee2b903772e25f4aebcf9faabdf16da1be5f64169923b2c16aa830c30ff4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701423090, "uuid": "c9a98147-53d2-4d64-baef-2373c6de1197", "value": "T1AB425E7163351E16D3155A34BB4B387295B9790479B8C685216A7E2D0FFF60C1720BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701423090, "uuid": "4666649b-f6a3-4385-bb98-a86ec2a0b65d", "value": "48:JMWgA0AQRlEFlErlElx5sL6y64dA3MlS5qf2nK+xGMYsOnSyN+5vvsbsA1AX4SSv:Jfd4I4daMg5qs+ndNqxIPw6Z3EuF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701423090, "uuid": "282fe043-e707-44b9-bfde-e033fa9f8bb1", "value": 12032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701423090, "uuid": "8e13fa33-5c29-4b83-9f30-275a573f91d0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701423090, "uuid": "03f4b7c7-b412-45fa-98e7-c34b3e22885d", "value": "MoHA Border and Immigration Section Order.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eacb507-9078-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701455608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455608, "uuid": "1208bb85-caa1-4370-b251-6b32ca5e9af4", "comment": "Malware payload", "value": "04dd54529911d1b5e5b7a2a6c265a263", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455608, "uuid": "c20e8aac-94b1-4b76-be6a-5aedfc76e4fe", "comment": "Malware payload", "value": "845edb61fbed134ecb9a924cffc17bd9888d3f6039dc94898e34a71d5934443c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455608, "uuid": "db7a839a-92f5-4ca0-9cca-2b294ae5f7d2", "comment": "Malware payload", "value": "61ac7c3f4ea855e68aa11f1f988531ed25c83859", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455608, "uuid": "30a22afb-fa90-445e-a55d-d099ad967abc", "comment": "Malware payload", "value": "3bd5f60e337ce24a6dc845de858e47570553d440969d932531aefb6082f17262bee08fd1affd807ed67fe90d8867e4f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455608, "uuid": "2a16ccf0-b972-47fe-adb3-3aa990b71a11", "value": "T166C3194AEB408B43C4D22B75BBDB425533239B54D7AB23055928BFF43F867AE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455608, "uuid": "a842bc1d-63b6-4bbd-a5aa-3558b5ce9552", "value": "3072:16aSNYwyM6VfOLZmpH+lSCxlM/9FnqoUO0w:oaSNYwyVftelSC/M/9VqoUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701455608, "uuid": "39aed0cf-a8c0-4cee-b065-aa0b0df246cf", "value": 128033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701455608, "uuid": "55b5a636-161c-4291-9643-f68f61bd369c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455608, "uuid": "d8e6ceef-a7d6-4096-84be-da98819dfb15", "value": "arm7-20231201-1833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1702e9e4-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701403196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403196, "uuid": "a1578ad3-03eb-4250-8829-2d020ffac736", "comment": "Malware payload (Formbook)", "value": "202ff26923cb44846d9dc5a223acfae6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403196, "uuid": "1abbef47-9b47-4602-8668-0e7e9100c5ef", "comment": "Malware payload (Formbook)", "value": "850d92c9f57ca005066c92f6cb9d96340e2da37398d8862316d45c8e6a1f8882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403196, "uuid": "d3643e0a-c913-4931-9a5e-a4b5cfeceae9", "comment": "Malware payload (Formbook)", "value": "c6df1fd2ee803d88164143a7c4b014bf97eb5598", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403196, "uuid": "8a497908-9e6a-4eef-89a4-15caae7c36c9", "comment": "Malware payload (Formbook)", "value": "9a1fe748e7b7142fdbf5b26ed1a76115cbb210b2bcab68ea8365d01ddd56275792fb00fd851655b20b471c9d83d7dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403196, "uuid": "fc62fd40-a858-4115-b303-6cd137995af7", "value": "T14A33591CA7CEAB23C1AD467FA4E377814375D1B6E34BE78B2CC8422415977EB8801A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403196, "uuid": "d92b832b-b326-4a26-84b7-d4fc42f8666f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403196, "uuid": "b1688f70-3867-4942-8ed5-edaa32070075", "value": "768:gsqI1O6YW4wHKMPpj3srDFBOKWKIovsHShbAGrTUUEyZbZCGlJ2bVGRaBWF:9LQ6YwTpj4PO1ovsu/UFGz2bVGa8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403196, "uuid": "307875b4-cc4c-4f2e-b138-c1e9cd1465e5", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403196, "uuid": "1640f712-f288-456c-9fd6-fea74bcab84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403196, "uuid": "7903cf64-2244-4fa8-a2f7-b70f400b5ab1", "value": "202ff26923cb44846d9dc5a223acfae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf94fd91-8fed-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701396177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396177, "uuid": "d671087b-fb35-4410-b8e5-474380dc29e2", "comment": "Malware payload (Stealc)", "value": "fb6c569fc5072a16c203de7cad9432ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396177, "uuid": "230cd83a-8540-4fa2-aa16-c7d7857ad60b", "comment": "Malware payload (Stealc)", "value": "854454fcf6cdce3223bea2e9cabf030047d7f81537eda0e1ca94baff43cc59e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396177, "uuid": "6b077837-9fc9-4a3f-82ea-665475a438fe", "comment": "Malware payload (Stealc)", "value": "771ed1e38da320f246d4f93af86ca9682d75f255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396177, "uuid": "88c14a41-c29c-4e93-b49c-fa754961c3f6", "comment": "Malware payload (Stealc)", "value": "8ce8912b5f24aea4babc4786cec7b65d10151709ce599166371851e3502107641217887a32cfac953f2a605a7adcbb09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396177, "uuid": "17f788ae-eb3e-4375-b000-a385bc0c5532", "value": "T1EB64D64392E17D86E9278B729F2FC6EC771EF6508F497BA922289E1F14B0172C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396177, "uuid": "821641be-549b-4528-b5e9-da620c73b231", "value": "0bd61e688135eda02fcf13008a67a440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396177, "uuid": "bd161982-62c1-49cc-a79e-fe00c4422d3b", "value": "3072:cTKdV3O3ijFgJRyiulC629uyN91NM2xLru5tSiMu63jXdo:hLO3wFasiuw6yuyhB+qjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701396177, "uuid": "0773cd72-63dc-4c56-9b52-50316507aa98", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701396177, "uuid": "2a88959e-03bc-4618-a88d-f873b2d46b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396177, "uuid": "ee59d4b4-86fa-4e5d-94a9-d1268dd988aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c49e9b-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413321, "uuid": "9dcd63e8-4e8d-4609-9b2a-61d2c791d975", "comment": "Malware payload (GuLoader)", "value": "52805a3c07ecc9bf6840e89bd0aa287e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413321, "uuid": "6f3df4a5-ef99-486f-afa2-1621bda9ed72", "comment": "Malware payload (GuLoader)", "value": "85800855fe13f4eabcc471486d2c267794ef62962f900bf4f4a80d6461913211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413321, "uuid": "5a150f1e-f17e-4427-89e1-39da58a5fff9", "comment": "Malware payload (GuLoader)", "value": "c635295c2581d25e456e465ea2e99fb70ee3e53b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413321, "uuid": "b11d524d-53e8-4433-bbd8-0f9e0ddc9673", "comment": "Malware payload (GuLoader)", "value": "f68a269457235c62ec498e1bf97718fe30c0339d4a246ddfeaedb9a1b2d325edad821e5f9e2144e1c2faa452e13e129a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413321, "uuid": "9e493331-6f36-4803-86d9-c45fab60c996", "value": "T136E422915224C4EBC0686D71C5A63EF7AA35BD02FC21BB4763203E9B7A35352E4593F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413321, "uuid": "f1499363-0c96-47a9-8fe1-610b344a0ffd", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413321, "uuid": "eef09dda-52a7-4e34-9ea6-90629e351e6d", "value": "12288:fBZEwWqf8chI/XEhBX9iugcjG31t30GvABWEuO4LIEtv29lZsDRn2:Dhkch9HEt303WEa20Rn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413321, "uuid": "4de90854-b338-4de9-becb-404be9cf1fe3", "value": 662848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413321, "uuid": "9d2b1717-fe51-4e29-84fe-16ea03726c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413321, "uuid": "da7ccbe3-1f01-4db3-ad73-ba85d67e7fcf", "value": "HURNER Schweisstechni L.L.C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5510503d-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454840, "uuid": "2e8a1d2d-09a3-454f-bc65-9d7a2deff73d", "comment": "Malware payload", "value": "1c8048d0829876198d434138c4f57305", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454840, "uuid": "bb8e02d3-4b0a-4f4e-b999-f379e50e74d2", "comment": "Malware payload", "value": "86486d4719c75c1df9d78feb1226c8632bc2aeeac2c4edb73fec47e90e92caaf", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454840, "uuid": "5c00d987-95c2-47f0-9780-48c7ab5407ae", "comment": "Malware payload", "value": "36b1715c3d34410dbe6d917cfa7332d546f02fc7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454840, "uuid": "73aef38b-365d-4bd8-bd4f-dfd1b9f3394a", "comment": "Malware payload", "value": "235aabc1fbceadff445d62fbd36d4dd84b86aa387f2b0a20a6831ad24df9ba4a7a045c73d79b0cef74d457ae51d19629", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454840, "uuid": "30108be9-dd66-49d3-8418-a6612b9b230b", "value": "T1F152CA56FD9B4A90F81E973152DB8A2B37333C20D75B8A46361E331D1FB95909503A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454840, "uuid": "83b4dd8d-9c29-4cd5-9543-0537b2c7148c", "value": "192:UypMp8p8p8p8rR2248hhPPPPPPPPPPCOaUf:wqqqqrR21OaUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454840, "uuid": "ed8ba6cd-059c-4303-88bf-9fa1250f9054", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454840, "uuid": "ee4dfdf4-e587-476e-a70d-a7e40770924b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454840, "uuid": "51fa93af-4d4a-4df8-918c-18855d033a73", "value": "SecuriteInfo.com.Trojan.MulDrop21.58103.1868.3755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda5b2b3-9008-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701407771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407771, "uuid": "cb0d242d-177d-481b-a8d4-70ef35ed2693", "comment": "Malware payload (AgentTesla)", "value": "4119497e585d3a6b2ad56e26ea7420e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407771, "uuid": "c6c2f108-bc9d-4d74-86a1-7212d271efb1", "comment": "Malware payload (AgentTesla)", "value": "866449259001c84fcbdf518e90778328c048f87bbe98ba374b949af951e86030", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407771, "uuid": "313a8021-a269-421b-b6aa-aeb3a3261a45", "comment": "Malware payload (AgentTesla)", "value": "4e7d8c8e38679d8afe579ad6e3bd4d56fc57cdf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407771, "uuid": "ae73b9cd-7dd2-40a8-8189-2da07e6a55a8", "comment": "Malware payload (AgentTesla)", "value": "8ee086e5f5a440ce92787fb7aea1e197ca4fcee166194e9fe6b2042de6b558f8407bfe652b87f69b7bd400b91ff1a5e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407771, "uuid": "e89cf6bd-579e-4c83-8b2a-ef81e4ff8aca", "value": "T19EE41256339ED762C1BF9BF764C0451083B3B82BA4A4E34C4DD540DB1AB2B50E6A1FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407771, "uuid": "1a15de4f-89ca-4330-b241-8531dddc9679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407771, "uuid": "99134f97-5005-4509-b5a1-96dc0b6f868d", "value": "12288:lCaZJZIUGmDq+Hoc7BKhmolAYecsAf+85g3bp4/4U:tZJp2FdlAYecsGpi3bpO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701407771, "uuid": "869999c8-4af2-4fbe-8658-602ce731628f", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701407771, "uuid": "4c8c936b-a304-4bf7-90a6-09f526bc7d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407771, "uuid": "9b7db49a-c387-40d0-bb13-85bda9a61f03", "value": "SecuriteInfo.com.Win32.PWSX-gen.13596.7415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19494c6b-908b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701463759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463759, "uuid": "2ef81ad8-5691-4915-9ece-09b032332ac4", "comment": "Malware payload", "value": "889bfff147dacfd20ab4d8e7785b5e00", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463759, "uuid": "260f0207-861d-49f0-88c4-412be9c2da0c", "comment": "Malware payload", "value": "868a9c2ae24ddb66e98680c4e0f0f79fbe9022ea414e34762cb665d96661aa61", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463759, "uuid": "06c0876a-72d2-4102-9e0c-de82e267dc62", "comment": "Malware payload", "value": "7d5ccedb4b52b5114968b91287a25d61ae4db55c", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701463759, "uuid": "4bbe8d1b-bf3e-4a01-902b-697c1d7c116d", "comment": "Malware payload", "value": "cf5bfc90b72322a8a70185212a0868c3abf464a8e0218dbb5ea4644a0c8f1d33b456b239327e90001bc2f24d7a77e1e5", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "piratestealer", "colour": "#F1B774", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463759, "uuid": "959f8ef1-c4e9-49de-9c77-4270f27d4f8c", "value": "T1EE33EA158C6B151191B7869EA413F84BFF09A343C22A15037DBCD2843FB9596D2E8FBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463759, "uuid": "535108d4-3c92-4b36-bb52-17f7dc74d32f", "value": "768:mjDKv8SRFEIXK4R464G87VU/X4C+VJyj/s1RDT8D79Rz1txNc:myv8StKQGNJyj/ODT8D7NtxNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701463759, "uuid": "b8236f88-2945-4546-8344-b037486fde00", "value": 53345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701463759, "uuid": "a8393644-d274-4c02-a9a5-21334e1f9d27", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701463759, "uuid": "9dd750a0-6e33-4768-9574-3b9ad6ea2796", "value": "stagedLuna.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ab7bbd-8fe1-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701390767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701390767, "uuid": "22eb190d-6e84-4844-a89a-6a83b2168a12", "comment": "Malware payload (Socks5Systemz)", "value": "035b985d77215c95412efec5a1501e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701390767, "uuid": "213515d2-7f23-4845-ae5f-e60c8fbf658b", "comment": "Malware payload (Socks5Systemz)", "value": "8879ec2ac0aa27a8030bfbdce08d9ef1d59bd8f48bfc767fe83ca40703de33fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701390767, "uuid": "086444c5-2265-412a-9e53-2794699a2c9f", "comment": "Malware payload (Socks5Systemz)", "value": "2b66ca35cbb57087a0722a6d39f187b62372082c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701390767, "uuid": "fc28b682-c018-4c0b-9c4e-fcc20bc023bb", "comment": "Malware payload (Socks5Systemz)", "value": "e030727e13959a29998004053f59042b70fb0d06453674f6ef31d06805362903c86193eda967f982712c588fcd5e721c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701390767, "uuid": "6823d6e8-3047-4abd-b671-39888f88129e", "value": "T1A0E533414A5BC4B0F671EA750FE3DA80825BB9A334311DD991DE4F5F6B2D382B82B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701390767, "uuid": "7cadb9f5-dab2-4aa9-af6e-6167973a063a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701390767, "uuid": "c9e869b2-6cbe-431b-acfc-f759e2bbc041", "value": "49152:d22LK66sfh2ceGIkPOdSQcjWuYvaXqAv48k5NitFUKa37NxMzr02E/sI:I2g+qkmRcjWGXqAv4DNiDkAzr05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701390767, "uuid": "4dee738c-ca77-4b9c-80bb-3cfcecee40ba", "value": 3217801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701390767, "uuid": "f83e0f4b-2cf4-4869-9345-8518a7d9cbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701390767, "uuid": "23fb0b92-b08e-4278-b5e9-a61ead900a41", "value": "SecuriteInfo.com.Other.Malware-gen.9594.7436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ec1b69-9076-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1701454868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454868, "uuid": "0c63fda4-19d4-45ec-bff2-211a5feaae1a", "comment": "Malware payload (Adware.FileTour)", "value": "4d4933918c5f4dc8294ef986cb8ba1b4", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454868, "uuid": "32e81096-a5c3-41fe-be6c-edbba5b8c7e9", "comment": "Malware payload (Adware.FileTour)", "value": "892dc1607407dedbb30f95ac92cb326a5c4f248f5e8981343bc84e4f834d8f52", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454868, "uuid": "9e990725-0d3f-419f-9ca7-f1ca075534c7", "comment": "Malware payload (Adware.FileTour)", "value": "edc47f6a0fdcbf870e456e3f9fdf6d02aaebca8d", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454868, "uuid": "f6b930db-409f-48b7-990c-bdaa47dfd45b", "comment": "Malware payload (Adware.FileTour)", "value": "74ee6d39df43c9714f29b917a2e2c460562774fc81d37a2122422ca9901c8256b05a1905345a2df9c14f276e14c908b4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454868, "uuid": "f6814ae5-a58d-4f44-9350-836035ea9026", "value": "T15575335356D5DC39E160A5702C3FE0E25B2A7E93AC3C217C75AEA03F4E0A478E546B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454868, "uuid": "9e13f50d-500d-46f1-afa3-b3807fc959a4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454868, "uuid": "669d26bf-a46c-49e1-993d-1997662bc739", "value": "49152:5aJKrt9QyqLMUR/0AMBGVZrdzxEBvrx8MinXBgJ:QJKhKyQMURsAMmZCrWnRgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454868, "uuid": "eee963af-d80b-4688-946f-d88a538bb861", "value": 1649291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454868, "uuid": "2889e482-a8cb-40ff-997f-750ecc3be3ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454868, "uuid": "bfc9fb6d-204b-44f0-8e96-9e99111a1098", "value": "SecuriteInfo.com.FileRepMalware.9853.10727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87770f3a-907e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701458360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701458360, "uuid": "1dfe443f-b38e-41e4-941c-8e1e9487fd5f", "comment": "Malware payload (AgentTesla)", "value": "6edfa183afb1a62fa8dbea76609dc8ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701458360, "uuid": "bba3d8a3-94a2-4574-a500-dc8d6038425e", "comment": "Malware payload (AgentTesla)", "value": "89b6d55948f56a8cc40e24a46746384cef20ed8aef3fc961953235b51f48b936", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701458360, "uuid": "96a15423-3138-4208-884e-380e1bd41f65", "comment": "Malware payload (AgentTesla)", "value": "cb4c8aafd9fd91e1afdf90403c6deed0a6f24d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701458360, "uuid": "c72ead12-d86f-4a29-876c-1a27f28163f7", "comment": "Malware payload (AgentTesla)", "value": "9be843be97ea5ca2c983e61e6fcc693eae19979ddfdc571b93fc14e7581f833416561890455d2e5db23b5dc168dec132", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701458360, "uuid": "70826ba2-341b-4da8-8149-85267c3c951e", "value": "T1A5264905FA105CF1CD5D12F3A6B786042E73CC45A25C9B9E27E6B1DEE6381D3A40B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701458360, "uuid": "53233a3c-a370-451b-84d5-044d543b0bff", "value": "49152:VmBXOVvMKANvffGGRUWgbC+Sb/8ML5cCEuGtobl8UW:YO1MKLjCXzcCfXbl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701458360, "uuid": "f67bb8ff-f026-452a-90ce-5d153e684393", "value": 4618752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701458360, "uuid": "dfd4e090-0a89-453b-ae2a-5f57ec942941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701458360, "uuid": "20d93afd-ac4e-48d3-acae-ba26a72cd809", "value": "SecuriteInfo.com.Trojan.PackedNET.2228.20274.21667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e26aeb-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454841, "uuid": "7c9f65ce-c5c8-4070-b4fc-43a95fee716f", "comment": "Malware payload", "value": "4a93f591a3a3f054adab0422b4108cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454841, "uuid": "75ecce0e-3869-4192-9c9f-ed2f1393392d", "comment": "Malware payload", "value": "8a95fc3285c7b7c73886e4470319b05803762b06cd498b3dcecfd612f380d88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454841, "uuid": "55abbb3e-04f0-4d38-ad3b-f4cb2a7db798", "comment": "Malware payload", "value": "636d167037941337a1ffc140fd2cf49482c988b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454841, "uuid": "50cccd94-3394-47ce-b7e9-b05e45fbfca8", "comment": "Malware payload", "value": "3edf90838e1e386768fd4b203bd9861fe0657a365241770337710f4ee5b9a507e15e5fb27720577178ef21ea9900b87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454841, "uuid": "66e51b37-04f6-4e8c-9063-8973f54a316f", "value": "T186A5A3FFE287EC91D5733C30849E23F267D06D019B26DA8369AAFD142E3578B9126147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454841, "uuid": "9a53724a-64e3-4040-996e-1ad2f30bb180", "value": "49152:yONuY3FC3TZoooooooooooooooooo5oooooooooooooooooooooooooooooooo8:RtC3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454841, "uuid": "9475753b-4320-49f2-b7b3-560cb58d9395", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454841, "uuid": "ca10ab5a-46c1-4491-8e1e-f8546e49630d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454841, "uuid": "ac2968ec-c1ef-4613-af67-398a59a6759e", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.13380.28301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26feefe2-906c-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701450468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450468, "uuid": "f9b3fc92-82c0-4cf7-87a4-ba627456a127", "comment": "Malware payload (AsyncRAT)", "value": "b58fa014257635941fe9337b005e5392", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450468, "uuid": "1946bb99-96c8-4daf-9332-7e23c1ea9971", "comment": "Malware payload (AsyncRAT)", "value": "8a9c1f6cbb3c007686dd49723babb95afc94933aabf1c2012e395ee3ecf3a65b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450468, "uuid": "df19653b-15bd-446c-8d1d-4d068dc4a032", "comment": "Malware payload (AsyncRAT)", "value": "1fed977486b75dbdba3d1f148b180a4290fef106", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450468, "uuid": "18e1824c-0724-466f-9679-d22be47ce45f", "comment": "Malware payload (AsyncRAT)", "value": "79990da87f6d6fa60a25aeeac0b842ff26e4f15cbec41f0889b3abe1745129d019c454270679bd3698343555e4f08293", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450468, "uuid": "ab0ad90c-4405-479d-b4b3-8bd3825528b6", "value": "T115236E4037D8C13AE6FD4775A9F2A20582B5E2171D03DB8D6CC824AA2B13FC596536FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450468, "uuid": "c48afb97-a90f-4e6e-9125-6baeff979861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450468, "uuid": "8d52a856-c2ca-4669-b8fb-fbdac5a8202e", "value": "768:oq+s3pUtDILNCCa+Di6liT8YbdgewKvEgK/JfZVc6KN:oq+AGtQONzbKHKnkJfZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701450468, "uuid": "8ae39662-c0d5-4ca2-8afc-639b74be7f62", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701450468, "uuid": "a7514a1e-8468-41f7-889f-54bf29cefb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450468, "uuid": "a93099e8-6d26-4c33-8451-0109185cf196", "value": "bScs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9305e8b9-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413283, "uuid": "b6cd2a32-755d-4143-9137-c3f885ca839e", "comment": "Malware payload (GuLoader)", "value": "a973cc6d8fad504b3945b735894459c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413283, "uuid": "c9f220d4-fd65-4226-962b-09af3b467ccc", "comment": "Malware payload (GuLoader)", "value": "8ba8368c1d2883025bac7f7a5c702ca93c4fdea100d97c26eed7cd6bba68b249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413283, "uuid": "84f40ab7-7e43-4256-803b-fe8ab2ef29e6", "comment": "Malware payload (GuLoader)", "value": "ae6067e95b30b789804d8ac05a600f05aa69be19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413283, "uuid": "ad2e17b4-e826-4371-8b97-f6894fa5a711", "comment": "Malware payload (GuLoader)", "value": "c1b7d1f5bade379f349a00c1c7230a89ce6757b49e8e27ee41b59ae6db16853578149cd20387c4110b571ce648da8b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413283, "uuid": "b63c10fb-0629-4352-8d0f-0105a303a1bd", "value": "T1F2E4BE9239C976AFDC2F4A34035FEAB22A795CE0B391096D5F40321D4C3664A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413283, "uuid": "eb56cf87-bace-4ac5-adc5-061a0465a532", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413283, "uuid": "ccec1fd8-e44e-4fd1-bbb5-95a1667cb5e8", "value": "12288:lcqnhe2ec4khGDsP+MCQ1hJqdm17zOckylak7iI/dKX0HOV:lPhem4khGIrCeqCKdOT73dy0HOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413283, "uuid": "e69726f9-b077-48be-acba-e3e6ac97ef34", "value": 661264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413283, "uuid": "0ca4d3e4-2289-48e6-9ad0-e71bdaaccef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413283, "uuid": "e875e09a-eea1-43d0-9f19-27ebf4c5b42d", "value": "1700827483949[1]PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f5f6d-9017-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1701414178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414178, "uuid": "03044ca5-2e92-4a6f-ade5-946022d6bbc6", "comment": "Malware payload (CoinMiner)", "value": "379e10ccba431ffa0366acf596670f36", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414178, "uuid": "91d2406a-b7d3-4800-be1e-7ea82207f671", "comment": "Malware payload (CoinMiner)", "value": "8bda45cc0b47a606158b810f9702ae4a114d53c5a818dbeaa9a8252a52daa7f8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414178, "uuid": "f05f873b-03c6-4d71-b9ae-11a4965a3b00", "comment": "Malware payload (CoinMiner)", "value": "432cee573e2368042f2fa901b058c578615d2a0e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414178, "uuid": "af2137bc-c35a-4c29-81f4-292107e3b1c5", "comment": "Malware payload (CoinMiner)", "value": "ab0a67665fbe8722a1fc3a14ae6c1ffe33b95b1c43b7bddb96a20ea27c5047129a5047ef624a6d7277b5c69a8002b11e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414178, "uuid": "5ae7cdbf-9d7f-432b-9592-da8262f64db4", "value": "T16D34BF2276D0C072E12768364961CA665B3BBCE29B6165CB37903F3E5E312D18BB5F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414178, "uuid": "a17d1ea8-e62c-4707-b56a-027226e4eebe", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414178, "uuid": "cd53231d-ee62-4ae5-aee9-5fe30f4d94e8", "value": "3072:2/5SVJWVD3ARzrspBqNMgOFYIvXAzt2moxo/BGlBIUlml3j6f1SkwvwCTR:CO+3IrMoSgOFYCAz4moxWMOz6fROT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701414178, "uuid": "99f893c5-50ec-44b8-8d10-d0149d822053", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701414178, "uuid": "a6397539-a878-491a-9285-18d6ec8d98da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414178, "uuid": "a399c5f1-1040-4884-948c-21fbd97e6cd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6044fa9a-9077-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701455288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455288, "uuid": "4a7fe7bc-90d1-42ca-b4b4-bac1bedb8738", "comment": "Malware payload (AgentTesla)", "value": "b3cb7b5092ec2f49be062a87a6335041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455288, "uuid": "2167f221-cb20-4717-9e67-a6970ebaf708", "comment": "Malware payload (AgentTesla)", "value": "8fc8d08ac95f945b863195ee3556c1e756754faff354db781a67a9323b4c06fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455288, "uuid": "255c4678-68eb-4123-a0d2-f3da7a73356e", "comment": "Malware payload (AgentTesla)", "value": "273ee251d431823cc65e1b9e177c34b36da3b578", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455288, "uuid": "f77db56c-63c5-49b1-8d97-2ea228ce8149", "comment": "Malware payload (AgentTesla)", "value": "49c17d1073d31c21ff758ef2f55df447be253ed7b19471fd89c863d9b1d50ad00b83d7a5ca13744f5d27d1915d97f233", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455288, "uuid": "480e99d6-d672-4217-9fd5-15ec4b7fd2e9", "value": "T17ED4A0D447D01957F38F0678B031826443B8F657B19FF746AE74A5E80B923C1ABE9A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455288, "uuid": "fdda9e42-3b86-45c4-9fc8-f69cae3e3098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455288, "uuid": "e5bbfc2c-a461-43f5-8f43-411f19b63048", "value": "12288:suod5zlZmSVaFl3LLTIhbH5TtOBoLFv0X1iMM0pwsNdRjH1y92Tneg:kzOSEXL/IhbHnuMF8X1iFsFH1y92ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701455288, "uuid": "66206843-affe-4c55-a2c2-49c81f5c6c5c", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701455288, "uuid": "e26411eb-85c2-4a6d-8e04-acedc9cf6682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455288, "uuid": "13a34d1e-ea50-4fac-8f3f-047d5b51c112", "value": "payment status.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca85236-9014-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701412628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412628, "uuid": "c6466e43-afe2-4153-a869-01cd3bcb73fe", "comment": "Malware payload", "value": "83e62d940ec62486773673608884d184", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412628, "uuid": "0f6a7a29-8c51-4e1b-9360-6775ed9893e1", "comment": "Malware payload", "value": "8fe0aa3ff5870358034681fb3f4153f42ec04101f4fc93b857154f81e5f8892c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412628, "uuid": "3c9fd02e-d7d6-402e-b797-6bbcfb03b6a4", "comment": "Malware payload", "value": "7a65b5e829f2df338b5700e826791d07f9357076", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412628, "uuid": "d0c9d168-d3ad-445b-957c-1bf1c5b380f5", "comment": "Malware payload", "value": "3bd54fc9ddf7d3bf9c4d24ce5027dda27b45b105a4a29bacf86cb8b51d9b1333598f3e3c4c1306402f19815c22387461", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412628, "uuid": "46aafd74-8560-461b-88ce-fcb235d5224c", "value": "T1BEE1191AC26204BCD76A353F60456281572AB6EB02AF5217353071DDBEAF1E30F5E3B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412628, "uuid": "3d69a5bc-8be6-4be9-9c81-676a08b4c19f", "value": "96:ZVXINTYcTjlMhVVCvkwQEeGIRf3UNaD82ZUWCB+mrPotVYuL9gye4R/rUQYF8/:vaTLxOV8vdQjm7WU+mrkYufe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412628, "uuid": "b475adf3-b1c7-4654-b430-8d6111642754", "value": 7179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412628, "uuid": "65aeafce-1880-4ffe-b0f3-4c08e92f5daf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412628, "uuid": "632c8087-64b4-446e-87e7-36627cd0fb51", "value": "New order Roch LTDA.-11-29.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d79893-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1701411756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411756, "uuid": "a9c40a3f-0ee9-4d78-b9f9-8207accb660c", "comment": "Malware payload (DarkGate)", "value": "6376c4e1fa2dcb1c73f178b675ea5840", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411756, "uuid": "88bcec26-6c94-44bc-9155-3744f0e567cd", "comment": "Malware payload (DarkGate)", "value": "90e38d684c63fee4e5d7bdd16c4409022bf9edfc7cf266b9e49936962ce37b03", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411756, "uuid": "f9fac701-8465-417d-b0cc-3d3367477f2b", "comment": "Malware payload (DarkGate)", "value": "c46e52b896bf3b53a6878d2b2386a9dc40377f19", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411756, "uuid": "c097edc8-0a6d-443c-893f-e51f3de01a1f", "comment": "Malware payload (DarkGate)", "value": "5fdb62e9992d447eacd3c68806a0417c12879f221d9b4d875fb854fcfe8ba0b69d3bc5c38aeea421280fca50b393d2eb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411756, "uuid": "17dfa7a8-fcc2-4ba5-be88-d4451794134d", "value": "T1C1D5AE32F6057D3BC4D40A3B443AAA090D7FE3432829DA175FF5889CC9BB442D67969B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411756, "uuid": "50f4d267-89dc-40dc-b237-0ccab1229460", "value": "c0c501cf3297e1f198923d5f84a50189", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411756, "uuid": "e8bb0699-2286-42ed-9db4-2be399c833d9", "value": "24576:dHZrhn7olvHbxA7qQCzt/s7ry5SnCo44Bg85mwFXyEOdT1ZAIe9ae/K4wMIQb6Vo:dpqt7sU9s7r/HvCKPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701411756, "uuid": "cef9b354-5455-43a8-9f25-7868025f318c", "value": 2843648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701411756, "uuid": "1d62651a-8bc6-4690-9187-4d2f85bbd2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411756, "uuid": "b1452946-2dad-4237-a9e5-c5f0821e8c8f", "value": "Lightshot(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b261655e-901a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701415483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415483, "uuid": "22cf39ea-1c0d-4dc3-9e0a-3b71b755ae28", "comment": "Malware payload", "value": "ee83d18bfc2f9a20443b2a97167436bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415483, "uuid": "037705b0-e395-49c9-b9e5-e325eaa32504", "comment": "Malware payload", "value": "911f02081b22872fd24ec9282f901ed0278f17a982a922bf50c969c9d80da99a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415483, "uuid": "7a0e4b9d-443e-49f5-9bc1-40ef8b8534bc", "comment": "Malware payload", "value": "ad844bdf4589e1643154bd44e2b2381919ab3af4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415483, "uuid": "e8dd11f9-4cdd-4f58-8bc3-c6e7d29709cc", "comment": "Malware payload", "value": "7b3fe59d3cb3386f30bdc87e90d89024d08eac93df8f9596048f6ee98557a933ca2279c9404e585e09433ac1aad9ed54", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415483, "uuid": "598a3808-29b3-4087-a542-7ecdec12204c", "value": "T14905336ECD423753C486ED333C8F53A44E9322F0A06967B4CB93D57DEABA299342056D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415483, "uuid": "ae8c6445-2da6-4e96-8835-8fe7120e9218", "value": "24576:TifL/Yqy83h81tUwDBGKk8C3u0hsZfO1nXRPIACpsa:g/YqZ+8wAh5mZfO1iea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701415483, "uuid": "fd22efde-aa5b-4596-9b7b-f009d98fa400", "value": 847648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701415483, "uuid": "26f2d4fa-108a-4fa0-b346-913e0da913f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415483, "uuid": "c8026d8a-ae4b-42e1-b631-efc66593ed3f", "value": "\u0411\u0410\u041d\u041a\u041e\u0412\u0421\u041a\u0418\u0419 \u0427\u0415\u041a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582a64b2-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454845, "uuid": "e8996381-9cee-49e6-9df5-2896367f9c0a", "comment": "Malware payload", "value": "620a6a048a5d9dd3aa74627990f25744", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454845, "uuid": "308a7b36-46e6-43da-ba3d-45a8bfda81f2", "comment": "Malware payload", "value": "91507c3c38d7d512f5b49f2005f221ec3f92facd398e06e6cec0d26c6161cf6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454845, "uuid": "df6efb67-b568-47a8-9038-f6fc76fba0b5", "comment": "Malware payload", "value": "5686d6cba4dc15f45e8b371507c6dc79fb503cc3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454845, "uuid": "a8385904-f1dc-4d59-bae6-6a25572c4fc0", "comment": "Malware payload", "value": "833022d4796090eeb59f5099a5158ca060b64b0e2948e677972a4fdbf5e5a7cf4a7d0fa0872513dd48253ce2e81fd2a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454845, "uuid": "2c05bac6-7113-4fa9-86e7-638b5eb57e0b", "value": "T1C2057D42E683C0B5D7813332086A33F6AF758E66AE34AFB7975CED385D220917936351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454845, "uuid": "9a9b3a18-ed34-4dc2-9c85-866930a14f20", "value": "6144:gr2nFATXAQkAOrGflwUyge8JKNpIGxMoV2dxcPz85+BNbwHDUSqJ8uIsynvaGc:giowzAOr8O8oDUczfBF2KnIsyny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454845, "uuid": "4f66b9b7-f4e0-4f29-8caa-d51c95300beb", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454845, "uuid": "a197d1cd-908a-4feb-b832-b5fe753690a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454845, "uuid": "4577f7d4-a8c2-494b-a447-02967a207732", "value": "SecuriteInfo.com.Trojan.Win32.16560.27840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762e7824-9074-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701454036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454036, "uuid": "67c5bfd6-a882-4688-af98-0f5747decdf6", "comment": "Malware payload (Smoke Loader)", "value": "492f8063cbc9076f76156e5187b682a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454036, "uuid": "a79a8ce4-1658-44c9-b9e9-a2e11ab4429a", "comment": "Malware payload (Smoke Loader)", "value": "9172b881a60c8d5a220257ae6c7d3618af3e9cb77d68c13cdb71fb85bbbdb04b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454036, "uuid": "3b010c08-7fb7-4e87-99c9-ff4138f4dcd2", "comment": "Malware payload (Smoke Loader)", "value": "d8d13a3802521e943934da4276e553984ebcf29e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454036, "uuid": "833aff31-76cf-4c0a-b2a5-19bf49f0dea7", "comment": "Malware payload (Smoke Loader)", "value": "54e3ca7b9fcf403f75320f2c5bc72dec8e44f24cf0e330c24c4a683ccef1ac17c7d8b7cfade87b15363f17dedf543e94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454036, "uuid": "abf9b3bc-941b-4921-8658-1dc5c2a18fb7", "value": "T116D62275B36FC917F0F36E648406BFEB61B367B1BB19216964281EC541B8B31A0A4F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454036, "uuid": "5b83b07e-dbb1-4008-bf8b-1e37cc8364d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454036, "uuid": "28c887f6-1ab9-4392-9979-72d8781c3c16", "value": "393216:jmL5LvPmm1SPtqMOL7JTa/l8ua1ipeE/Dl3uh1:jS5jXMt3OL7ta/mtJgDlez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454036, "uuid": "c8f4cfab-8275-4c0d-b2e3-16760d91d078", "value": 12760576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454036, "uuid": "6486b081-bdc6-460d-bfeb-e05bca036fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454036, "uuid": "e584e84e-0547-4d8f-869e-ca085cf88733", "value": "492f8063cbc9076f76156e5187b682a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cbdb36-909c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701471351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701471351, "uuid": "91a152c0-0c39-4cd6-a142-139627e56eb4", "comment": "Malware payload", "value": "0a5de1ec3faa4f2740be8f2f728d39aa", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701471351, "uuid": "0061ef1f-2c90-4be6-94ed-824e03d5cabd", "comment": "Malware payload", "value": "93c34e6633b446533b78e27b96b175247dbf80d1d4a2f825933a69dece48aba6", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701471351, "uuid": "795be6b4-d55b-4ef2-b2a9-e0965dd343d8", "comment": "Malware payload", "value": "c9546433c3eff029fe135a4d3c7bcf1c8ddea148", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701471351, "uuid": "0f6e8253-f44d-4d4e-86a1-7b82404edf7f", "comment": "Malware payload", "value": "405c10d39ac9ee251019d0d231f9df5a23b8c611bc525887e7ea9156f8ae6920677c91aa077d414ced00b5a0629d93c5", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701471351, "uuid": "1c826b96-27d2-4c7f-afd2-41083850f319", "value": "T15C54E795BAD759B16273B4BD4BAF900976B96833500ACC117C8C80D46FC467887FAEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701471351, "uuid": "06ff50db-1ca0-40fc-99e7-3586908b1cda", "value": "3072:ZZNnZB1lCi3Jufys/Ga//Cp5KY8L2YNf6AuFn8s76/3VuoFGvzHiVQVIkK0H86tH:HNnZgOJu0a//C+ReIzcAz16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701471351, "uuid": "d4ad6d90-d8d8-43d7-8f88-c7ed4896e341", "value": 282667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701471351, "uuid": "b5d3a868-5e88-45b8-9fa2-feb90872546e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701471351, "uuid": "254d4d48-2f4e-4ef3-a54c-67de6198e9c9", "value": "runscan.decoded.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b795f96-8fe6-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701392869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392869, "uuid": "ae3c5c81-1572-410d-9000-f7aefc32fe60", "comment": "Malware payload (RiseProStealer)", "value": "05777a5356e31ca0261c06d2b6080b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392869, "uuid": "8f5ee624-5e92-4a74-ad4c-2260c631d1d9", "comment": "Malware payload (RiseProStealer)", "value": "9518bc3f3049b98afe86b1d2b349938682cd218c98c3a13d8954794f8f7c0435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392869, "uuid": "ce057adc-6f27-4839-be2e-fd0062538285", "comment": "Malware payload (RiseProStealer)", "value": "73c615b3aacf9dc63f558e9c0f9c4259fe7d4e84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392869, "uuid": "648fb6d0-88dc-444f-9ef9-c1c9e4073938", "comment": "Malware payload (RiseProStealer)", "value": "e380ca848c7d26b4523b1b0ea2592d72e5ae172edbd5d90ad58154c66ad5be6f56b11a8802186609fc187da5a5a205fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392869, "uuid": "5c73468f-b91b-421b-b299-87e9a56ad77b", "value": "T193C5AD3822E3E860E94BD43595E86633B26E5EF50360A1FB6D4807FD59933D3E1B2163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392869, "uuid": "e50adae6-b002-452b-b898-99be131022bf", "value": "fe9e3404bebf8b23e1a17d6558da6aa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392869, "uuid": "6fd7fe48-4d9b-4059-bc0e-284ce76e981c", "value": "24576:H3ryj7++6rsI9of8esr7NgtuOGVT0gPk/rrjjvPTI45IRyxx3LmFRpugljwvAeAf:+++6rsIw8jZgtOIgMjLPLtmFR1jwI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701392869, "uuid": "95a41acb-d88e-4d7f-89b6-291db8ff85b0", "value": 2732032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701392869, "uuid": "28a8b630-af08-41ab-a97d-879a2aafc2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392869, "uuid": "74361a94-c4d8-4e7e-905e-7f0b59defd7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14572abc-9031-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701425096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425096, "uuid": "a02f6972-87aa-47d6-87cf-cea8d370df4f", "comment": "Malware payload (AgentTesla)", "value": "13e7ae190b0ab1250c199ac339217231", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425096, "uuid": "774d3e22-a41f-4f58-ad27-b398943ee1b4", "comment": "Malware payload (AgentTesla)", "value": "951f66b51f796de5f9298aa1f97c49e392083f6b570fb31df72610999fb50769", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425096, "uuid": "85276ee7-496e-4ac4-8002-c6a0d494fd0d", "comment": "Malware payload (AgentTesla)", "value": "625b25670a86a8b9a7808d226919dec2a224339f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425096, "uuid": "4329e7f0-9cfb-4ee0-ba77-1cde8fe0eb12", "comment": "Malware payload (AgentTesla)", "value": "b5a4daadf9cd773c36d9fce53667bb44c548799487a78803a75605908eaa4b00b024c39197d9c4a0bf1c8cf6439b0c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425096, "uuid": "4cf91d65-3ad1-4a3f-a39a-9cf664514afd", "value": "T1FD05E1176299A296DEB65B772878A1214773EE275B3DE73C3DC1306B5FBA30084113A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425096, "uuid": "c78777a4-9e9b-416f-8daf-2c994fd87cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425096, "uuid": "4d964023-324e-4076-85f9-ec414e58ae2a", "value": "12288:yvmSJD+IFgicSDKNfGAIko3cajHh84/dUNMgBe9+hXpKm0qE+Fq:YmSJD1ZctNbIko3c684KiKhXQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701425096, "uuid": "49389dc3-ccc0-4e5e-9a3b-079264960664", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701425096, "uuid": "288dc817-6104-46a4-8d90-656f3d90821f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425096, "uuid": "cbf95d02-b51c-4742-9316-bde1a3ddae28", "value": "payment overdue (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab17c60e-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413323, "uuid": "f3d9829d-97fe-4c0e-b0b5-29d74cf09655", "comment": "Malware payload (GuLoader)", "value": "cdea70e3354963b54fe10d3dacf8b0d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413323, "uuid": "8e3b4881-19d7-42cd-ac3c-efef33fa7455", "comment": "Malware payload (GuLoader)", "value": "964a9bc8417655173dd7b36723b55dc4e6e42faa10b7755435608d7eb97ab5de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413323, "uuid": "5dd5ba7f-e671-4a1c-a6dd-9260f7cf8e8d", "comment": "Malware payload (GuLoader)", "value": "cf15655f43a376512e00c44f69cbf3d1bc9e307b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413323, "uuid": "52acc338-af85-4533-9acb-32e26a3252cf", "comment": "Malware payload (GuLoader)", "value": "b4384964fa48986032c4e8a154038f69a9a54f6ad89927d43b50dff594c2d6a6ebecdcc55327799fa321da2fab4c988d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413323, "uuid": "7a7d2d4d-d74a-4d95-b59b-ff44e83592f1", "value": "T1C7E42361A201C06BC5642A30CA7579F56975BD0BE8E03B8363703E7A3F353A2D5DD6E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413323, "uuid": "3eafb0b8-2b3e-4bf6-952d-d80a67d55731", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413323, "uuid": "3a31413a-991a-4bc6-abd1-41f14a23aebb", "value": "12288:hBZEwWqf8chI/XEhBXhusJg2wiWokI5xhNoXX2/cJRIttnBMPmy29lZsDRnR:Zhkch9HDg2wDokI5loocJRsJy20RnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413323, "uuid": "3930e3f4-da25-4c37-824e-9f7491d6bca8", "value": 675744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413323, "uuid": "eaf3e4b1-10e2-43dc-a97f-2b14dea78281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413323, "uuid": "60de79d8-5e28-498f-9715-8f3b14faaa8c", "value": "HURNEr Schweisstechni _L.L.C_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bd5dfe-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701403187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403187, "uuid": "29c4c9b8-48bd-4629-b7a2-c8e9d7a0f432", "comment": "Malware payload (Stealc)", "value": "e02e36dd920288bad92fcfe84bfae0c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403187, "uuid": "b48c0544-95fe-4899-a809-ef9f0e6db893", "comment": "Malware payload (Stealc)", "value": "972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403187, "uuid": "d9d77e6b-0478-4b58-871f-b7150f80937e", "comment": "Malware payload (Stealc)", "value": "ed98ad4cdfa3295f85f95a77b8039d76b7b55e65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403187, "uuid": "adbb270c-dac5-47dd-b1bb-5c8d65ede462", "comment": "Malware payload (Stealc)", "value": "8c78335c5a8cd9bfe80b4f019746820d21e92481ee3b0d0ce5afc56765290793a2bccd80497d8b69071961b8a65914e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403187, "uuid": "03493def-9efe-4f38-85bf-16997da4f26d", "value": "T15D64D54382E13D46F9278B729F2F86EC771EF6508F597B6922289E1F04B11B6C1A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403187, "uuid": "accd0e9b-cccd-4a2f-9a45-b856d440b599", "value": "0bd61e688135eda02fcf13008a67a440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403187, "uuid": "0b75a55b-1b94-4888-b7fe-8de538a0ad9f", "value": "3072:3TdUpBOhZ0EgosRswRzERWJc23lGXeS5Ii68paMu63jXdo:RwOhjgosqwRzERWBd+RjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403187, "uuid": "9ae1c80a-3e7b-4720-a2ba-cef599d7805b", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403187, "uuid": "f6642ce1-3382-4fa2-9e1f-a3406af7b260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403187, "uuid": "f9b0f99d-c1ac-40eb-9095-750578997b35", "value": "e02e36dd920288bad92fcfe84bfae0c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d0d75d-9028-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701421521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421521, "uuid": "0d44fca2-3de6-4830-b004-9dc00d6174c0", "comment": "Malware payload (DCRat)", "value": "43ee6c6106ce1e382ea4460dd075212f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421521, "uuid": "1a89165f-7609-489f-bf64-ab78c9f3b13a", "comment": "Malware payload (DCRat)", "value": "9779543d04adb36b3723209b8ba712d41adb1e8df2cdb605257fe12cf114634a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421521, "uuid": "8d30210c-a6e5-4388-bce3-fa894679ffdc", "comment": "Malware payload (DCRat)", "value": "3fb0e09763a22ae08df3a48702a3d043ce1d7092", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421521, "uuid": "11eb661a-728c-4838-be27-85d60b780d3d", "comment": "Malware payload (DCRat)", "value": "5ce6ace0415b9b439a37ed5442ba616adc4d22527bf2a660d5b423dbf967ed9469b3388c730b780c0ba24c7d581a61d6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421521, "uuid": "c563c2bf-2d90-4330-b1df-a7f62c9a3704", "value": "T130455A027E44CE22F0191633C2EF454C87B4A95166E6E32B7DBA376E55123A73C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421521, "uuid": "e4741692-0244-4a03-ad12-f9fd107048b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421521, "uuid": "94f9861b-f630-4009-a785-2ca7e69fcaea", "value": "24576:7dsJmRqGHPRGpCH89l9RAHsjvjgkh177XN39fx:7q8nC9l9OY0kDXlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421521, "uuid": "7abb5027-e5d2-4d63-9b76-106a4bfb6428", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421521, "uuid": "14f19132-50c6-4206-9286-13d86093da5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421521, "uuid": "61590c03-a256-4914-813d-c7f1247526fd", "value": "43ee6c6106ce1e382ea4460dd075212f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598e2292-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422635, "uuid": "a9201fa4-54c9-4c1b-99ac-71691ea8479f", "comment": "Malware payload (AgentTesla)", "value": "c48f38fc47d6349ab8992c1e3d376c0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422635, "uuid": "9602288d-1b39-4635-aecc-b58676c526da", "comment": "Malware payload (AgentTesla)", "value": "97c69287c207370326199647238fd3578c061df19768ae3181e8aa20b9b87100", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422635, "uuid": "c10ab13e-b899-45f5-a349-313d18007f60", "comment": "Malware payload (AgentTesla)", "value": "65d40278a4cc77caf106a4de30a151ff13412039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422635, "uuid": "fe774c2c-ff12-4c8d-8404-3183a6cc2b61", "comment": "Malware payload (AgentTesla)", "value": "c6141bcbdea09b5b51efa4c38bba99cec596ba0352259a16d7872d1e577335ecdfacae8860d1d3f66aab2f6a6fca1eb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422635, "uuid": "f4a43368-a215-4e5c-b6f6-7e7a199f5a83", "value": "T1DF452356230A8363D9BEA7F7A890540493B3B81B9550E304DCC788CE6C72B55DAA3FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422635, "uuid": "7eed0838-b7d1-49a1-b89a-de3caee7bac6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422635, "uuid": "3dab7051-9dc3-4c3c-80a7-5d9312a1a700", "value": "24576:HHJYCiYv7vz2YowyFskjCBthTNtohgcjBHDMSgEmwJCp:HHJ+YvGSydCBnTtcGSfmw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422635, "uuid": "98a21daa-3a56-4310-b7d1-d6f1854a24da", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422635, "uuid": "c2169ac5-94b3-4447-993e-5047107fa101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422635, "uuid": "8545e4a3-e29c-4818-a2e3-4888a9820764", "value": "FAT098765700080000.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4987dde8-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422608, "uuid": "481f1cab-e9d5-4a4f-af8a-ec0cb8854275", "comment": "Malware payload (AgentTesla)", "value": "3b339aabaf3bfb3af9d0e0887e554835", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422608, "uuid": "1e263256-badf-4957-a58f-2fc2578a22c8", "comment": "Malware payload (AgentTesla)", "value": "9a1a81688bf7f92903009cceb1e592668a04048deebb264dfb5fd6c7c6fdd650", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422608, "uuid": "7052a696-ec0d-4893-8956-0c17d962f0fd", "comment": "Malware payload (AgentTesla)", "value": "bb2d2846e92fd0a4c5e0a2040e74a3c7cfab8d02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422608, "uuid": "a0220400-db84-4212-835a-65d6ec346fad", "comment": "Malware payload (AgentTesla)", "value": "b21810e73219c6d53ba918e7a0cbfb2c231b3bbbdb2176fa0b0531eb90c7904f90cad64603a92c149d51eae1cb601737", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422608, "uuid": "a98cf16e-4a24-4f10-adce-7d9fca155df7", "value": "T16A150220E1F85B22C5FE97F1045557140FF778AAA47EE32E4CC9A4DB26A5F004A92F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422608, "uuid": "83058e77-42c1-457b-8a9f-3538b904a001", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422608, "uuid": "5e6479ca-4537-421c-aba7-93f0d53f1417", "value": "24576:SG+Cw0kXuGN5jQypH+jDhtscbfnbOdVSrKHm9SO:6Cw0QuGN5REhbfbmVPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422608, "uuid": "d9eb5604-d959-40fb-bb29-d32804c50221", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422608, "uuid": "212a2073-0cec-4db9-8aec-f72a078262fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422608, "uuid": "6d2441e5-4f57-4279-8a50-ae9441fbc592", "value": "SAF-C161CS-LF-CA INFINEON2000 PCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e221d73a-9024-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701419858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419858, "uuid": "0e61600a-f082-455f-9f87-e27db2ff92db", "comment": "Malware payload (Socks5Systemz)", "value": "bd68eb00f0eb01274f4ad7b09795390d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419858, "uuid": "7113b038-81b8-4424-8f13-93f7e0cfe493", "comment": "Malware payload (Socks5Systemz)", "value": "9a8d4e81a4ec2637adc5a74746a9f1574d47850ee833edd5faefcf84edab239a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419858, "uuid": "4fb11f2d-b838-4350-a7b3-da7a56b0b9d9", "comment": "Malware payload (Socks5Systemz)", "value": "220ac124aac264e5a97a97f082d36e66209b209f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419858, "uuid": "d97eb7bb-b45a-4d89-88b5-4b210b035a46", "comment": "Malware payload (Socks5Systemz)", "value": "6840ec35e077f6090f2819bf7d844ab84b6b0769f3696cb7c0114302d0a313cf94bf4e0b81e8f874089b7dc2afde1b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419858, "uuid": "ea32ddb2-6b5a-4ecb-a516-7cd87793b408", "value": "T1E4E5339212B3C436F891457248E8A44496D3FA214AB47D96250EC6CABB335D6F0EF37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419858, "uuid": "2b2504bc-cb89-4aa2-9567-2477430aa42c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419858, "uuid": "4cc23775-d97a-49ba-b85c-b695c7064e07", "value": "49152:N2V9j2tB8nFGjZqzfN9VporsIKpeN+sivVAvtgUeYqpMqK9b7Bz/sI:YV9KBi9grsIKcNBivVA1g4yMx7Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701419858, "uuid": "d8c5dad8-4560-4d43-a917-ad6bcb27fc21", "value": 3102974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701419858, "uuid": "8f924a65-bb3c-4797-a1f5-21ad8a987459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419858, "uuid": "b1ba04c7-eddf-464c-a541-e1e46074f8c8", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.19452.15629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4de510-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413169, "uuid": "70faac59-d21f-46c7-a67d-0973d975018a", "comment": "Malware payload (GuLoader)", "value": "51cb830842e589b49a1b55014746f647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413169, "uuid": "af711d3b-dad8-467f-a9db-94e3ab2b5a58", "comment": "Malware payload (GuLoader)", "value": "9acb70bd6ffab2d395295d4422898b4e5ec4b5186290201512b61fef28083590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413169, "uuid": "7021b7cb-28cf-4308-ae22-2ee2c53b3b7c", "comment": "Malware payload (GuLoader)", "value": "24f7657d58d4a6abdf4d6d8f037a81ea78f9b0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413169, "uuid": "316a999d-5c1d-4da6-a683-8a7fe2693e1e", "comment": "Malware payload (GuLoader)", "value": "92c80d0d880fa157c96aa9f8328f7972e9e7d0e1776bfc0d8d4059598fd30934706aef1f1f0e0d80a18c3f55c22261b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413169, "uuid": "a1e8b39a-81ba-4a09-bf6e-f489bda90eea", "value": "T13EE4BE9239D9B56EDC2F8674035FEAB22AB85CD07391486E4F80760C4C3664B90EDDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413169, "uuid": "85259b42-4b41-4152-a803-2212cc0f66d8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413169, "uuid": "846732c8-cc27-41b6-a13e-7bd34da55b86", "value": "12288:inhe2eauQym0FpjqhmapsCd/+n291YLWR:0hegZ0XjcpPs2zYyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413169, "uuid": "d0015df6-81bb-4023-8a96-79f7eff670b7", "value": 668736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413169, "uuid": "8f5e98f5-574e-4bc1-b983-262ff2328382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413169, "uuid": "e2aba39b-967e-4f4a-a048-e3aafea135f8", "value": "justificantePago_es_180214093508pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc4a1be-9076-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701455042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455042, "uuid": "36e28a89-0663-4400-b056-628a4748eed4", "comment": "Malware payload (Stealc)", "value": "b5d3ccc5f3fd91587ce1822988e1eb35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455042, "uuid": "e873b5fb-01de-4664-b29d-b5a9c647d1b2", "comment": "Malware payload (Stealc)", "value": "9b1f16fc5a7eb84cd73ad46c684151303bdacb2e9ea7bd239e5557822026426c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455042, "uuid": "7ae1f236-bbfa-41b2-a542-b7f8f568561c", "comment": "Malware payload (Stealc)", "value": "b6c5f70f0b13aab5adf790373ce910e057c3a64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455042, "uuid": "dd958a57-5d59-4952-ae46-e6fc74fc890c", "comment": "Malware payload (Stealc)", "value": "a504cf80a37cbcbb82b59402ca165ae26ea06bed4ee364afea13e56e0e28b951fd68b501b0d7de9c999c630636c01840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455042, "uuid": "baed2d55-f967-4a00-8e1b-3810e53af9ed", "value": "T135545C0392E07C61E5264A368E2AC6E4261EFF618F3D7B9B13586F6F09731B1C562F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455042, "uuid": "1fd8980f-6041-4cf9-8379-60ce1f1dee6b", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455042, "uuid": "bda0b541-4103-4069-b634-9b1cdb35a476", "value": "3072:CwVNydzfCt1P3BjLs0UH6mROR8gmbjAffgC5QxNXWrhPBQoOAGLlb6C:FVWfe1fJ40UH6mIoWrlBm7p6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701455042, "uuid": "f58aac7d-4af8-453d-bfb5-ddc8d6786d85", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701455042, "uuid": "49f08707-010d-4ea8-b837-6b86f22fbbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455042, "uuid": "b95bc387-1490-4708-96b1-33dd16f29846", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f33c19a-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442321, "uuid": "3271946b-d183-469b-922c-0062b093dbc3", "comment": "Malware payload", "value": "4e9f3e3eca08d0147a036651499ed227", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442321, "uuid": "8a11a22d-45b8-4038-b518-b9f0455e7cbf", "comment": "Malware payload", "value": "9c0460f5bc542d2250144c2f9c0fe840cb88e6ed9598ef0ec04c9238cd695baf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442321, "uuid": "3b2c6ab3-685c-4a04-9992-a85e2b920c1e", "comment": "Malware payload", "value": "a065446f0cf380b3d98c68e8052baab21daf4fab", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442321, "uuid": "495c7a44-5d0d-4c65-9e38-2ecec9fe82c7", "comment": "Malware payload", "value": "f128d58e32e45587c69d3a1530e9f73dd2116664f17a5215d418d465c5b4d017778e759507824f02f7d6f9ee7e689a6a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442321, "uuid": "fb1b59ff-8d5f-4408-9710-32f2839e9d4c", "value": "T1AB560175731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442321, "uuid": "34916291-6555-4cbd-a8b2-128b366fe975", "value": "196608:/ZDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYE:ZirUVis8O/0giAZ9PDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442321, "uuid": "419b24c6-37a2-402e-bb70-995cbe5ff477", "value": 6364090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442321, "uuid": "0eed8a6f-6d76-4f8f-9f94-f864071aa018", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442321, "uuid": "db6426e1-49de-475d-9d92-5864df684a8c", "value": "StartFre\u0435.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1522be-906f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701452110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452110, "uuid": "1954cf6d-445e-4b0e-a1d1-a4bb64c92867", "comment": "Malware payload (RedLineStealer)", "value": "7cd29fb3f2cc7226aba2a03531db57e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452110, "uuid": "f5f0ae49-45ec-41f6-bed1-6644e5bb181c", "comment": "Malware payload (RedLineStealer)", "value": "9c22666893cdbbff85b24d18e4cdda6b5e6d11679c1bd01dfbb38c7e82014e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452110, "uuid": "01289ee5-1a3c-436c-9062-ccf06c4d729f", "comment": "Malware payload (RedLineStealer)", "value": "aefa5187c50c56d0a0bde356ef7975193c743c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701452110, "uuid": "c1d33aa6-7a13-45fc-ac77-80efcfbc3653", "comment": "Malware payload (RedLineStealer)", "value": "2ae91c4508b709d0f17c28d262775c54d3651b22071ef25aa3982bf5735e901eb884f9361b5445e801abf63028bdff9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452110, "uuid": "95f9aae4-abb4-4e45-9097-84b753c622bd", "value": "T176C40210B2DC1BDBED7683F80D24B1018BB1BD3A5436D7682D85B2CB56797101A72EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452110, "uuid": "dcccf4ee-2a9f-43d8-a0de-698022e5073b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452110, "uuid": "a8880b22-7791-4c36-8bc1-3c99753bd109", "value": "12288:gbPmxN1E6jD/oXM8gK8HrRumpX+JpJ7/+/wHyIQ1NS+0opox:AQN1tD/gx8HA0cvPyIQHse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701452110, "uuid": "3b3320d1-8db8-4208-ade1-e4b6dda159b8", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701452110, "uuid": "ff5ac72a-6aa0-4217-bfdd-b6563df09392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701452110, "uuid": "2ea4223d-a1eb-4f71-af2f-d844b6f44698", "value": "7CD29FB3F2CC7226ABA2A03531DB57E3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84417dc3-9036-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701427431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427431, "uuid": "807d2c9d-11e7-4022-9d5f-db19f7cb34a0", "comment": "Malware payload (RemcosRAT)", "value": "2d1013d597cf1a7313da5e4be3df12af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427431, "uuid": "6fc6efb0-6590-4219-8cb5-52866916400a", "comment": "Malware payload (RemcosRAT)", "value": "9c365f7df9b2bb958a53890dc80a258de1f5ea0781155f7c2b3741b9dd593867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427431, "uuid": "e89b7d0c-3999-4a3d-9333-978c6078e6d1", "comment": "Malware payload (RemcosRAT)", "value": "015dcee05970990215d6d7d2498e3e412de81f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427431, "uuid": "2bc81584-a56e-41f7-8b44-f3b601717fd1", "comment": "Malware payload (RemcosRAT)", "value": "b0ca79159f26537433c2990a596562c9a3f820ed309485b347b8148d2329fe475214949a378529800efa1eae005a5e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427431, "uuid": "34c37e2e-f8a0-47bf-b353-f6e95e1fc441", "value": "T16F251202326CDF07F6761BF92011755453FA208E643AE6985DC238CB50E6FD54AB1EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427431, "uuid": "bdb1f167-b5a4-466d-95b7-d957850832e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427431, "uuid": "13cebcc1-882c-4667-909b-941dd49361c9", "value": "24576:u7Oz/Q1yEUkVhVyU6YpfsmpPRnTr/hRaynRd1m:IOz/QA3kVh9ls8PrUeRd1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701427431, "uuid": "94c14ac5-3b20-4857-a69f-8115c6f92a39", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701427431, "uuid": "8542196b-5890-47bc-95b7-0c8f7fc47403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427431, "uuid": "c32864a0-05c2-43ae-93a8-653249b7b2e7", "value": "FG9878000980000.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586f1e69-909b-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701470737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701470737, "uuid": "e439bace-6c89-4313-8ade-3ec62754f0e1", "comment": "Malware payload (DCRat)", "value": "0e594ac856076b0d308c0e6c93a2fe9b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701470737, "uuid": "b94aa08d-89c0-46bd-8883-1a3c6434a1aa", "comment": "Malware payload (DCRat)", "value": "9cd351bd4b3c17ece37ff8603e030b4980cddf1cd55efee810c7ce5b102cc6e3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701470737, "uuid": "64ec7aed-6fd8-48e9-a2db-95527f14b256", "comment": "Malware payload (DCRat)", "value": "f099dcb5b1a7d22f096784c577d6061860a46191", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701470737, "uuid": "13ebf30a-10f0-4051-8c04-0b0b19694086", "comment": "Malware payload (DCRat)", "value": "53438b726d253b4e10f47098f4e4cf2117d04c0cc4fad513f1d6ed01d1c305dac85c16cbf526f31217242ccc1ce292f6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701470737, "uuid": "59e34075-dd30-4d0d-9529-507b9c80fe26", "value": "T1ABE533E184D81E10CCF98176E64CB77B5CEA096B8876ACF58BE89C9FDF746F854A1400", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701470737, "uuid": "64056cd1-b861-4210-b413-797c0ea90486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701470737, "uuid": "6465e727-0425-48b9-a6f9-0894fec0cb15", "value": "49152:EKyaJpcOeaZ+wEBOyh46tqrj73kOAeIFA3pmo5I49c/iLAur3TCm3DP0eGJrnWYD:vya9Z+jIp3ngOXIo5I4UgzfDceGJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701470737, "uuid": "951f5335-2150-4a07-9311-980af2451ca2", "value": 3316092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701470737, "uuid": "a796ef14-f63e-4383-b806-3ed47a2fb06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701470737, "uuid": "802e28f2-71fa-458b-a07b-4390c514b483", "value": "0e594ac856076b0d308c0e6c93a2fe9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1490ff2-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422755, "uuid": "afd7a8e9-e805-4260-92d0-875250eaddca", "comment": "Malware payload (AgentTesla)", "value": "90d45383bd5fc539fedd77eac5d09841", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422755, "uuid": "77914e74-f011-4d42-b8c0-6326da664fc8", "comment": "Malware payload (AgentTesla)", "value": "9d0c10331d40a7cbeda5f8e93f7314ff0930b7e0338bcd113de8392c0e09091d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422755, "uuid": "c4503c19-f9e6-4184-8442-f00fc38fa321", "comment": "Malware payload (AgentTesla)", "value": "ab54ec001fe64d3ae3cc76828f8e2521ef404653", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422755, "uuid": "7fde8b71-ccda-4a02-898a-6cb22695285c", "comment": "Malware payload (AgentTesla)", "value": "7e20caa4350e35857574d06e8e4e1224c7bf8ff4c6f898076d4eaa1fca2789ee986e14a26b82a111855ace085d76773e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422755, "uuid": "db88f090-e0b9-4fac-ab02-c5eb045b13f9", "value": "T1C4D40246238A97A6E13F8BF729D0A44483B3B417A860F35C8ED341DF7A71711D682E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422755, "uuid": "2d45e5e8-50f7-4451-b75c-f2950babe731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422755, "uuid": "bf9c46cd-d3b8-40d1-ad0d-4940c18c939d", "value": "12288:5CCXJwIE89iS42jwf8HXJmGQf01NoFIsfSjfzBh:BXJ6829Y5mGQfCNoFI0sLBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422755, "uuid": "82f5d85d-b9fa-4f29-84fa-13f49e9cbacf", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422755, "uuid": "cf030561-6841-49e0-9a84-e69a1d6eb853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422755, "uuid": "8aa87413-aa1e-45f1-ad76-70382952c883", "value": "transfer 2023.11.30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970cb962-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442495, "uuid": "64e32def-af9a-4507-915d-b2bac4254f78", "comment": "Malware payload", "value": "1876f22122c10e270f6d2bfa5b6a507f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442495, "uuid": "4679c42c-0202-4b69-aa39-1290915f086e", "comment": "Malware payload", "value": "9ed713aab05f4d8d6c3483283b23c3f7dd68d7b7d03d85a2b906f70ee9240815", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442495, "uuid": "1a1ef6cb-b8b9-4f2c-a9c1-f4b0225fd545", "comment": "Malware payload", "value": "61e15be1434d0c897ea30121a16c90208fe0baec", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442495, "uuid": "ff5dee05-788d-4827-914f-0da879ab0ecc", "comment": "Malware payload", "value": "6e009fc378289f9dc9d7680e351051b502859ec6db2efe08421cdda1d95f12c9fd1bf96313f48b6ed6f3e91fb94df227", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442495, "uuid": "0ef77b6f-426d-4690-90ec-4a6d36cb373f", "value": "T1569644D4DE2E639AD2E3F81B7702588DD8DCDF1D50B85D15027BAE9091E0293CBB53A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442495, "uuid": "4bd6300b-b6bf-4903-a3a9-33ca266218c7", "value": "98304:2jGdEU9j8ILeadLzYTG66K8ZTAcYVTJK6vgIgL/gJoimZEp0fVCFBFHaY7m2j7Hm:sDINoq66ZTzYVjgrLIJoimZteb68rXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442495, "uuid": "3632f6aa-3d32-4529-9bec-d3d8461b7eca", "value": 9031390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442495, "uuid": "9b5ec998-49f4-4e58-8745-024a06939fdd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442495, "uuid": "f7815021-b117-492f-9d52-2747a18c74f9", "value": "installer-bundle.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68361243-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454872, "uuid": "083b86af-4a1b-4dc2-958a-31a27e84cf5d", "comment": "Malware payload", "value": "29e6df3fd6ff685f040a5a4ffd7bd299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454872, "uuid": "14f1d345-8832-409a-a723-4c6834b9ef68", "comment": "Malware payload", "value": "9f2f8048f6c3433183e28fd5d31b9451b01e7b6928c544af335203594c946af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454872, "uuid": "ac9899f0-7a36-4728-bb2b-2dfb0ffdb663", "comment": "Malware payload", "value": "29276a2ad04418adb5883a907693065c6e845872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454872, "uuid": "615d271a-086e-4ccc-acc6-cf49c28f96d1", "comment": "Malware payload", "value": "657c0a1db9688df858b1a0378d7c9f131732f295c26db781c7b6deea1a144121e245beb41c36713f5d2bcdb51c2dcdf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454872, "uuid": "946f73e7-6f7a-43cf-a846-0d4b370eb5ef", "value": "T1989530CC29D9CC0DC2579D7734CDC1D9E88118C9BEC9A7C3B266BF2EA977256A423250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454872, "uuid": "62914327-53fb-472c-9ce0-3e1ac82a6c46", "value": "3fdcd306d350b274632ecbdec4eb0bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454872, "uuid": "bcb7c453-309a-4748-84e6-683fbc42e1e9", "value": "3072:StxcyFm0iQPAIntoiUA30BEdo7DOOAlABBeYnsMz6DSsoRNV1PSXNo9Zd743KlIb:S0YAI/UlEd8S0BBSDOSoZ543KlI5eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454872, "uuid": "fc826a5a-c8b9-4e42-8c50-a987d5c2cc74", "value": 2034242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454872, "uuid": "9efb4e00-1dab-492d-a1f6-18e3a7ed519c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454872, "uuid": "686e1cfd-7c9c-41a9-844e-cbf1f9962c19", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.31088.27686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121b2fde-9014-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701412637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412637, "uuid": "95db882e-014f-426c-a936-6a192af1f92f", "comment": "Malware payload (AgentTesla)", "value": "e09099905a06bf6c0c26c3b5ceb2f8f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412637, "uuid": "16cf1f10-1c20-4bb9-809e-b2bb940829fc", "comment": "Malware payload (AgentTesla)", "value": "9f4ff6a61fea6fc87d56dc8dc274522d38e34255ccdb39a6888686b920ec5ac0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412637, "uuid": "a8f5139f-c0e5-4a06-a270-336252f2bb24", "comment": "Malware payload (AgentTesla)", "value": "993fca0bde00e85ef9714a8f17b39c5c1aa86900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412637, "uuid": "9364379d-1c70-448d-bb99-836d4e9571bb", "comment": "Malware payload (AgentTesla)", "value": "8a97281045b08ab0d02d05e53b08942f32606d02b000a7bdbceec21d7ce2702c88c51d0d7fc968a62523edaf1b9e5e37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412637, "uuid": "700a01cb-871b-4e6a-949b-03c3f60bc4cf", "value": "T1CEF4DF3533F092D2CD6A87B72488405853F16D6EECD5E208EAC05ECA3521FD15ABD9BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412637, "uuid": "bf1094f4-f01b-4748-8c35-928eebb5992c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412637, "uuid": "b69c996c-6fdc-464b-8867-48820e0e628c", "value": "12288:+C5pJHIvppx3Wwmb8hGHCGNn8ZNq29jg3EkvSB0Uvzixd66kJif0yFD:1pJwgDHfRINX96EGSWizixlKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412637, "uuid": "80bbd367-8569-4612-90ed-bde0049da8be", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412637, "uuid": "aacb6f76-fcce-4e38-bb3f-48c7584db875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412637, "uuid": "5d4f8390-ad1b-4138-a5bc-fb2db624c52a", "value": "HSBC_093843_92343.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1258d955-9075-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701454298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454298, "uuid": "9ee8c362-90e5-47d8-a5ff-1a647ce7f44f", "comment": "Malware payload (AgentTesla)", "value": "8f5b5b215937feb465df3f2c58f5a60e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454298, "uuid": "da1b6364-f597-4de2-8c9d-5fc5919ec7f7", "comment": "Malware payload (AgentTesla)", "value": "9fdca9360e25dcfd92011c7aa47c40037cadc4573826b13cfdb8ecf7dc3bb553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454298, "uuid": "4a4f849a-b0bf-4e5c-9d5f-830327825ba2", "comment": "Malware payload (AgentTesla)", "value": "e9c03c4746d9d2ca7811d9067fa501ebad67be10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454298, "uuid": "bed6b3aa-5806-4155-a622-314b13bc918d", "comment": "Malware payload (AgentTesla)", "value": "59553579fb44b7bbaa09e135a86c2d0e0404bf6a705f54d2e14df04edd5dabe85af6f2fac83fa6def9629bd34a3c0c6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454298, "uuid": "9f84fdc3-55dd-4333-9c17-629ec36e1769", "value": "T15215238ABA68FB56C87247FF2EA5521103F1910B4CF5D5018CE234E791FAF219A61F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454298, "uuid": "73a173fc-72c9-4244-b2b5-12daf4a0203b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454298, "uuid": "052d4db0-8bbd-427b-b35d-c55cdb5d1730", "value": "24576:JBFeGw0xuxKHprItYi/52Re9N5j+18wDDyY:Jh7M0OHB2+zCfDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454298, "uuid": "3468a702-3574-445a-96e0-ede7043398cc", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454298, "uuid": "846d816a-7ef5-47b8-b4bc-d59ae6b14b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454298, "uuid": "96f64a03-9446-4b39-aa3e-7dbc0bad6322", "value": "wlanext.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdd7c52-8fe8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701394079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394079, "uuid": "c469991b-6499-4b97-96e4-3bd4d33c004f", "comment": "Malware payload", "value": "e9ebb1d9aa3397db7a67415bc3001232", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394079, "uuid": "ad808ff1-90f7-42ba-a220-cdabee719e4b", "comment": "Malware payload", "value": "a03969c1a3d555a10acc4ad578860908f60bd86c9fb1f355418821bc9c28ddfe", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394079, "uuid": "f06c0108-e321-4ca7-a2e3-f5f105b79c3c", "comment": "Malware payload", "value": "e0e95e3298c184aa11c24ecb353bac483ed89439", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394079, "uuid": "bb603fc4-5567-4816-b8d1-4cc3241c4287", "comment": "Malware payload", "value": "6899bbad3faea2f4ef5f7aea4f7f661404fe4f2600c3526b869ab54fb68a462db2b37e1679b9495338b9a03c390f88f3", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394079, "uuid": "369df71d-c34c-47ea-b1f1-0c82e35f4355", "value": "T142265B1372C86C3ED0E6CB3AC8F7A254983FB66C6A22AC4B57E4474C4E355437D2A617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394079, "uuid": "fd1fe7b2-02cd-472c-92ef-6b9ac0a31c3d", "value": "4f4b1e4ce0615335bdd1483a9228507f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394079, "uuid": "454b0020-83d6-474a-8655-bb30f36c7ee8", "value": "49152:IJXnF1EvXnIyBbAH5SMA+Ca1qra8VtPDXDefHeqyk02YUAsYAsJLYWxh:iLEnBGjkaWJXDduYUAsYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701394079, "uuid": "45b34cdb-6dcc-4f9e-ac9c-dc6b05911b0a", "value": 4533760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701394079, "uuid": "091d71b6-e936-4584-ba6f-52f7eb03e031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394079, "uuid": "5b9f0a80-9518-47a3-a9cf-f50b7b359e17", "value": "Binary.bDZLnNeGYKjTQfcZWTnvj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a5504d-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454864, "uuid": "a989ae01-f11b-44b4-bc13-1ab046faf541", "comment": "Malware payload", "value": "61882ac978cc45c5c53ae9d725d03aab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454864, "uuid": "757ec38f-d12f-4724-8e9c-151ff9f8dbed", "comment": "Malware payload", "value": "a216573b3e9d729743715c1cc2d10656c01e1aa32d943df18c851b5da5a97484", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454864, "uuid": "54c6a4a7-38a1-403f-a6a5-bdff0e9a2ae8", "comment": "Malware payload", "value": "e9980aae3ee8125f58e4b5978468919622ca712e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454864, "uuid": "4c3131d4-7cd1-4f7d-bd36-e63f46229010", "comment": "Malware payload", "value": "43c0a28b6999e2b8e71b0791c20d2e726c2b209c6e06f635d98bdf04f724f7194959a3e37855a715a822ce39d5a96e33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454864, "uuid": "b3e702ee-8c0a-452c-acfe-43c38e3a42bd", "value": "T1A8463314C11EA8BCF052A6B31A4675B54188E16EF39AD1A39EC7705FFB725B019F30E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454864, "uuid": "2e5f9026-92e7-4000-a806-234a273af0c7", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454864, "uuid": "9c12b841-4b46-4401-a194-d3440b3a7545", "value": "98304:WmlnWte7Y1hKbKjhrgLaPICeHFq5Je8IjT6jfGHrfIG8n5y0AK+:W/tes1hkkO7CeHFq58tjfLfH0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454864, "uuid": "04769293-2d5c-4896-944d-6e91fd97e9df", "value": 5741653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454864, "uuid": "7f4e3803-5e8e-484b-8fc7-e7ed8cc6838f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454864, "uuid": "00828d90-c088-4742-b536-b529a6b29388", "value": "SecuriteInfo.com.BScope.Trojan.Download.6512.11601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8bf39e-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454822, "uuid": "514f45f0-da16-4af3-af04-ae34ca87b8e3", "comment": "Malware payload", "value": "26b0aa991f1dceeee4bf0821c319959f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454822, "uuid": "294d37b9-8169-4524-9990-3b6a36786325", "comment": "Malware payload", "value": "a3bd686b7af732017fb4939bbc6d00db91567caa0457fce1adafb4d251255feb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454822, "uuid": "c9e48ab8-a462-46ca-8865-614f81205639", "comment": "Malware payload", "value": "0774a74768dccb817bb2a5fe6bf3bf5a8fd5aa4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454822, "uuid": "fcb3a4ae-3565-46ec-9099-c1b311973492", "comment": "Malware payload", "value": "a8eacb50c185328541e3d1d1a256c47b9bb121c49e5eaff071ed3c9ea464f9bfd5fd21bc3db54b16c4ce8d98258a22bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454822, "uuid": "80906b2d-0daa-42f5-bb9b-46f0ec077ea7", "value": "T14FA42EE875209557C304417B78CD81A8F9DCBB165BF2C5266E7D220F287CF897A83E68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454822, "uuid": "554726a8-3593-4ddf-8856-445227d5f22e", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454822, "uuid": "7dd51cec-9b73-4cb6-8684-90d3eb459789", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjg8UTn5GTXxuCppqLblVJamkLo8qHU2u:+RR5rhZFQGrsUwF7vlPoSWn5F2XZ28ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454822, "uuid": "f0e9c419-261b-43d6-bf2d-6f41ba0e4d55", "value": 471590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454822, "uuid": "3b2d0302-9d1b-4530-be39-8484e6ef9ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454822, "uuid": "82b7f7da-8fae-404f-b147-4a323cbe2f10", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.27808.28588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31415835-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413119, "uuid": "792e0cb1-a41f-40ad-8068-5a687a597455", "comment": "Malware payload (AgentTesla)", "value": "3afe7ac331aba60b1748358613d16b52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413119, "uuid": "ab6deeb7-b68e-4d0e-b347-925e5e8118ef", "comment": "Malware payload (AgentTesla)", "value": "a59437567cef6624a191e8b8b4f94b72e056e896ba28d15cd466cb36b5f186a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413119, "uuid": "46191bbf-086d-40b0-bad7-7797755edb04", "comment": "Malware payload (AgentTesla)", "value": "2e5f92b77c23ef602642ce6df48305e7fa45e896", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413119, "uuid": "86a1efed-8e54-4900-ad88-8278428ca354", "comment": "Malware payload (AgentTesla)", "value": "35a8e5ad42bab0ca9cb2c9a5fcc5f9850ec110eb50a99a773fae74efc7e7676cdc29b84af7901ced1f20defe2c71adf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413119, "uuid": "2cfe4ad2-e333-47a9-a0c5-889ff43a2f6f", "value": "T11C057953660C4AFADC7543BC851180C286F4AD6E51E2B2265BB13EBEC53DE205D3FA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413119, "uuid": "8de99dd2-4932-43ca-8a28-5e6d42883f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413119, "uuid": "ccb91bb3-5d4d-41ba-827b-0a8c36e40eb6", "value": "24576:V91tD/Y2IZVROhxbOuIx3ISaJ5K1xQl5qHyje:VFY2ZCuIxkHL/qHyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413119, "uuid": "ca39df07-0e2e-4d18-ab59-4be7a98d8b8c", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413119, "uuid": "7546c4e6-69ec-4906-a4e2-74882474fee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413119, "uuid": "c6909f9e-e258-40cd-bd68-bb41907886d2", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bdffd0-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454814, "uuid": "3f4511d7-4c66-40a2-b0e1-feca452e19be", "comment": "Malware payload", "value": "35a6dbc8fa1f49d8e17d416c7b537e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454814, "uuid": "b55c9c08-fd73-4a77-87d2-b5951fe5ed69", "comment": "Malware payload", "value": "a5ab74978e2c4aa87fe2c988b713069adb6bade242c792cea26753a920486f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454814, "uuid": "e4862779-9572-46e1-add1-54b8008c3537", "comment": "Malware payload", "value": "08a40770c93b810bc7d2cbbfbbb907c8a34ea9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454814, "uuid": "718cb5cf-812d-409a-bf14-96cdcf16eed5", "comment": "Malware payload", "value": "e5261f7ff72d39fb84cdaa4888f8618fd620f3ee4459841dff04a042724a8fe89e0021bdbe3ee392d5cc0422eb23e461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454814, "uuid": "2e666676-c4eb-4293-84df-9f91da436220", "value": "T1F985236178C9A540E42C4E31BF1BFAB2567A0D7CBDCE0AA1357A7925973003CB94DBE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454814, "uuid": "2667735a-4df4-4fda-bb57-64bd890fbf2f", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454814, "uuid": "37c40fa9-daa5-416f-a138-f705e17fd475", "value": "49152:qj0nKp8JOjQ5aCN0Cc2lTC5f7wwXFw7fnQY:qj03JOj6a4Cye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454814, "uuid": "8c41670f-71c6-4199-9c43-5b051aafd1a1", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454814, "uuid": "fb5e1995-9176-41b2-8cd6-550c7997f4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454814, "uuid": "64388745-93a3-470f-9a3b-5abf9f8f2631", "value": "SecuriteInfo.com.FileRepMalware.4269.6620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272578db-9034-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701426416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426416, "uuid": "cab266c6-40d8-4cc8-a3ff-fac20be6d861", "comment": "Malware payload (AgentTesla)", "value": "ffbead404f6284ca066aace51346fc15", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426416, "uuid": "20e87183-257b-4589-a04c-23c3a392ce3d", "comment": "Malware payload (AgentTesla)", "value": "a67f076542d40afad180257af33f9b3a4b1ca1fd3f6146f030c165188bb16945", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426416, "uuid": "a538281c-e66c-4208-bb99-64fbc131eeef", "comment": "Malware payload (AgentTesla)", "value": "e4fb9fff898f0108fca15cc3710f22e4d7be5509", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426416, "uuid": "24f90038-37cf-479b-9ef4-958e87b4c8e2", "comment": "Malware payload (AgentTesla)", "value": "e410ed337825420941ad0c4505c46e5ed4195922212d3fcf10dd9a0b5c3e45d47c57bc8cd1c44bc3fd3a4443bf2ab5dc", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426416, "uuid": "86ea69d3-4207-4751-9955-b545d61f256c", "value": "T1E3E433CC702CB97FE95D474817EA007D0CC2A48B71F74AA5366CFAB994899613F284B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426416, "uuid": "4256d19c-f525-4541-a973-baaace73ec6a", "value": "12288:oQcrV2DZddftdzkua1fukoCRJQE8TPcPqp9wLUUFkLQj7XbM:oXrVeZHzglVukHRJUMqp95lsPbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426416, "uuid": "2e2f9015-e5dd-4f32-ad47-76205a506256", "value": 671214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426416, "uuid": "e0f02473-cced-4401-be65-4de3936a2b70", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426416, "uuid": "9a531349-8ba5-46d2-bdf5-e8795467cea4", "value": "payment status.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a860f28f-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413318, "uuid": "292db250-f2d7-4920-a8f0-57b5d347b3a0", "comment": "Malware payload (AgentTesla)", "value": "08ebb1813895b664712ce4b91d3ae1f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413318, "uuid": "d05401f9-6083-42cd-bd34-570bd90a6d9b", "comment": "Malware payload (AgentTesla)", "value": "a86ebb515972e0290fe78d073a8a057ae65181ffc8f511f2ddcebe1fb9a47a5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413318, "uuid": "33d896d1-bc78-4230-b167-dd16ac5ff841", "comment": "Malware payload (AgentTesla)", "value": "a2f15bf230124ec8c1cd658a721528e6800e4c9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413318, "uuid": "007437b5-5b30-45b6-a6fd-776e4ec662c2", "comment": "Malware payload (AgentTesla)", "value": "aa5ef4a1c02ea9bb788b1ccdceeac1714deb633544e4f0834b39889372b176d55e6611c9eeaac6d599be5a0fed3f9f48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413318, "uuid": "92c374bb-6bdb-48d0-9b31-a49ee1fc7bba", "value": "T136F423006D8DC312ECB45B77B43162B1537AA2861CB3E61D08FD7635F667393288BA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413318, "uuid": "355186a8-b3f4-4996-921f-1b913b041b9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413318, "uuid": "d466dc4c-63f7-4253-8264-ed7bad999339", "value": "12288:ptHnV7rD6PuHzDDGrqMaofNbWQUIHs3siRN:t3DXX4qMaybXBwsi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413318, "uuid": "5f4da7ee-9cc3-4918-9db6-da0ebced9005", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413318, "uuid": "e18f52ad-f041-48d1-912d-7f5865577374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413318, "uuid": "accffb91-ddda-4e92-a919-ed7d43bc254c", "value": "Bytcentrum New Inquiry #57280_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a74a4c-9073-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701453685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453685, "uuid": "97df563f-d1ac-4232-ad1b-b885ba75ae3f", "comment": "Malware payload", "value": "face3f7a55e927eca228f79f4f8a5ebb", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453685, "uuid": "8d8f8b8f-9d2a-4d54-b704-f0d5d463a9e9", "comment": "Malware payload", "value": "a9a12c451a27dc6bea651a60a472f36be1b1802e6c15c9969f8a963802a9f797", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453685, "uuid": "d2755041-7e09-4dd4-a75b-c6aa09b7eb5b", "comment": "Malware payload", "value": "8dd77ac8de21d2adbb759db7b731018a7e37acf7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453685, "uuid": "5124ab11-7b96-42fa-8d24-492d3b432713", "comment": "Malware payload", "value": "35da6148e3acee744dd125d8df223ff4d099568451733c7cfb5e768bee561b0416f1884d368fd9d60547a3d9172ca997", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453685, "uuid": "d5a0cd13-de4d-4112-9c8f-2c6cfe774bc1", "value": "T1AE840216F2C2C32BCD129934CCD9E4DAD339BC54AF05834F72C6734F46319A5D2A6A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453685, "uuid": "aeb10188-97f4-4710-bbcb-38daefc44552", "value": "12288:BOeToOtNzRlgZ11ppwN+uS6fNoTCNBq5Z:BOeEy9uJp6NPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701453685, "uuid": "c52e48b8-8a1c-4732-be3d-71f504e36d4e", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701453685, "uuid": "0d904782-f99a-478d-a864-05aaa6161093", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453685, "uuid": "1c5897f8-8b91-41cb-a78b-bfb15593339c", "value": "Transferencia Interbancaria.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a704fe-9022-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701418899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418899, "uuid": "725d3889-b77d-4003-8ebe-779ca61801f4", "comment": "Malware payload", "value": "d1d019bd0971e71f7fa6d5079b6b0f6f", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418899, "uuid": "b0d86946-f158-46d6-8b97-922da67957ba", "comment": "Malware payload", "value": "ab9ea998daa1a4b0e0b03394a8dec6a0fdc794671beae076e6b9713971dfeef9", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418899, "uuid": "4f980ea1-0508-4795-a597-db29d7e47a7a", "comment": "Malware payload", "value": "254e5f5bfc2b30e0996120ddebcdb0aadd14fa72", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418899, "uuid": "2f8c33f3-eae7-4ce3-9c39-17c5cf7f333a", "comment": "Malware payload", "value": "c0950609fd8bb2917f6de59144f1a0d3918251d1274fdd9f1f9dbf428037de37ae2c883d248a1936751bc321dfe8d617", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418899, "uuid": "857d1a62-2571-42a8-96ab-4ff6aa41344f", "value": "T156D53328D6ED445BD18AAF30811744D14F846600DB3B6FE1A394C7861BECE50BFA6E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418899, "uuid": "2c6cbb4e-1353-40ba-a577-ce3782496b98", "value": "49152:+AVIw/c0nKy5F/ufDqZtQE9Xi6QaLHW42DmBf1XBTJsCfTwED51UmV2NhlA7i15i:LJnKy5F/ufDq/rXi6QaLVdTpUx22Nhli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701418899, "uuid": "b7713d31-5e34-4513-bafc-652e05ef6b08", "value": 3004251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701418899, "uuid": "a2e106d4-830b-4769-8d99-8673e87aa468", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418899, "uuid": "1197d377-9743-4223-9c98-325846e01dd5", "value": "rAaLDR.apk.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f292a2a-8fe4-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701392177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392177, "uuid": "dfc91700-9ece-45e5-b283-e443586b8935", "comment": "Malware payload (Stealc)", "value": "a1eaaa73a1c0cc9600a07ff469f1e257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392177, "uuid": "f0af5225-2744-434b-a712-07434582964d", "comment": "Malware payload (Stealc)", "value": "ac24e25abf122f50c3eff690cec633cee1ee0bd11138842364e6c600a7ca8c54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392177, "uuid": "4576955d-5ac3-4903-94b9-d516eab82505", "comment": "Malware payload (Stealc)", "value": "83ed4831e61e1d5a94589a22c2bb8201f8c350da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392177, "uuid": "e19ce58b-7923-476e-8e12-8eeda249f193", "comment": "Malware payload (Stealc)", "value": "3592ddfaa463582b2c9ceedad95a99ef9003d32d9e900e9305360a5843d526b38b5aba03bed55a968616f192ed546fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392177, "uuid": "42c7f644-9927-4288-9a1f-4ef84e06d1df", "value": "T18F64C50382E17D86EA278B729F2FC6EC771EF6508E49777912289E1F14B05B6D1A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392177, "uuid": "60648294-6e60-4567-8b34-42e2a7c3faf8", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392177, "uuid": "50b2ff03-4a67-4d05-b2f1-07c82b639c4d", "value": "3072:N8AKyPxwvtEivlRtJc7Yr6JGAMu5jPXzxpMu63jXdo:WQPKplv6VJGATPXzxyjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701392177, "uuid": "20eca659-904f-4826-89c8-f51cd4f8c51b", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701392177, "uuid": "8daca002-75dd-47c2-9572-b75d94050453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392177, "uuid": "c9fbdd6f-3a1a-496e-b420-796ac201f7d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9e2fcd-9028-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1701421214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421214, "uuid": "22863f5f-b40a-4ce3-8e89-59ac9945f9c1", "comment": "Malware payload (NanoCore)", "value": "445596d8d72006707ffe5f678b83b41d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421214, "uuid": "30f0c16f-3d5f-4ec3-8178-ee7e42f36c3c", "comment": "Malware payload (NanoCore)", "value": "acffe7ab21a1e5967acb391020f1710e1f8cb69a85833073fea4c2d59f5345cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421214, "uuid": "2c4f2251-9097-468b-b14b-3506335fd6f8", "comment": "Malware payload (NanoCore)", "value": "b1a82db821c9841501fecdec1d6cb5239dd780d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701421214, "uuid": "978289f8-8a91-4979-af84-864f504101db", "comment": "Malware payload (NanoCore)", "value": "e5eae7698ec7a04f3f14aed689b9de3ad05815d761c3e1ccb32ddecfe8269517cc880ff8e455915d0e065b723847befe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421214, "uuid": "6837f8ce-c5c2-45a5-9b53-e45267875e05", "value": "T1BF073396627845BBE0EAA57E580FD42601B3F8933362DADF43E49A354F13BE11936F40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421214, "uuid": "0f5c6f0d-ccc0-4b13-8300-38f0836c0340", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421214, "uuid": "3df641ce-5479-4124-9b12-bc4860c72f7d", "value": "393216:a7JqPnLFXl4kUMHdTQ9bAlbRu3oNGtSgnQoqNg7U3XgnNDQvO:a7APLFXik1Q9bO43EQQhN0nVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701421214, "uuid": "c316c726-7fe2-41c6-a964-ec5a2da7665e", "value": 18446336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701421214, "uuid": "89c5c860-7ac6-4a1d-9576-40d268629dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701421214, "uuid": "faa8237c-0fa8-4719-a198-f224265313f1", "value": "ACFFE7AB21A1E5967ACB391020F1710E1F8CB69A85833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3a5d53-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435206, "uuid": "3e79554d-a1fa-42d3-acbf-81fd9c33c1c5", "comment": "Malware payload", "value": "f1ce9c83135959c97be7ff468830be54", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435206, "uuid": "883ca3ed-ed11-4f8a-9354-71d6b79d1076", "comment": "Malware payload", "value": "ae5bf589a6e9b118bb745fab0543b1e26cedf984a43d61dc8a323afe06ef266c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435206, "uuid": "9e30da85-d6cd-4bc7-bbad-5e4f4beb3e52", "comment": "Malware payload", "value": "32e38f75410db3ae8e397cabff7d6c6e4e7e4ced", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435206, "uuid": "7a650859-985d-46d7-823d-436a6308c316", "comment": "Malware payload", "value": "6ff81b6d6958887a8bbd96bca821b92b25cc3af3d50bfe8651fdddc92638ed68e6b68c79bde75ec6b28e15db82492c19", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435206, "uuid": "2736fb67-e48a-4a1c-8b91-d177056974c8", "value": "T103560175731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435206, "uuid": "2860d49d-f013-4d3b-9de5-5d0019c2ba5e", "value": "196608:/DDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYxl:/irUVis8O/0giAZ9PDNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435206, "uuid": "2fe6aa83-1eb7-40dd-aa3e-5e6f9c53014b", "value": 6364093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435206, "uuid": "1ee4a214-906d-474f-aef2-3894a6b6b1a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435206, "uuid": "52147057-4979-451b-bd82-66ddb2232a9e", "value": "FastSub.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cad4c54-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454826, "uuid": "d1f1e0ac-0306-4a12-9ca0-5153f72d341d", "comment": "Malware payload", "value": "51dc1e699b55fb6c6f615fab85f11d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454826, "uuid": "c87dee7d-56c8-4797-8008-014db9d061b5", "comment": "Malware payload", "value": "ae6fba0b86cf089e75de2f673ca8f88dbe73af1194845fb624ec85c4fa5e80cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454826, "uuid": "91ff3b32-eb35-45bf-a457-3fb55b21d1da", "comment": "Malware payload", "value": "e54af0126fa9d61ef6f399cc4548ed86d21c2df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454826, "uuid": "5bcab462-789e-41ef-92af-2ff2497d7f97", "comment": "Malware payload", "value": "18fd4858380d570dcaee083bead51a0c21be910582e4e25abad2136c89a8b62d7d8526760160c17a89111e5c5293c634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454826, "uuid": "2d1dbb31-08a9-482c-adef-54df0ec88284", "value": "T19D84C86D35F8D432C04849322CF197B9D963F8214D538A4FA698BB5E2D3F3D16D220BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454826, "uuid": "15ced5d6-b644-4def-849c-a018c46c27c1", "value": "edf46b6a9aceeebc55eb9cb33ed4d508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454826, "uuid": "228037d5-36a3-430b-b749-e9b86d9d8bad", "value": "3072:wAMbXIVuWJGtAUXOtjCL72miltvX6E0z4J:wbbY4HkRvLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454826, "uuid": "c57eac94-4c92-4123-b1c0-ce54615fb455", "value": 377778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454826, "uuid": "b98cdae2-7580-4f3b-b4de-6d83a92a6572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454826, "uuid": "c4c4e82c-fe7e-4e76-9592-7934fc951ad6", "value": "SecuriteInfo.com.Variant.Midie.137439.32467.11651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a13329c-8fe8-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1701393806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393806, "uuid": "0f783689-230b-46ed-809d-b666dca8f960", "comment": "Malware payload (Glupteba)", "value": "86fbe010876ea39d16d7d411c51ec37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393806, "uuid": "ca36af37-e561-4a6a-acb6-b8f50ffd73a5", "comment": "Malware payload (Glupteba)", "value": "ae9dec17418ed06f57af2df42fc52c285416996c460115ad3a5d8929f0867951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393806, "uuid": "1d516ee9-b34c-49bf-ad28-877523d1c25d", "comment": "Malware payload (Glupteba)", "value": "7c2538dcc5b924bfed76264942b6c4520fa58e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701393806, "uuid": "844959ec-54ed-4dfc-8b3e-7aaa7b412ce7", "comment": "Malware payload (Glupteba)", "value": "4feabb8253b1b5211ad5296d38b814d759137ea2c458c20a9f5dfdcfe95d3ce54ef4ef4b50f9a192085a6b7ca6ba01dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393806, "uuid": "631abf27-86f3-4d2a-aa43-f0749c613f5b", "value": "T15BD5E05F8028EF100DA524B72B9B0290AEB81DCC4075E37196D5B46DF9F880FDE79E99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393806, "uuid": "0b2ee2c2-44b1-4eb5-a787-4f79c3734690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393806, "uuid": "cd76b7ba-634e-4ec5-b2aa-2214b00bd974", "value": "49152:Y2uRLlySeEPbnfQz9YdBZG3e/9iIcWz7ViTBl+MpXYoz2HLMH+aR3M3:Yy6Tnq8ZecQ8Sl+fCOgH+O3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701393806, "uuid": "2044bc29-583f-41b2-bcc5-08bdca75330c", "value": 2848112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701393806, "uuid": "d83e5098-18d5-462f-8597-afde7803c8f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701393806, "uuid": "6cdc955b-1976-4920-9ab0-69a0a99849fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54601a62-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413177, "uuid": "55a916c6-8f19-4ce3-a7f3-04ef76c4ab73", "comment": "Malware payload (GuLoader)", "value": "e8a26832b7070a2d718361ceaed2be70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413177, "uuid": "c892a86d-953f-4375-a3f9-f38376f52f3b", "comment": "Malware payload (GuLoader)", "value": "aeea6fe11416d64a87076cd047112835e12c7ff2ea3eeecc961ca072b06434a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413177, "uuid": "fa0e4fe8-6b08-4b0a-be6e-9aaf96576bd1", "comment": "Malware payload (GuLoader)", "value": "5ffa0795a805b09365268f9d9ad03ca803d77b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413177, "uuid": "27421450-7062-4874-b826-7a63e1d86761", "comment": "Malware payload (GuLoader)", "value": "c02df3da44d37fffd8296d7fe8e2ff07706a673142344a81cb41697908d2715ce448b695647c999ffc4375edd8e52587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413177, "uuid": "b590dfa4-9f3e-4fb8-9197-3b0078edaad3", "value": "T15BE4BE92399A75AFEC2F5674034FEAB22BB96CD07391496E4F80360C4C3554A80EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413177, "uuid": "58d5adc4-02ff-4604-bbd7-e6da3b077a2b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413177, "uuid": "2af6f1da-5688-4891-90c6-ea3b25b260b4", "value": "12288:rnhe2eaLtcvA+efuHdKqtveH6QKxtOxOn291YLW3:7hegT0dKqtK6QKfz2zYy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413177, "uuid": "cd7c1300-65fb-42f0-a674-a22de26ba97e", "value": 659248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413177, "uuid": "a0e1eed1-2ab5-4423-bc99-94a524c62cc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413177, "uuid": "84f66d6b-3a63-42d1-a292-47d7b9e02500", "value": "00158007317748300pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf5606-8ffc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701402588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402588, "uuid": "99e6e426-85f3-4e4d-920b-60a1e5700a83", "comment": "Malware payload (AgentTesla)", "value": "29977072fe45a7d0ec41ce83c5b2cc58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402588, "uuid": "52e3d025-982d-467d-ba5a-bcf3e74aced9", "comment": "Malware payload (AgentTesla)", "value": "af05bc98f43fe36d326207744952acc1a11e122bab8c8c928aa8508d7f2c1b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402588, "uuid": "cfeff09a-db00-467c-8bb3-eac72cfd5d24", "comment": "Malware payload (AgentTesla)", "value": "36139c47840ab64a3d67adc9cf412ae7950ee1fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701402588, "uuid": "abf22cfd-a190-4da0-97f6-58d6b821b739", "comment": "Malware payload (AgentTesla)", "value": "3e963c740bb2b3c40113fd1b5c53ee26d9b04be1a81b0302882f7c44b83ba8f43a2edde5f90532782160dd3d5ee5cb20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402588, "uuid": "f7c5c047-60f4-411b-93f1-7dc82b77a8b5", "value": "T170D40124B2B86B96E77967F0445550644BF13AEF2779E3181CCBB0DB7124B0A8E90B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402588, "uuid": "81d4e2b7-cc43-40c0-899d-cb4e40013e54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402588, "uuid": "141b48a1-ef20-4749-9e2d-7ee5c2a9dbd6", "value": "12288:mq8oD7K/btio951wTef+fpyXCBcgK7fqttzhZTrifS9hxC:eBH951w6f+fpyXCB4khb6SI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701402588, "uuid": "8fd67db1-e6a8-44dc-bb71-e39f23d4c4e4", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701402588, "uuid": "82a25d8c-d513-469e-88f7-df4353591078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701402588, "uuid": "695e9ff0-b82f-4114-ac59-5be10b4b6da0", "value": "29977072fe45a7d0ec41ce83c5b2cc58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a722d1-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413267, "uuid": "45d2608c-0717-4334-ac5e-85a521853c75", "comment": "Malware payload (GuLoader)", "value": "41c817d6542edcd8f7aeeab0cc65db2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413267, "uuid": "8fe46278-e227-42d1-88f7-1ad5e67b7762", "comment": "Malware payload (GuLoader)", "value": "b089673a44363a7c78cdf9b9253c4d98e3402aef6441e624ee0789e3b9b54dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413267, "uuid": "ef63e2a8-4d48-4d3d-8bbf-cc189faf64f2", "comment": "Malware payload (GuLoader)", "value": "a522777e7cd387650ec30e56d7618429b3c25efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413267, "uuid": "fdb9382f-f6ba-49e2-85a0-0ec42dbe7476", "comment": "Malware payload (GuLoader)", "value": "8b701f26ccd55ef326a79aa1e3500db2c3a970fb3ee0a1130aa6fa694417c4c4f26ea9fdcfd61da1561a84f2e44a1490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413267, "uuid": "bacee483-1d6e-4823-b669-bf78e394409e", "value": "T1C1E4CE9639CA72AFDC2F4678035FEAB21A755CE07382496E4F40761D4C35A4A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413267, "uuid": "733f6231-ae01-4261-82b1-a60f863be78e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413267, "uuid": "62145e2d-b129-4a15-8c03-d98b46fff31f", "value": "12288:tkEnhe2eNVZRTq8AgIAs3DBOenLgf3RfiMv3aqEAdv522K7abjI:bhenVZ085IB3FOMsB7EAdv02K7abj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413267, "uuid": "fae457ed-515f-4cf1-b5d4-6ab16da10693", "value": 659742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413267, "uuid": "41a5b45a-a432-4dc9-932d-fccd4ba7cf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413267, "uuid": "84ea5477-3d27-47d8-86b2-75b7e03f052c", "value": "Altogether.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a7ae14-9014-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701412883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412883, "uuid": "68a4fa2c-ca25-4c94-8942-28b6260c5200", "comment": "Malware payload (GuLoader)", "value": "0747baebf03b8c3f8c439869f3dca354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412883, "uuid": "9ab9c919-5d39-49cf-8f6f-1a8b8480fa7a", "comment": "Malware payload (GuLoader)", "value": "b11f1168de972b6434369a266a642ec91d25dc77db08b12de5c4f8b2552e7e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412883, "uuid": "51bec0d6-14a4-4e62-802b-d7f8666ee8e7", "comment": "Malware payload (GuLoader)", "value": "8d6655eaa9ea50bff59efd63c1562d0814681b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412883, "uuid": "bb45d477-516d-47e8-ada4-035e8bbd4f65", "comment": "Malware payload (GuLoader)", "value": "800479823ad759f1b76dce01fba7820d6ef8ca118e500c6959e7f12f824ea8dd3df821639da667bf6a5a4191fbae81ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412883, "uuid": "c5ff7146-cd7b-41ce-b2fa-3336368bd04a", "value": "T1F2E4BE92398975AFDC2F4A74034FEAB22BB56DE07381496E0F40760D5C3694A80EDED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412883, "uuid": "82c360c4-261f-41c2-9bc1-727749ecc8de", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412883, "uuid": "a0153fd8-c768-47ca-8a83-652ef72ae6a6", "value": "12288:Nnhe2ea5OAhF5vSBufysOWeK19n291YLWZ:dhegLnvCufVeKz2zYyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412883, "uuid": "b1efcd4b-c628-4b98-8c5b-55ede22f0ba8", "value": 667408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412883, "uuid": "dd9406e8-9be3-4f00-aadd-defad198a80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412883, "uuid": "a5751977-febb-4be8-b886-d14b37cf4728", "value": "Ticari Hesap \u00d6zetinizpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba854ff2-9030-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701424945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424945, "uuid": "20855d15-bc54-4b11-bc8a-bffd2d97a42b", "comment": "Malware payload (AgentTesla)", "value": "f06ced89e9f041ea9907fa750a31a5a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424945, "uuid": "b1218fc9-5e2a-4a17-825f-62ff57660e65", "comment": "Malware payload (AgentTesla)", "value": "b12f4fb9ba8afbedede9a6132fa5c92a25045d33dd93dbafcb042dbc6bcae529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424945, "uuid": "5730c5e3-9244-437d-8a2e-9b1c9cfe65f7", "comment": "Malware payload (AgentTesla)", "value": "a5adcfede6509ef3f19c4774f1438d8b1da8ec55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424945, "uuid": "9af67d32-7ec6-4fe4-ada5-806a4c3a3927", "comment": "Malware payload (AgentTesla)", "value": "0d630a3eacc3392cef057d19c485b2353b355b6781c614163b246e79bb3b9d0423677bda2761fac5eb5e82060f4dc005", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424945, "uuid": "19bf9359-af51-41d2-878f-edc435bb32cb", "value": "T1DE15DF59325449A3DDB94BF504B6E84003B12E1A38B8E6CFDCD271D63BF77E214A2A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424945, "uuid": "e0e9d524-318e-402c-88f8-24a7c532c273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424945, "uuid": "c3229a84-3d4b-47a6-af68-9ac58d463300", "value": "12288:b+fL9rf814Ok9fCy7ib/FQItk/n0QCt/d/7ZI9+lMO2OPWtddjcd8SLGA6LKMUBY:bELL0rl5ZK+LCPdjcfGxLVUBYrro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701424945, "uuid": "c5681764-43ad-4ede-b8f7-e94aef196903", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701424945, "uuid": "7155770e-bb93-421c-8899-fafe586002eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424945, "uuid": "f7b89fac-e5d9-4dd9-b706-2844bdaef1f7", "value": "Ningbo-Overdue 974356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554d9e2b-903c-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701429929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429929, "uuid": "e46ad254-0a1d-4c16-83b6-f753c8d053c5", "comment": "Malware payload (Socks5Systemz)", "value": "63d85481911b83bb270f8da986190e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429929, "uuid": "55b326ec-788a-4e6c-8fb0-9e127b610001", "comment": "Malware payload (Socks5Systemz)", "value": "b2b910725e39af508364c063bad61249e2f65c2937f04ffad6ed4e99795acb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429929, "uuid": "9e0570bd-d438-4649-8b90-0d0decf874a1", "comment": "Malware payload (Socks5Systemz)", "value": "5463f23b64a9ff4b6e0928b76c4517cb568d2e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429929, "uuid": "44548631-c37d-45a2-9478-8c7e54df1107", "comment": "Malware payload (Socks5Systemz)", "value": "f04e4cc33abf91a2bd863472d5d89b0aced0f2bf8aa381c9161c957906fe8e7575953a23c3ad848140aa4e0d02603f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429929, "uuid": "eb509285-4ada-4a7c-a82e-c7d5d8be00e0", "value": "T154E5339212B3C436F891457248E8A44496D3FA214AB47D96250EC6CABB335D6F0EF37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429929, "uuid": "385e495f-ebad-4ff5-99da-1f486129cbc5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429929, "uuid": "8408121c-3e48-4ce3-8651-14bd8fc0c07b", "value": "49152:h2V9j2tB8nFGjZqzfN9VporsIKpeN+sivVAvtgUeYqpMqK9b7Bz/sI:kV9KBi9grsIKcNBivVA1g4yMx7Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701429929, "uuid": "1f812c67-289c-4c71-8300-65695978f684", "value": 3102974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701429929, "uuid": "f792e8b1-aaec-4a96-a32b-f9360015a970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429929, "uuid": "ab0135e2-be49-47e9-b1f2-114a85256964", "value": "SecuriteInfo.com.Other.Malware-gen.31979.22356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51701fb5-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454834, "uuid": "0b07e740-7e2a-4875-9277-eb2756dd3f78", "comment": "Malware payload", "value": "7613f8fddef4a44a051279c47becdb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454834, "uuid": "2a7a8221-a66f-4dd2-8c70-8e6eb0af64a2", "comment": "Malware payload", "value": "b3411bd2ee784e8f2b020960d04a3596cfd37ecd36999121c23f98a9dc208930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454834, "uuid": "ea3eb47e-5439-44da-bf4d-a0e6240e824d", "comment": "Malware payload", "value": "b173f0fac40876aa45da36c090fec024dbfe3f8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454834, "uuid": "5b1687d2-644d-4603-84af-38cf17f10ff2", "comment": "Malware payload", "value": "946003b7e7a632f4f31ea4481b0f14a52d7166bed4c0bb61ccee6a7cabd9a7b0ac83a16de118a7ca2956180653b7bb7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454834, "uuid": "a0c1d440-a350-4035-a888-f82b64fa8eae", "value": "T17AC4A213EB60641DF8928471ACF59A6A28153C362548AC4BF7C1AB4D3635AD3EDF072F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454834, "uuid": "d0c3c9e8-0aa3-497b-b9df-72ccb8ebdd7e", "value": "12288:qJAQaUy84FNKreM91jGL3g3bA3iBQq25fEG5DsGh/eAq:erPgL3g3bA3imsGKGNeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454834, "uuid": "ef318919-a0d8-4ad5-8662-6797da16a15c", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454834, "uuid": "a13e720a-3b4d-4a64-9039-f1598e28f551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454834, "uuid": "0f61db54-d14b-4e0e-a387-6d9bcb25c4af", "value": "SecuriteInfo.com.W32.Agent.CC.gen.Eldorado.1975.17446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d77d55-901f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701417446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417446, "uuid": "37db3f8a-5c8e-45e4-86d9-aa789e61a339", "comment": "Malware payload (RemcosRAT)", "value": "260a46793a3e16f14dd5d49c0f73512f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417446, "uuid": "10f4daf1-02fa-4e44-ae3a-1f88b4e3f06f", "comment": "Malware payload (RemcosRAT)", "value": "b36bca2cc1dd84ab12652cc17cbca89e3feebb01dc5563aaf8155fce6be035aa", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417446, "uuid": "8ad8f4af-6ae6-4986-9639-dd29c6071e7c", "comment": "Malware payload (RemcosRAT)", "value": "e0273840b94ff6ebd9d9d64c68f94d6dfb97503b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417446, "uuid": "3607285a-a51d-41bb-9f9f-64579e3c7acc", "comment": "Malware payload (RemcosRAT)", "value": "4d91bd91af265818cf3f2f87dd02983d903bc172f461d6316d16a8546e54fd113bf6feedf6857dca2527eb85050a3b2d", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417446, "uuid": "d83f88aa-1e20-44c8-be85-3bb6b98ce443", "value": "T16D852355FA229F73C429E431539428B8D2C30C3B242773CD72973F6CF61BB969521A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417446, "uuid": "e6664cef-7607-464e-9de2-77aaa7232360", "value": "24576:xO356Vbb0Y8SNH+OzfMlIJIndfD0qINHw:Y356VbbGSIOzElIJIndfD0FNHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701417446, "uuid": "1aa5535d-f3ca-48de-bc1b-a81f0e129d54", "value": 1723793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701417446, "uuid": "6cecccd5-2c3e-4b6a-91ff-d84a41a0ce95", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417446, "uuid": "f48e8f2d-b445-4560-9f56-52ac01b7f59c", "value": "YMC_CENTRE_01122023_ORDERS_DECMBER_LISTS_DOKUMENT_PDF.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34792755-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442330, "uuid": "27c99c7b-6a05-4bf6-a17b-40956f1b4f13", "comment": "Malware payload", "value": "fc23452e48fbe2ba9de761ec18437ae9", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442330, "uuid": "7cc78fd6-4df2-490d-9c37-5b4bbbf47bb3", "comment": "Malware payload", "value": "b4105a76ae6c9ed30c170a39a387746518b2ac78c5a5463d9e70c35915ad0b6e", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442330, "uuid": "cabe2813-6966-4aa0-998b-ac6a1dde8320", "comment": "Malware payload", "value": "5289688ec6a984be4373b179586327a73842baab", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442330, "uuid": "393caff2-27b2-4657-9410-e3fb11303e4b", "comment": "Malware payload", "value": "a24d62958bdb9ce336db84fab42aa8464999e00ab861662359bcceae5a6a4b91afdd078a1e8c63320ff30c886cdbe01b", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442330, "uuid": "9ef8ab27-e912-4969-b471-fcfe348e0a41", "value": "T16C15AE84E5A45BA1DDB9A7F01535C93407733DADA838E21D1CCD7CE73BBAB821412A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442330, "uuid": "3f7d5f26-3f83-4cd6-8c7f-ded3d0f97700", "value": "12288:AvNIAMRwaeCuGyPGoOz8dcn39o3l5LEmos8x93nT6WP7r9r/+ppppppppppppppx:o/bCFy6NCgx393+W1qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442330, "uuid": "8033bf78-a6db-47cf-bf4a-b67da5a581fc", "value": 948998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442330, "uuid": "ca8fe386-8275-4d1d-b09e-808e11259fda", "value": "application/x-ms-wim", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442330, "uuid": "70145240-9643-49d4-be10-217c98737a71", "value": "INVOICE #901825.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11d2001-9073-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701453733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453733, "uuid": "7ae60698-1373-4687-a4db-6ad4655dd6e3", "comment": "Malware payload (AgentTesla)", "value": "cc6f4d2f70c0b2e78b3a3a2ac85d6558", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453733, "uuid": "51a554ba-713a-4c27-a1a0-c601a3724f6c", "comment": "Malware payload (AgentTesla)", "value": "b63c7c8967a492c0c2a30d0b0d4694cfa693b1a1b6db3d7498d4d526889ecc44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453733, "uuid": "4a87ad3c-490d-4ccc-84e4-1b9722dce697", "comment": "Malware payload (AgentTesla)", "value": "884533d77211f566b0dd3d6b941f95601a1c0665", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453733, "uuid": "4ef90e62-f06d-44cc-aa16-47bc55cb085b", "comment": "Malware payload (AgentTesla)", "value": "bcd33b0a1cb9b06bf94e1ff5c5fc69127093307cd3087cd11452c562a0c7f9df4a4ea364743511b8a9d50d9749ec41db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453733, "uuid": "0c9ce84a-5875-43bd-89c6-5bfbd7566db6", "value": "T1AC94E7006FF94A97F3AE2BB9A8B155104F78FD05A4BBE70E266870F81E773105A58353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453733, "uuid": "c928b611-a360-48c3-919e-d208a0004edb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453733, "uuid": "35993db4-178c-4485-b5fa-4a389cca9e2f", "value": "6144:gecVmg0JrRy93uhVr2qIfWY3Sksh3z/5:oVCRZCJWARIj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701453733, "uuid": "c42f2a80-5e5c-44f3-96a6-f5c08a055f0d", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701453733, "uuid": "349e1639-84ba-43bd-912b-5420f564c6fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453733, "uuid": "630df908-1aea-4fa1-8b07-95a3787d3451", "value": "Orden de compra 20231130 RingaCorp LTDA_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a061aa71-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413734, "uuid": "515cc290-01de-4488-865f-5670410c35e1", "comment": "Malware payload (AgentTesla)", "value": "5b6b7be15bda1f17de94992fa7d1d226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413734, "uuid": "18f7b721-11a3-493d-a726-88924597807a", "comment": "Malware payload (AgentTesla)", "value": "b65fa79999540d67d3d3265a2d5081adf2a2119ebefa258dd4c3bfedaa203f03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413734, "uuid": "8f02db05-7d8c-40d6-8512-c97e4971aabb", "comment": "Malware payload (AgentTesla)", "value": "8d6576e8945a3c635376ef1ec1ed4edc7a02a089", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413734, "uuid": "123c0a6c-6c1b-403b-a12f-88ab1c365b8e", "comment": "Malware payload (AgentTesla)", "value": "7f8b8887fc3657400a3c435245dee6cb4b09c8feb861f6442ec574d7c1f53336bae2898fdeaf0b651b2e5712f40ed2c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413734, "uuid": "c6688913-840b-4ba2-91e6-047b03ea151f", "value": "T1CAD423C48D2047997D1E2AD2BAF19129F893F884A5D2661E433FA5853ED11CFE49F7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413734, "uuid": "61848a63-2b06-4de1-89f5-a205ea09bcf9", "value": "12288:SHhSevzMMXKP6xmYG2yO92n5NwAaxuknP2/3LDyxV7S8qoidn3mh6GvO5+fN:SHhSIwM6P6kYPyO92nInA0QoJYGgaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413734, "uuid": "87ab1557-77bf-48c2-92f8-88de66ee9320", "value": 641637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413734, "uuid": "f19bdff5-edfc-4f92-b80a-e936f70c8405", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413734, "uuid": "21ba96d6-9430-49df-b168-8d48300bcc5a", "value": "SOA OCT-NOV 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52701ee7-9076-11ee-8907-42010a9c0042", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1701454835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454835, "uuid": "bb6ca0dc-899c-4b41-97d2-7ca37bfc9f9a", "comment": "Malware payload (Riskware.Generic)", "value": "e65b91e9554da7da329de0562a0a8bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454835, "uuid": "4ce68b9d-3061-4735-a4eb-4f74ce94bf56", "comment": "Malware payload (Riskware.Generic)", "value": "b66d4567931de3ace219a0ae2ddca9e5535bc1062613d3bdf7418e3edf0b6db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454835, "uuid": "bb035c5d-3960-47f5-968b-d6044337993c", "comment": "Malware payload (Riskware.Generic)", "value": "9fcbeda7803f46944d10c4a8cde716d33e1d2ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454835, "uuid": "42d02d62-848b-4ca1-bda6-ffeb56c25617", "comment": "Malware payload (Riskware.Generic)", "value": "decc267d76c17e14c73492301101460797ead6565e3a5ba65d2a604f05b3fde4d38b02bac1a9f803c34754f524d3596c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454835, "uuid": "6a8918db-db01-4d58-87d6-798f1c92a064", "value": "T158053322944CAC05CA394F3E2F2B993F4F6B8C215DC77E978D226A311994670FE29735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454835, "uuid": "c211bf22-e114-432b-b2b9-4eb8d2fceb4d", "value": "70fdb1cc5a7f08af3dc8a9d56cb41801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454835, "uuid": "77122af5-549f-4991-9ff4-6107e6b77064", "value": "12288:TSdzNarP7xTNeZmcXZzmXnXSIhlSNiGmxDPDSXHzfjgZchIFPInRHE/FyLdz655S:TkpaDZNU1JmXXHlUiUv8ch6AS/FgyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454835, "uuid": "5ab61d01-ccee-4d9c-b1c1-e99a83d4a83f", "value": 869999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454835, "uuid": "0b75521b-0c04-4ca9-9a09-c35560c70758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454835, "uuid": "ac37cb16-3308-4a38-8e8c-687563593667", "value": "SecuriteInfo.com.Trojan.Packed.Based.12196.884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29937bfb-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442311, "uuid": "d6ff18d4-26af-406e-aed0-d57fa40b4818", "comment": "Malware payload", "value": "f06734496ae55f02be2cd71254275f39", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442311, "uuid": "c1362695-c983-48dd-9b51-5215aca9c4f7", "comment": "Malware payload", "value": "b6d5c67dccc0b07a2d9c7950842058e68921742f43321a38aaa21ae027bb7586", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442311, "uuid": "fd548410-fbd4-44b5-8c45-c3c22f64a346", "comment": "Malware payload", "value": "1bdea9e505db9b428236ea370c4d729dff44b232", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442311, "uuid": "ab3ae561-bb72-40bb-8fba-99a843787548", "comment": "Malware payload", "value": "6f688138e5d248d5915c5ceea0bb994ffff71efcf25d070027206c4373a381a3b1f5b6a58b0fa1e7aabbfb96b0cc97df", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442311, "uuid": "98783a97-257f-4676-835b-5b377308d349", "value": "T112560175731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442311, "uuid": "6e47d4d3-486c-4820-81f0-64353e79d02d", "value": "196608:/yDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYaO:mirUVis8O/0giAZ9PDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442311, "uuid": "0857cfdd-b154-4a05-8644-1f7872ea6fc9", "value": 6380477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442311, "uuid": "f45fccb7-c72e-4e0a-960b-e1f8d727bc8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442311, "uuid": "d7de0fed-a223-4b8e-80ce-cf5074cd9083", "value": "\u0412\u0438\u0434\u0435\u043e\u0427\u0430\u0442 Herzi.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77108638-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701413665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413665, "uuid": "d36c09d8-b09e-4b98-95ec-5c490db3b8d7", "comment": "Malware payload (Smoke Loader)", "value": "39984dd8a5e8246ce321592c274114fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413665, "uuid": "b1b4fe17-00ec-410c-be61-3cb49ae3bc3c", "comment": "Malware payload (Smoke Loader)", "value": "b7e1e34df8d8f63cad1d66970746631001c34f2bad3f86e3a517e5ebdfdd6b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413665, "uuid": "3e0f6ec2-6836-4e3c-8f76-3b83822828bc", "comment": "Malware payload (Smoke Loader)", "value": "7a80fcdffbc624c54b4df3beaa9a3d1d108c7943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413665, "uuid": "3e107539-b6b3-4007-8d9b-d6face976397", "comment": "Malware payload (Smoke Loader)", "value": "97f7393d237fa909c05d59dca1c7262c0590ed01ea6a7de30475b44fab8651baabb545059dc6f0b3e86d6f3339ac6c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413665, "uuid": "db6d2ffb-9d21-4f31-a49c-0c928cafbfc0", "value": "T17264075782F5BD40E9278B729F2FE6EC771DF6508E8A7B6922189E1F04B0572C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413665, "uuid": "c4e38d86-b92f-45a5-8945-48a396ca8281", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413665, "uuid": "cb23d5b5-f113-4763-86f9-82e37dbcda17", "value": "3072:ZEbn4NJpfmROpECfWYS1hiwAhvJtPOSm9Zh5eAIUUXdZ315U:GcNJpfmmHCiw6vYZKAI7NhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413665, "uuid": "7047cb80-f8f2-48a0-a70a-4f6d408a59ea", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413665, "uuid": "d214fc65-cc1d-458b-b888-b7f266fb33ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413665, "uuid": "843ab9ca-4e03-40a0-9b7a-8d51e81399f9", "value": "39984dd8a5e8246ce321592c274114fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569c646f-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454842, "uuid": "e38da71e-fa66-4a7f-ba53-0f14bde572d4", "comment": "Malware payload", "value": "8b45de23d0b6ade07a5f6c80056e11d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454842, "uuid": "3c7d490d-8a69-4a05-9362-42c0f16c933a", "comment": "Malware payload", "value": "b828f52d0a7d80b4babbd4a9b5815315e994dd49f3253303aad3afcd7f923dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454842, "uuid": "854b0919-8b48-4859-b051-72fdbd8b4ad7", "comment": "Malware payload", "value": "63646dce05f96ba1558e3c2253474f5bc7d3bcc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454842, "uuid": "18f14a3f-0b3d-40d2-bd08-3c079c274a5f", "comment": "Malware payload", "value": "1b2d40e4de12f0600c703d64bd082a16b8fcb77b8313def7352c88b4eead4ea0ca35d35c92cd1fe4a4ebba7d2f2910c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454842, "uuid": "8606997b-6a78-4c15-a78b-4bcba18b90f0", "value": "T1D02523603743ADC8C3510B358D9B45D16B0D7D8EC6B09FCB21E53A2EBBFA999A5C3610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454842, "uuid": "42d91418-bc3a-4521-af63-c01c4273f35c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454842, "uuid": "c0255923-02e1-4aca-9c01-aebed86d90ea", "value": "24576:cXeP4PiOTxO4Az3FPiDVOjtcgq1hDov+EmJ112sx:QeP433ABacq1h2+nJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454842, "uuid": "b2a028be-397a-43da-8d0e-e09c643bd8da", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454842, "uuid": "1457e705-b55c-47d1-bc52-9673dd67ff10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454842, "uuid": "0502d304-0c24-4a81-a833-2a3f37ae267b", "value": "SecuriteInfo.com.Win32.Evo-gen.20184.6826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b532bf-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701412124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412124, "uuid": "ab88cae0-98ef-4c5d-9b22-64686bdd1bec", "comment": "Malware payload (RemcosRAT)", "value": "567c79fbc213d5c16b81dd5f6b0e227a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412124, "uuid": "5114fb85-10ad-4fd8-a5cc-d48668adf9db", "comment": "Malware payload (RemcosRAT)", "value": "b8a41895f98a7ac48e2834e43ffe027b834c7c3c9e396531803fa82ff977c19e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412124, "uuid": "bb3be619-bc59-440a-af44-0fd6748677e0", "comment": "Malware payload (RemcosRAT)", "value": "31882c06d4fdb4bd87902fa3442fc3541d25e2fa", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412124, "uuid": "8d914cf3-ceb1-407d-9315-bb20ad8018ac", "comment": "Malware payload (RemcosRAT)", "value": "4137510843d50967a90556cc7703917e2d7d31eb0f873c250a5cf91a59a4b8fc1e59a574e1679ab47439ffbae4dfd9d8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412124, "uuid": "d928dfcb-bb09-4f5e-b78a-39ec82ea92e3", "value": "T1C3F3E36028EE5148F0B7AF296FD4FEE15DBFF6B4063960F05248131A8D62D42CD91BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412124, "uuid": "ce022bfe-f341-4199-ac67-82e78b17a6e1", "value": "768:Quw6xFf66s6zY6m6RnM6OX6MHu6l6LXa2azarauauauauauauauauauauauauauX:Quw6Tf66s6zY6m6W6OX6Eu6l6cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412124, "uuid": "45cf4107-6ac0-444b-aa5e-e8544155daf6", "value": 162628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412124, "uuid": "10d5aa45-dc83-4545-ab1f-f45ddee88a3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412124, "uuid": "1caca8cc-2b9a-4e58-a148-e1f311db1842", "value": "DHL Express Shipping Documents_docs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23c446d-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701403510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403510, "uuid": "801fe957-8dfa-4b37-a0bd-9ea48619f885", "comment": "Malware payload (RedLineStealer)", "value": "1d4fde23037b89e03945ee6b4763a476", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403510, "uuid": "9985a72c-5c76-4d52-8f3e-7ccd896599de", "comment": "Malware payload (RedLineStealer)", "value": "b94e542ed8b73ece3f4c01eaeccc5855ed0f3c4e04bdbd95cc1fc592b1aa0bf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403510, "uuid": "cc7a7cce-6fab-498c-93b0-8c5458339e24", "comment": "Malware payload (RedLineStealer)", "value": "b1334a9b515738d1fa20a94c50f956569a673a9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403510, "uuid": "597c53ae-c1b2-4387-9e57-f80fbaa5ae08", "comment": "Malware payload (RedLineStealer)", "value": "0ce9c8bd5253cf2f8aa04c6c77a87da97ae582fb79824771b4f93cff5def4ef81ce97da0e5f904a1bb3b0a01acced2a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403510, "uuid": "06dc0c55-62ad-458b-8dad-681c94047b22", "value": "T1B9250112BB59DEC0E51C40702933467661B2FD968DA30B5B785FFE2D3EB22022197E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403510, "uuid": "1308dc7f-d7a7-4917-810c-2576a44d3a6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403510, "uuid": "c808c2d1-a7b7-411f-bfac-a40a367cddb4", "value": "24576:wmBXh8ufyksiEpjG+RcpHHqZfONgwKK/yz:9FLd+rcpHKQzV/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403510, "uuid": "7d229a51-e6d1-41e9-933b-633611a24b28", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403510, "uuid": "f6c255d3-786a-475b-9aee-6767e7a310ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403510, "uuid": "220ec8a7-298d-426b-9514-4023c89ac8ce", "value": "1d4fde23037b89e03945ee6b4763a476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892106c1-8fff-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701403817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403817, "uuid": "86ea6a85-d37f-4ffc-af7a-6782123d9396", "comment": "Malware payload (DCRat)", "value": "2945e382970f23a149ad5b10a32e79cc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403817, "uuid": "554363d8-1fe0-4be4-b625-b7b980ff0a47", "comment": "Malware payload (DCRat)", "value": "b9bf86ca557127ec61bbbaf9675686ee155186f3b4f4d1d80bf94b17a04b7371", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403817, "uuid": "f5b127e5-4c58-4921-a04b-76c3509657d6", "comment": "Malware payload (DCRat)", "value": "b392e3493f3b796984a2d5de278db240f7e732c7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403817, "uuid": "83571c04-2c4d-4f6b-b5e1-26936efecfe0", "comment": "Malware payload (DCRat)", "value": "0156d10f7ea6e40b4219867c6e5a28573eaca5e4281e92ec423f2f242567daf670cb2fa52845e92573c40a94b64c8ddc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403817, "uuid": "36cc63e7-38f7-49ee-b699-1b01589e471c", "value": "T1E9E5E006A5624F73C2A47F7098CB075E52B5C726A213EF17362F28D2A916270DB171FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403817, "uuid": "b90d6b5f-506e-4fda-8169-22945fc3c670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403817, "uuid": "3d394fe4-4676-4f90-be26-02121adf5417", "value": "49152:7q9irP9ZqCTT7UadcNh20yhnmhcJav3U56UZB1poQKhNb0cl/w:7qMrF577dC20y8fUPZDpxgb0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403817, "uuid": "c8293bc2-beed-453b-b41e-a9d5b063f9f1", "value": 3178496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403817, "uuid": "ab125a57-372a-4cc5-8500-eca8313303c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403817, "uuid": "99dc0458-a9c0-4836-809f-271d499eaaff", "value": "2945e382970f23a149ad5b10a32e79cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b735cd-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (N-W0rm)", "timestamp": 1701403513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403513, "uuid": "d4b27710-29af-45f7-af62-5476533f57db", "comment": "Malware payload (N-W0rm)", "value": "077b9b86f7cab57cc5dd4932cbd04b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403513, "uuid": "00599a4e-0665-40de-b0d8-bcda5eb0651c", "comment": "Malware payload (N-W0rm)", "value": "ba4d461d394b8345604518df33c0d7b09c2278c9fdf2dd747c28047d0c35cfe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403513, "uuid": "58b897c5-7a53-4a98-913b-897abb484c2c", "comment": "Malware payload (N-W0rm)", "value": "40327a7aec2b57fbe3aa7b4698d5facc1870eeda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403513, "uuid": "e5d52694-bef0-471c-a1bd-b0fe4fb99b14", "comment": "Malware payload (N-W0rm)", "value": "8dace4a0b3b012e3a9b32ea2a13318bb727ff5aa1b23e2b742ab7262ca845bed1cfa44b7f27322ee81379968921ef5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403513, "uuid": "bdef0020-0100-4901-a8ca-8f75ec0cad03", "value": "T1151523A5AFDC81A2D078507409A171809BFEFA631605E3D6F58C0747BFB3BF5992068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403513, "uuid": "b9580033-ea6e-4231-95fb-b0b93c792f35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403513, "uuid": "32d1345f-cfaa-45fb-95a8-50d9e1875467", "value": "24576:fTfJ6KpXLhySBDOBGeipOF9oY23od+19AVaMsLyOtPwn:l6UXLDOBG1pA9oNod+7SaMCtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403513, "uuid": "6bb0f0d6-1367-4ef6-b3ed-9301b32f53ca", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403513, "uuid": "9a6cdcb7-8f7f-4ed0-8baa-74eb712eb294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403513, "uuid": "d030f2d3-e960-42a5-a6b7-6df5fd41ae52", "value": "077b9b86f7cab57cc5dd4932cbd04b48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f75046-903f-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701431137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431137, "uuid": "bedefa1a-f3d4-4db2-a595-0164d367aa4c", "comment": "Malware payload (Stealc)", "value": "553063f295f478eb2cb59469f5895722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431137, "uuid": "f01fdf9a-d035-4984-a32a-3395bd8f7f7d", "comment": "Malware payload (Stealc)", "value": "ba89f092b79e2be9a65d497aa9136db0ef3ba26531b30a2d20bd6ad77ae94392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431137, "uuid": "9075ba53-5b03-4582-9f31-279834270896", "comment": "Malware payload (Stealc)", "value": "75546161ec3dd5aed2a837d72a8551626d33e514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431137, "uuid": "5c4be9a5-e69c-4359-8398-6fe8c6b262ad", "comment": "Malware payload (Stealc)", "value": "cbed6ae33a3405ce4b52ce0b214dec7305cc2122a701422d6708aadf94684d9ada6181268603837d61a15cf1e665ff82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431137, "uuid": "6c8580ec-aab6-48fb-8c00-be46362527c8", "value": "T16734BF2276D1C032E22319354970C6A55B27BCE29B658ACB27D43F7F9E312D28B7474B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431137, "uuid": "9e066250-7d37-44bd-9d02-739cce33ed81", "value": "1e5043715b5ec4c1a45256db4effd68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431137, "uuid": "7c7f8a7b-7044-44b0-8ff0-a25cfa0390d3", "value": "6144:TuDOsSH/FaL6ndDsti3vI/DzQ1l3A/1NhX:TuqaL6ndDU6kDU1l3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701431137, "uuid": "625d6f02-dd9b-4750-bb5a-a747a2696a1a", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701431137, "uuid": "ad71f62e-42f8-4796-acf5-345a13dda224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431137, "uuid": "41754a04-cd02-42c8-ba09-91ef99d4e340", "value": "553063f295f478eb2cb59469f5895722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ee8e76-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413308, "uuid": "d80f4761-4345-42e5-a742-c4412215f1ec", "comment": "Malware payload (AgentTesla)", "value": "706db86ba1dc103e4e0c077df259f2b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413308, "uuid": "ab7c7b69-400b-4f34-8df7-529dd42916f0", "comment": "Malware payload (AgentTesla)", "value": "bb43b2c0ebce3b50ab06f88375624660207270a8f14b0ee952b40f1810f1c9f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413308, "uuid": "ede3a473-fa95-4a6e-91f7-be69bec3f947", "comment": "Malware payload (AgentTesla)", "value": "0596787953854f3f051e854b463f9f491f1edeee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413308, "uuid": "28e482e8-feac-423b-8ba9-954d75da6c9a", "comment": "Malware payload (AgentTesla)", "value": "4d1253a2f8138e62edaf3889f2be1cffd3cdcedba3971a5f1663caa59f2799bf9b632663f29814cc546ee2a14a3085cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413308, "uuid": "8ad6edc5-3a0c-4fbd-a92d-aebb10b70a3b", "value": "T14CE41200BC968216E4859B3B19B6E1F0C7B1230F19B3CA1C1D5DB5B6ED32B5369827B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413308, "uuid": "5b029165-4b06-4c6b-9cf1-2c2190dd45ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413308, "uuid": "beb748e1-040b-4a03-9aeb-9232a582e363", "value": "12288:MVo1gur4bP98Ev8mm4jy00142pl90QwJ1PFtTNlHxanDNumB0:GoOa4bPhnydVBdI1vxlInsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413308, "uuid": "4c6418e5-3ca9-491d-9ce3-f6ac83ac4466", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413308, "uuid": "2f7f89a8-0f03-4f16-b1ca-3b191f27a10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413308, "uuid": "ee77dd9c-fc3d-4d66-a527-b7c77558ed1e", "value": "PO #50927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62ce57c-9074-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "06952a08-db20-4da3-af2a-a70a1def6762", "comment": "Malware payload", "value": "6a1c0cb2c30f2bd30ac02506afd5701a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "6dd3e068-da93-4e1c-bbd6-2afe229a19dc", "comment": "Malware payload", "value": "bb6aa1136031783b6a94b84d8fd97c752126067113cd2c764b6176cf5e4cbf7e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "18a0e274-c37d-48aa-8ac9-eebd4052f536", "comment": "Malware payload", "value": "7e3de542f79118f276f50d46ae4a491e33395dad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "769c617f-3eb3-4473-92aa-4d8ba0e1f819", "comment": "Malware payload", "value": "bffdd8a4b584e6ef23811970ec3238d3e0a5fd7c277645079370309c75947694daa9936a6eb73267f1fe8bf3ba5c933a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "a0079cc6-5a76-4f6b-ab9b-4ee98b105d7b", "value": "T14333F32A774E4D25E765EA77415D8A8E4EFCF73A32C140D0BABCA3743B2D50E8A61074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "ed591645-ff61-44d5-b61e-67b37c40413b", "value": "1536:j+GKFijqk7mY+K/Af3Q8TDuOyVv9O8GZOj:VQK/Af3QMDus8GZOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454224, "uuid": "cdf2d0a8-0904-4372-8e4a-fff4b3e91406", "value": 50536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454224, "uuid": "07e3be87-f611-4f34-9beb-8b217a6c02ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "90243185-bf5a-4cd7-8afd-11fea3ed2e2c", "value": "microsoftdeletedentirehistorycachecookiefromthepc.Doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b76219-8fe9-11ee-8907-42010a9c0042", "comment": "Malware payload (Grandoreiro)", "timestamp": 1701394250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394250, "uuid": "cc23b5d1-08ad-4d59-bfc4-a2279cbee674", "comment": "Malware payload (Grandoreiro)", "value": "59d8999be7c30103aa1bf05f0560288b", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394250, "uuid": "f0174823-d746-44ef-8e83-cd41e5ad6504", "comment": "Malware payload (Grandoreiro)", "value": "bbe427db45f1b8f9344ea96792825954088fdc527fb8a37b632400311c6a2399", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394250, "uuid": "0e0e1f02-5996-4061-8aa5-3679ebeb0b32", "comment": "Malware payload (Grandoreiro)", "value": "6fb84022b18972df90cf0abef511459c0b8436f9", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701394250, "uuid": "ce60e7f8-0379-4cda-b482-2791eaad120e", "comment": "Malware payload (Grandoreiro)", "value": "31ae9155866eea5ec924935264c08775f5e14ebfadf1b56164718bb3498d51b9bc78967357603e0c249c8a7dd305d324", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394250, "uuid": "767fffe7-6afa-41be-8731-2c561cf2aff2", "value": "T14C27338AE1F5BDE63F8AC05C3160EEF3A6C0FC2431549D637176B647CEAB12654B8419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394250, "uuid": "bc4b079c-9b61-431e-9409-7a36c4de8ef5", "value": "393216:uYltzKsjkVFtXYAtDw1iw7EnsIemECfStqYPSjh0jDAs1180hI:rzK+WoAhw197E0mEvkESNJS60m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701394250, "uuid": "7d814ab2-3971-4800-af2d-8a0d824d60b3", "value": 20510435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701394250, "uuid": "a8c05f4c-7283-4e02-813c-4c153aab1dd3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701394250, "uuid": "74bc9d92-bc09-4f88-8eb4-ab922e3a5db5", "value": "tl30.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ed7c96-9049-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701435516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435516, "uuid": "ff7e5084-6c59-430e-9cf0-3e5c38b25fdb", "comment": "Malware payload (AgentTesla)", "value": "1d32c0bd2f5880c46baaafb8a72ae59d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435516, "uuid": "ed5d0c16-fc57-4dc3-b15b-12260504022e", "comment": "Malware payload (AgentTesla)", "value": "bcb3dc574b107728602528604786d687a262ecfb7748b9ff36f09fd893b85c7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435516, "uuid": "d74f4f02-c18c-429f-8149-946539b04161", "comment": "Malware payload (AgentTesla)", "value": "be52896b2edf759a459d0775da0e6b9bb2831c49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435516, "uuid": "af0ad88b-ecd4-4918-88c0-104560d83a96", "comment": "Malware payload (AgentTesla)", "value": "ccaee6d188ca7fbc7fd094e14e5c7c608ae3af330c233069cbef341d9f82aca6af3dfb3fc9a7ae1b9bd8bd78fe640f54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435516, "uuid": "f8fbff68-b452-45fc-a2f2-d3d884727886", "value": "T186154823A1BCDAE2F5AD7EB1050557140BB62C969139E21BC98FBCC9E573B03C541AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435516, "uuid": "9e61ed64-e4ba-4f2b-9626-a35e2f3c155e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435516, "uuid": "75b278b7-bfd0-4c6c-a5a0-646073bc12d4", "value": "12288:HcdIx751cYm9GU13uu8XVJ3hJxlxotCJf/Bn3hj+tOm/DZ:Hc8513m80uui7fxyCJ3BnV+tJ/DZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435516, "uuid": "b387f498-f5a2-4ba5-b879-c588156ad744", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435516, "uuid": "a9bd9704-c1f5-4e6b-8c4b-22bf9500288f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435516, "uuid": "85d68507-b70e-4c1d-b58a-ebb3088be883", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d7a3cc-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701422842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422842, "uuid": "288b62cf-a6a1-446e-830d-f4452c3b0264", "comment": "Malware payload (zgRAT)", "value": "920e519b2b55beb6afd556e4a0beea91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422842, "uuid": "d6fe5a50-6d4a-42ab-82ec-743f4525399c", "comment": "Malware payload (zgRAT)", "value": "bd201032be55d2b6bcb65a58bfb3baa7e720f59a13cc12b6ff9ee75d1b440801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422842, "uuid": "d0a49962-8238-437f-a4b7-a39c77c2dd5e", "comment": "Malware payload (zgRAT)", "value": "efc99963dc49efbfbd9ca1510c8d9b860e1381b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422842, "uuid": "617dc5a5-4818-4387-bce6-83cd2ee268f3", "comment": "Malware payload (zgRAT)", "value": "15fa3bbea3660976b2d971c7d30b969e299a193bbbfeea46dca3cc9a4c352b94ac21a4a0a79aa483b9d6ae2b7ea427cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422842, "uuid": "8866db68-4316-4d73-a79c-58ea4487e7ce", "value": "T195255B6667C1ABD6D1FE0E3384F17B1757B9E6AEAB5BE30D000011E60836367AF91613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422842, "uuid": "cfce5b68-1beb-400d-9cc3-b67adaf9b955", "value": "12288:bmwPOv9jG/yi9Y2ZqMMWz4j8OwUDFFsGvn8T5xzfIYzDrxsqXR:ywSNC9zqMMxjZwQ7vn8TLIgreqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422842, "uuid": "754a6840-a66f-46b4-8819-777378a4016f", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422842, "uuid": "ec5304be-609f-45fa-aa0d-7ca78e1e87ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422842, "uuid": "48e6f1f2-be67-42aa-889e-4edf9b9d50f3", "value": "New Quote Design and Company profile.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbf03ed-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454827, "uuid": "a698c153-8b87-4573-8f35-6f9dee6884a2", "comment": "Malware payload", "value": "aea6fbef9c25671ef5297dc2a5ce665e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454827, "uuid": "d2eeff50-9d0f-4184-a37d-d482cfad1275", "comment": "Malware payload", "value": "bd797b95cd65ab1139d164ec28f02694a91fa8eb87a9033231313b944e3f9f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454827, "uuid": "cbe40992-c398-420b-9a4b-c31921e62437", "comment": "Malware payload", "value": "ddca3da939479d8c4f5083f95a28b63331628b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454827, "uuid": "8bb6dfee-32b0-4b68-93fc-ff3cd4b4dcd3", "comment": "Malware payload", "value": "7d7bbc4ef36fe1945ce277f32454af989fe66df010bbb86766222e0f9ce468f45b9049ecb59c314d673be0585ffd269e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454827, "uuid": "6a450dc0-5370-41ed-9e5b-2b479ba7b1a4", "value": "T1C8468D379E1D5CC9F90174719C5A8FDA29949C20B4086B9B75C1B969CCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454827, "uuid": "835d4280-5dde-4fa6-8ac0-45a1e51ba99f", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454827, "uuid": "c1d252b1-2280-44ad-b25d-f2626e2a9dfe", "value": "98304:gLlR0w5MQxhTULXioWgdN4h3qT1sOas5x+eovVbiNR44anz4VFq:gP0wm2hQeoXdNW3oKs5x+eovVbiNR44O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454827, "uuid": "3fe8dd1b-6042-4540-b215-e18ac2d0fae1", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454827, "uuid": "85ee3fea-fa3c-4720-acbe-0cf6a8349502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454827, "uuid": "6332bbd0-ec74-46b3-a327-66e1a0d9d6c1", "value": "SecuriteInfo.com.Trojan.Crypt.32700.26160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d082fe6-9084-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701460839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701460839, "uuid": "6cfd54f3-9af9-4bfc-af35-13fc7afa903d", "comment": "Malware payload (LummaStealer)", "value": "206ba989d67d0a120778acedc0e9bf2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701460839, "uuid": "e52eb7c6-8d57-484e-8a4c-c69ce4ddb5de", "comment": "Malware payload (LummaStealer)", "value": "bdf647380fa61af2f6e16bc17e2f99c55dd63200c6299e127640a957010d194b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701460839, "uuid": "cdb6d448-4e23-43fc-964a-d8ae4689549e", "comment": "Malware payload (LummaStealer)", "value": "952230c60e801668d89bb22685a597d2111c9c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701460839, "uuid": "a01f8e15-dc25-493f-aa04-6d85f180d963", "comment": "Malware payload (LummaStealer)", "value": "5fc656f7efb98d63664b5e036c631e3f097da7d49b22af573498fb0cfb8721d85c8f54106babc25c54d37ac5cac91c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701460839, "uuid": "e5bd928d-71d9-47af-919b-cb4f9230e8b5", "value": "T1D7E4AE7076ADC43DEA51D87604C840CB78B7392B2ECB9895B7DCC39A4D24BC2EDE2552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701460839, "uuid": "c17e34c7-164e-44d3-9479-fa1d3d9def02", "value": "c2a9fa81a7541a8a82320e403e85f2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701460839, "uuid": "a28d507a-b2de-441e-b271-9c40bbb197d1", "value": "12288:dORyouIwhecRNf6SUGkDZa8egUwJiOpdRQHfewC71SryF8q:dOQNj7iSUWgUwJi7WmCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701460839, "uuid": "9d1207cf-f583-4a71-9ab1-69ad699ebbb3", "value": 710944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701460839, "uuid": "b1319587-52fb-4e46-9987-81349c07207a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701460839, "uuid": "da74e8f5-bab5-47ab-8043-6534fa6af3c6", "value": "206ba989d67d0a120778acedc0e9bf2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833a6e0e-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422705, "uuid": "23506cb2-e649-47de-9b8c-13f07d3f67ca", "comment": "Malware payload (AgentTesla)", "value": "8c366167246b6e371d4be611105206e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422705, "uuid": "d83902cc-fa4b-4124-9831-61f434d61905", "comment": "Malware payload (AgentTesla)", "value": "bee896925d62192aff4e13abda9cc0cff1cd063778b2dadb45035edd5d274c8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422705, "uuid": "e80ae5b6-8573-45de-a460-d9d462709b8b", "comment": "Malware payload (AgentTesla)", "value": "5689b19440aaa57b8893f7fabaff725963b92483", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422705, "uuid": "38689b4a-f534-471e-8ee8-66739ec37c87", "comment": "Malware payload (AgentTesla)", "value": "e47b78bf6538071032fd4ab78137bdecde444539630083254527dc7f7c17766fed74d43932f3adf184ad884a4d20d6f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422705, "uuid": "cd36e899-26ed-4572-90fe-5d1713a288df", "value": "T19FF4E024E1F95B22D5FEA7F5181412040BF7786AE87DF32E4DD9A4DA3266F004A42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422705, "uuid": "060ada6f-a43c-4a66-85ff-80c7ceb6ba26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422705, "uuid": "f5ce388a-d984-4628-b613-f2bc81152993", "value": "12288:rFdIfzChVnn1eJmllQAxyvyHhCR55JyRM/zZ0QEVJK:JszChV9wYtHhCR5/zqQeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422705, "uuid": "0e3585f7-0ac6-4f25-8a70-1973af7da21a", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422705, "uuid": "ee47cd8c-d3f4-4dbf-81ac-37c79f8ce112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422705, "uuid": "54be761d-8b77-407a-b1f4-d25a12b26947", "value": "B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c99cc51-9078-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701455711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455711, "uuid": "0cd93afb-aaef-41b3-9a33-927d80124034", "comment": "Malware payload (Tofsee)", "value": "d2bf0c77c70900657d7c919282b90136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455711, "uuid": "fab4646c-1e01-475e-a4ce-92fb277e8525", "comment": "Malware payload (Tofsee)", "value": "bf1da149d7e5da9a8a4908039856414e838db0a32129dcad45b6c737ec92d408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455711, "uuid": "9e78175f-db28-4d5e-a3d8-b66e92bbcd2e", "comment": "Malware payload (Tofsee)", "value": "dc50e45c6aabad5b672af625f5449a0f50a36116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701455711, "uuid": "9d956761-3802-403c-89e5-f5846059120e", "comment": "Malware payload (Tofsee)", "value": "02167957b92ad359f2db3455f1baf7aa1113add6ea0b62da68f82889511e9ed51cae7a47368a23635dad24aeba91ba37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455711, "uuid": "7031ece6-12d8-4e49-852d-e5289d770d26", "value": "T137545C1352E16C61E5264A328E2AC6E86A1EFF518F3D77DB13186F6F09731B1C662F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455711, "uuid": "2938c162-ab92-45d8-965e-40fe82da3aef", "value": "99958f84824363d70f77dd17df64c197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455711, "uuid": "0ea2861c-1534-4b93-a138-2a893e5d8907", "value": "6144:j7ol2UY55+0U4C/yHwyHkXdfLhBbjLp6:j80+0U4C6GXLBbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701455711, "uuid": "0dfc2898-c0e5-4958-b34d-3d7184b17bdb", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701455711, "uuid": "c89fd9c8-959d-461f-bd2e-91cfce5c2966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701455711, "uuid": "ccb5005e-c64b-4318-a88a-940883d81283", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a77ea54-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413268, "uuid": "e1af8728-9fab-438b-96fb-e600147c7227", "comment": "Malware payload (GuLoader)", "value": "4da497b81d8669a2bde25586ca12b8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413268, "uuid": "5f0f1b6e-84e8-43b0-8586-fdb93846660c", "comment": "Malware payload (GuLoader)", "value": "bf55ac2e1efb5978df0de15dc7a169c0a3eaf56971c3bd3604c132d032511e61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413268, "uuid": "4bdf117a-65e6-4e5b-b419-7502689492fb", "comment": "Malware payload (GuLoader)", "value": "4cd36ba04da275cd660d8e8cc40497f27fa1db1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413268, "uuid": "c1c212c0-cf0f-49ce-b304-fc3b7478085d", "comment": "Malware payload (GuLoader)", "value": "9c4d85d96cc0c6e99ac8f1c0dea7d6d9f57141122126c02c16d99be4f9219ac0bbcbaa7f8729ff2ee33fd9a716885cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413268, "uuid": "736f3dca-0ba2-4fee-8378-2b611c7839cf", "value": "T158E4BEA239CA766FDC2F4A74035FEAB22A795CD17382496D4F40760D4C35A4A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413268, "uuid": "507feb98-c435-4dcb-84d8-07db67ba386e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413268, "uuid": "2689a7ab-6c8c-4d93-9619-468f51ba5572", "value": "12288:tkEnhe2eNCIjsVMAD/gfnSCYvgf3RfiMv3aqEAdv522K7abjI:bhenCIj8BDIfSCYvsB7EAdv02K7abj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413268, "uuid": "7beed63b-b070-4860-a7d9-224d50e6fa11", "value": 669485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413268, "uuid": "a110710e-6eae-4979-ad78-0bdc037fdcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413268, "uuid": "afeb01f0-f939-4a84-b76f-8fcb6d7a279e", "value": "Aviso de pago.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6821aac-900c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701409584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409584, "uuid": "dc89561d-14ad-48f6-bdef-b0299b608b0c", "comment": "Malware payload", "value": "c852b584dfda969c0225887c58affbc8", "object_relation": "md5", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409584, "uuid": "330a0a09-297d-4b77-a355-77c47390368d", "comment": "Malware payload", "value": "bf966d5955184ba5ed1b253726ab350af30d6af30c7a65e846f734cd34268881", "object_relation": "sha256", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409584, "uuid": "d668d56e-5c6c-40a2-be5d-2b2bc83363b5", "comment": "Malware payload", "value": "6d57264a6b55f7769141a6e2f3ce9b1614d76090", "object_relation": "sha1", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701409584, "uuid": "375aa431-9fb7-4658-9c32-bb8e2c5ee96e", "comment": "Malware payload", "value": "ebcf8fa69335c2de0d2355d977d79d5c284474c38de08b0bd2fcdd34cb0d6b33f5028bee6cb88849fbd859c5b216e8f7", "object_relation": "sha3-384", "Tag": [ { "name": "bookingpdf", "colour": "#98A85B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409584, "uuid": "15559b82-7e20-458c-a4ef-23fce9084ba6", "value": "T1C0337034FBDBD7890B8B5A8DC57E3C73574592D442E84173403B8D4AA6A8F3A4A436BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409584, "uuid": "bc8460f4-21d3-4c49-903b-6a8d763321de", "value": "384:TG55555555HRAIIHiy5nMxQ0H5H2eX8iuch7:TG555555551ICy5nMSfePu67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701409584, "uuid": "454597e4-152f-40cc-9bf1-493ec0b8a022", "value": 52567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701409584, "uuid": "313522d3-da11-48d6-a8af-338d552e4b20", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701409584, "uuid": "6a558ec0-c881-4433-8885-59931004f6b3", "value": "lnvoice-2566246817.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ce0556-9016-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701413663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413663, "uuid": "f93cb2d9-b002-424e-b627-bfc0aafa6c1b", "comment": "Malware payload", "value": "f206635467c8d24cb19bf7b6070e53d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413663, "uuid": "cb8b3e8d-a4e4-4cec-9ac0-861e323cd458", "comment": "Malware payload", "value": "c0086e01e6d171067db510646b09479e6937dc2004944942ef5b6e0673f571b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413663, "uuid": "9d19396b-0da2-4258-90c5-718c0e69de4c", "comment": "Malware payload", "value": "5ed8b215fe39514ba26af8c8b2e094283ebb6133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413663, "uuid": "2984e885-f8e2-4286-aa71-17ff660094f5", "comment": "Malware payload", "value": "fd5e2e69f1e15a4e1423f0eea484bccd5152737d25cc755d6b19ba9c22be996a6405be4f20e7ee1e4c5b763e72dd2a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413663, "uuid": "7dfd8545-e63d-42d0-9226-6e76177ed281", "value": "T135148C73E9D0BC72C016037E8F5E9EECBBADB0511E50878617585D6E5A302F1E66B30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413663, "uuid": "fe299290-8b12-4c7c-81e9-107a0870232f", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413663, "uuid": "8aa18e7d-92ba-4108-8f43-04022bc810bd", "value": "3072:rJPIipPaZJWVVHHHHqlnYFBB7rTuAizaT85znty:FfpiHSHHHHiYFBB7/uA+aTas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413663, "uuid": "fd24c012-5795-4890-a8b6-8fbcedd9cb5c", "value": 197784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413663, "uuid": "d0038a97-4923-407a-be8d-4de32c7be225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413663, "uuid": "512bc9eb-2c1c-4b31-a834-c8454fc6cac1", "value": "f206635467c8d24cb19bf7b6070e53d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fae588c-908c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701464387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464387, "uuid": "5c305209-cc66-4667-8d5e-3dec41a95246", "comment": "Malware payload", "value": "982b330786cb34fd69849d9d7cb296a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464387, "uuid": "1c2a614c-04a5-4c20-bd36-340e04108951", "comment": "Malware payload", "value": "c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464387, "uuid": "173d96c3-6afb-4c80-a735-da0389d9d104", "comment": "Malware payload", "value": "536c5f37004cd255cfbeff9330bf4d7f7795d87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464387, "uuid": "8ed586e1-f67f-4611-8048-03aa89281030", "comment": "Malware payload", "value": "5b771e4b3bc1c73a0e402a943898b3310b9025108645119ee39dd27f832c32472bb53993bd3921e4b3c44c92731dac39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464387, "uuid": "8780875a-48bb-41e7-bf17-2a2cb9ff785e", "value": "T1EF545B1392E06C61E5224E328E2EC6E8661EFF518F3D779B13546B6F09731B1C6A2F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464387, "uuid": "052da8a1-b6f2-406a-88d5-19911269e646", "value": "d3ecaa3ff256d295d638233f7023beb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464387, "uuid": "7294d40e-73f0-48d5-8c20-d33f5b686a88", "value": "3072:AfSJIG3VDgzl3rLJEBTdD96DttL2WHCfaTqCXyhZfLhaWblDmj3nnX7GHBrR4ulT:AnggFrLu5d96Dtt6Ww841kr7EBD5Fp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701464387, "uuid": "110d6ccc-5ede-4ec7-91c6-14fdf0a874a1", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701464387, "uuid": "0ba720cc-71ef-49ec-9719-70e603b65797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464387, "uuid": "5e57656b-3f15-4293-9cd5-201cc9d874da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a08b52-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413255, "uuid": "12ee3f1c-6345-4f8f-979d-d9da1ad1de85", "comment": "Malware payload (GuLoader)", "value": "998ff92384eae540a3c9ba7a89e87dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413255, "uuid": "0967ef3e-e6ea-491b-b854-b453d70fd61a", "comment": "Malware payload (GuLoader)", "value": "c25d8f1bc1238914fe5b137775de3806c192a20ad3a7c77228a62a0dbdaa3eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413255, "uuid": "abdd37d3-ca99-4e95-ac3a-01c190a2fc14", "comment": "Malware payload (GuLoader)", "value": "e8b248f9e8f9d6a041b38fe751f6dbcc3693e001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413255, "uuid": "78085f26-1753-43c9-841c-fedb925b5a30", "comment": "Malware payload (GuLoader)", "value": "f010ddb80f459bc58ae3079a9b7089a58115c3898da39264c1f4f5c8a0bc098e828a0476cb1b19d17ab83ed9cbbedef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413255, "uuid": "47bd7979-6c17-4f62-b4e9-1944dae9031f", "value": "T15BD4CF9238C9726FDD2F4675035FEAB62A795CE07382496E5F40360D4C3664A80EEEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413255, "uuid": "dd76553a-193a-4466-afb8-53e5cf8500ea", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413255, "uuid": "c53601d1-bdc3-4a3c-960b-a7e09f631ba0", "value": "12288:tkEnhe2eNyllWH50DO0uI/WEmue9SEgf3RfiMv3aqEAdv522K7abjI:bhenyLtkaJe9dsB7EAdv02K7abj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413255, "uuid": "f913d523-0c48-4cc1-b2a5-b392f3c0972d", "value": 652790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413255, "uuid": "2d047dca-b4c5-4c1f-808e-32b788853f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413255, "uuid": "51bc04ab-adce-46bf-bd54-6943e7faa06b", "value": "f010c514-a59b-4b68-9ea7-1cc9eac9ce66.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c678f0-903f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701431407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431407, "uuid": "3089fd7a-1ea9-42e9-8472-892e3d11905c", "comment": "Malware payload", "value": "7600933588af5a44bf63ab0829534f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431407, "uuid": "4162c236-06df-4375-8126-a7a856e2909c", "comment": "Malware payload", "value": "c2c5d319bc5fe424a8ea42a8626dd6b93b27f1a23aa45611df09ecf55dfa1dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431407, "uuid": "54d233df-467e-4a49-9023-8f945d1f0a4b", "comment": "Malware payload", "value": "16482b513fcdbb46f528a079ce3942314ece1b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701431407, "uuid": "430c69a5-5037-4d56-b28f-f923a074b43e", "comment": "Malware payload", "value": "328a69f7f8611105c426204f2d66a22c965c86b042a8bf0850b24bc1fc7c9cffe3104f1c27fc99cda253ea183a1b2912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431407, "uuid": "c01914f9-6540-4c0e-9fce-3d869d3c8165", "value": "T16154D011B6D0C832E1971A350861CAA25A37FCA29B7295CB27943F3E6D317D1CB79703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431407, "uuid": "5ff843d5-63fc-46bf-a221-094697804d8e", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431407, "uuid": "b38b0ee5-9b4b-40c1-93c8-c205409cdf9e", "value": "6144:Vh0Ej+3Mh8dV5MRWTa03cMMTmFAKo58oWnIoQGPRqa6Z3h+V/9H:VAMh8dVu8u5TmCZ8hnIoQGPR96ZMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701431407, "uuid": "b0361497-f3c4-450c-a1eb-e6be1d1b31ac", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701431407, "uuid": "5a03e248-66cd-425a-85e3-ad6c023afcf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701431407, "uuid": "40107bf0-267d-4f28-82ea-edcd62413b4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becb290f-9019-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701415074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415074, "uuid": "19a53f93-ec5e-49e3-8f7b-ce09a603454e", "comment": "Malware payload (Smoke Loader)", "value": "1854b4c677a8acf7978c940aaf70e815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415074, "uuid": "c5927d9b-b99b-45e6-b43f-b8ebc4996c2c", "comment": "Malware payload (Smoke Loader)", "value": "c4406228bda2b738291e4671966419558161be453434a544ff651821c4c54063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415074, "uuid": "262546c0-deb5-406c-abef-de90cceda24a", "comment": "Malware payload (Smoke Loader)", "value": "a932d8312cb06b9b898a60cf045946b6f63b3c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415074, "uuid": "8df3104f-118d-4b0b-b6e4-54c154105bf0", "comment": "Malware payload (Smoke Loader)", "value": "ae20616de5e6ebd9db48c39207f8d26bba88985b0569f264e4aedb364d45a66cacce0e5648ebf4c03d132bb0daf19c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415074, "uuid": "8939bdd4-5039-41a1-9272-a10d44e57871", "value": "T1E334BE2177D0C432E12769394962CAA54B2BFCE2AB6056CF37943E2E5E313D18BB5707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415074, "uuid": "3d786cf2-37bc-4ada-9662-694960b8bdf8", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415074, "uuid": "226b6c01-edb2-41aa-a48e-3abbaa709bec", "value": "3072:I/5SH0WVD2rRz9MaBaN2gOnMxUuErhP79zW8NnVqsMeRefbjkwiwCx:kkD2x9bA0gOnM6L9P7tD3Uf8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701415074, "uuid": "e527be18-d97c-48c9-9477-d78e514f9851", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701415074, "uuid": "7ba1731a-56ba-4d73-be15-80db7fcfb402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415074, "uuid": "c2646940-a35d-434c-a9d0-fcd8ec867828", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcbd212-903c-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1701429920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429920, "uuid": "e4861bc5-a2c8-4e7f-a1f9-b28a073ba3d4", "comment": "Malware payload (Arechclient2)", "value": "8c1612e86d4d9059dcf1f89d9b76881a", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429920, "uuid": "fbc1c8a6-0caf-4760-90ba-1c073bb1e30f", "comment": "Malware payload (Arechclient2)", "value": "c5cffc9807fa1747df3b91a8f12354f8f907bd062ed925c4368973e69dcb55ba", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429920, "uuid": "e7506a17-8364-42e2-b3fb-c6d852ecfeb8", "comment": "Malware payload (Arechclient2)", "value": "c8d2f4dcb005f1fff7c5f9b5a8a2ca0b62bda9ea", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701429920, "uuid": "292f8d18-872e-479b-bd25-8b912cf36ff2", "comment": "Malware payload (Arechclient2)", "value": "85cc8f23de8bf910771802b22d50c7e3679389a7d2c13596a1d817ccd42ad6e69992a4ec4d41829264328953e084abb2", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429920, "uuid": "88874016-9b9a-4afd-bdaf-2249925d828a", "value": "T130467C42BE91DF22F058613BC5DF550803B4EC246BA2F317BABC323D54517666C4AAAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429920, "uuid": "d482cd50-103d-47eb-a937-dbecd43ea02d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429920, "uuid": "3fb26abd-e4e3-48b2-8bf6-cb18591b4f5d", "value": "98304:Yfnfhrk25cX1tiPOYzQO3DQysNdlTll/eOLNmmDd:enfhr1GFoPOY0O3DVa7pYL6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701429920, "uuid": "f11f1363-cddc-49fd-93b2-2e2412a18395", "value": 5632000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701429920, "uuid": "86be5220-fb98-4a94-aa4a-b309662c775a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701429920, "uuid": "8fd5a0f9-c10b-4b08-b788-7172ed5ef44c", "value": "SecuriteInfo.com.W32.MSIL_Agent.GZN.gen.Eldorado.3915.4967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47c4e50-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701413312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413312, "uuid": "b818943d-e4f2-4748-bf0c-8eb4b2ea7493", "comment": "Malware payload (AgentTesla)", "value": "16a97a92f7072068c9345f16c1b841b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413312, "uuid": "e97efdbd-a3ce-4a2f-885e-7aebd86e193d", "comment": "Malware payload (AgentTesla)", "value": "c705dadf9dc655839e0778f2b05e191f41c58d288420095131fe2153e0cd9334", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413312, "uuid": "b740841d-0c9e-4d58-b2f5-806691e516cf", "comment": "Malware payload (AgentTesla)", "value": "42dda412b6af64273d1e55ae3008ca03fcf0072a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413312, "uuid": "c042f5b0-9b0d-4cd8-88cc-f6f9fd655e08", "comment": "Malware payload (AgentTesla)", "value": "5f0f24bb89c812e43fa756418d6727ec3e5a7eb66f5eb465a16c85f71339bc975bb7cf519b8b4d6bf3be941f9e5389ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413312, "uuid": "ed240ea0-7c56-44de-80a6-1fe0b4f554bd", "value": "T1FCE41201BEAE4B22D4762FFB95E2615213F4524A2932D30D4C8A37FDD421B63BA47397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413312, "uuid": "bd13653e-e63d-4405-93b6-2194bdc3ef48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413312, "uuid": "ddcbafc1-5673-4c49-b253-f49ec24f62c7", "value": "12288:HriSAx5PWPQA4jcCxttjSUXcM+UxhCuJ8JBCu5XHxrHdm5OznueAWt6G4enCG0m:Hr7Ax5uPH4jcCzBjJJ8/n3tHdm5OznuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413312, "uuid": "6aff9413-b55d-4477-81d7-57924b20c6a4", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413312, "uuid": "3e4f8f4c-9174-4843-b743-7fee199c6f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413312, "uuid": "1b6933f2-ac8f-43a7-a3ee-e901b2f05dc0", "value": "PO 3345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604fc6a4-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454859, "uuid": "26a336fc-18fe-49a1-8bde-db22ffa1f48a", "comment": "Malware payload", "value": "c839f815a896a5b322eb42f63c2f6da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454859, "uuid": "cde95bc3-0b1b-4cee-9359-395bd1049335", "comment": "Malware payload", "value": "c787776d0be52a89f38561a50606546bc577ed84c4703a7abb3a04c171db4416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454859, "uuid": "b13be013-edd2-4378-894e-c59767e1c66f", "comment": "Malware payload", "value": "8c739959e78bb2b208a0bb2c668ec13a17041681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454859, "uuid": "9cd4588a-e829-4068-bb6a-98d36acea81a", "comment": "Malware payload", "value": "27c85510332889005c63ea890cff2c91faa50277a1ce2b1964f50a1901c6b9b7b009e05d8dac9c4b62e166a3f0aad5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454859, "uuid": "fd924619-6509-4a0f-a671-856d68578e96", "value": "T1BBA4E85BB9B3D463C01874B69CB1C7B8AEA2ACF04C11894BE3E5EB2EBDB55015D130B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454859, "uuid": "7debe8b4-6f9e-41ff-a4e9-c8dedadb6b31", "value": "bad621c91ea0934e0bc53e2d5035a9a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454859, "uuid": "ba109ceb-3987-4dda-921c-ae33a0944690", "value": "3072:jP0qJsBAUbVMHKqGt4DUb717zehSjNuguLIpEbUoJ:jcQsBA+cBetzCdp80U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454859, "uuid": "e267214c-535a-420a-9cd8-90c949c67400", "value": 452290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454859, "uuid": "10c539a0-bdb9-4f41-82f1-2b3e7f84a7b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454859, "uuid": "936bb09f-ad1b-47e2-aff9-cd09c0fbbf22", "value": "SecuriteInfo.com.Trojan.PWS.Qqpass.12036.22456.1903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395d5393-9035-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701426876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426876, "uuid": "1ba8c3ef-4ae7-481c-b717-3c4d0125b905", "comment": "Malware payload (Smoke Loader)", "value": "11d4ae4bb463af0f5570495037788fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426876, "uuid": "c7856bca-f1f7-4a70-9b2c-c252e6e2d324", "comment": "Malware payload (Smoke Loader)", "value": "c998f84a22ae2e5d6a732d53a12a630eb0fe9570ff718fbe17dd4d9fd8beb3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426876, "uuid": "aa82bde8-06b1-4109-8745-3f1cbd6ba90a", "comment": "Malware payload (Smoke Loader)", "value": "3d22836be2ac97e93503ed622736acbb481d4e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426876, "uuid": "923e1e4f-fe73-4da2-a066-d02b7f153227", "comment": "Malware payload (Smoke Loader)", "value": "e3595c3f59035a6b09994ddd1675831288869b3e7b88aa28acb92b597fdedd1052479c57d4581a41584fdb9bafac30e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426876, "uuid": "446c1c4d-0200-49f4-980d-20db7b99a092", "value": "T19834AE22B694C072E15759354971CAA55B2BBCE2EB6146CF2BD43F3E5E302D28BB4703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426876, "uuid": "e0633180-0d8b-45c9-9903-6e7f5af9c071", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426876, "uuid": "8d3821d0-114a-4b0c-9388-c28ba84bde96", "value": "3072:h7lSs0WVDfLRz9PwBaEWgOnDSliPKVlhoVEpKC5gcPfewkwPwCmA:7zDfR9YAfgOnDYWe/IErPfCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426876, "uuid": "528944c7-c4ca-4ccd-8776-31cc01bbd788", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426876, "uuid": "74b02910-7055-4a75-982f-ff97efe35c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426876, "uuid": "9450c443-ff18-4dcb-8e2f-f8afe6ad6b5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e4937a-902b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422674, "uuid": "bf96f6ad-eede-4787-b377-79f2f4abe8e4", "comment": "Malware payload (AgentTesla)", "value": "0e89230203fa44d82492293a51980a46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422674, "uuid": "94452f53-2255-4519-beb7-fa5fe84617e0", "comment": "Malware payload (AgentTesla)", "value": "ca72d4bf88b667018f42bd8079f47678e3dfb0135a94dca3dcab84500490e5d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422674, "uuid": "d219db58-53a8-43ba-b720-fdb14b380647", "comment": "Malware payload (AgentTesla)", "value": "34bc8651234d58168124589acf94a97caf4061d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422674, "uuid": "3cdf4844-dd25-471f-870b-16b4c17ce85a", "comment": "Malware payload (AgentTesla)", "value": "591a1e76be4d8e13c77a137fbf27d329044be02883a63357a402fba96e16b135dcf08208d162415200ad37f2f55a70a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422674, "uuid": "61a51289-0d8d-46dc-ad1f-59296be501b6", "value": "T1BA15AE84E5A45B61DDB9A7B11935CD3407733DADA838E21D1CCD7CE73BBAB824412A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422674, "uuid": "7d223cfa-56a9-4afd-86ce-b637a5d97c3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422674, "uuid": "fada3957-b811-477e-ba56-13473443fe6b", "value": "12288:SekI8fHfrhdI6u0eCkrNK2XWtEAKzinIlDQzd4tOHWcxl6P7r9r/+ppppppppppR:r+fHfrhddgCko2GtfIUd4U2Il61q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422674, "uuid": "a45e0a03-e58d-4f48-82d3-027cc8dd0775", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422674, "uuid": "a3bb52b0-6e42-4caa-81cb-b852219a909d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422674, "uuid": "1d2c89f7-2527-4d71-8ff9-6bacb79e18fd", "value": "SecuriteInfo.com.Win32.PWSX-gen.29337.28984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd38b95d-9053-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701440009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440009, "uuid": "88a033c1-a409-4837-b90c-a74303205407", "comment": "Malware payload (AgentTesla)", "value": "c0358fee59172c24e5695593392135e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440009, "uuid": "0ee40576-0242-4c21-99c2-76de4489f332", "comment": "Malware payload (AgentTesla)", "value": "cab0d981559ec627b28ba927840774c66ccba4c7cea401d748ac398f0ab39c85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440009, "uuid": "f9600da6-7f4c-4157-a167-6cdea95bab3d", "comment": "Malware payload (AgentTesla)", "value": "5b7a3dac90e3014de6eec3ac9e96c9534918bfc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701440009, "uuid": "9e2abb85-6a9b-4bd8-aceb-7a25313ab406", "comment": "Malware payload (AgentTesla)", "value": "29d8669ea6462f6595361cc5ba00df6adea12496ab73a886a535722d2d55ae0609779164b0848fc99f18f911613a0772", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440009, "uuid": "aa73731c-35b0-4428-b2d3-ce7df33225ea", "value": "T12FF4E020F1F91B22C6FE93F1145555140BFB786AA43DF32A4DC9A4EB3662F004A42F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440009, "uuid": "91c686ec-7619-4cb0-abd5-e8ff7171eda2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440009, "uuid": "6852dc21-07c4-4459-9ef6-263d91631803", "value": "12288:aD+dIbgzk6wM4i0ID2Fld+lwrzS8dRm9LSuvnUA78WxKNQbCxOKL:aD+H4XMb0Pz3nS8oSuvUm8WxtbCx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701440009, "uuid": "6cf65a39-5fd4-4673-ba20-dc7bdd598c24", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701440009, "uuid": "f3aa4c7a-25ea-4924-9bc7-fbc1f030ae87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701440009, "uuid": "ee230265-92de-402d-982a-3ff9e139c024", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5327cf7e-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454837, "uuid": "7c9c9eb8-d7f0-414a-b000-d913feca55bb", "comment": "Malware payload", "value": "62ee4b681006884ba4e3e9b47020dced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454837, "uuid": "c9416452-7f2b-4e01-b205-c283c422974f", "comment": "Malware payload", "value": "cab6a034b48dd245eb1259995433ee1b1fb6a32a5d25e22f11bcbc7dc9bc4821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454837, "uuid": "e12b8b73-5363-4c2e-9c7e-877674408ef1", "comment": "Malware payload", "value": "cc64096311583cc1ce70e649be3818eb411b501e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454837, "uuid": "4b001ec5-3a89-4437-a7e9-cb631d4898da", "comment": "Malware payload", "value": "df65bdbc4f68b7b5424f6d474fc9a3ab8c0fe2d3bec1cb2aff58a1031e904edc27cfe8a5ce8490c9e1c732b3f1892809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454837, "uuid": "59031497-b957-482c-8b47-1ed3a58a1cf4", "value": "T14F058D06F6E380BAC71430B20A6677755E77D5068B308BD79268DF696D63271AC3F232", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454837, "uuid": "11a18175-d99d-4a0b-b7cb-e47ec0ba5d94", "value": "6144:zsSMOErSCZR0MrwCcT62lvFWWbJzdMkgO/obQ2VRReKHSd/HVCWUG3Wq882+dqnr:zsCfWWbJC2GVbyhHVC4Gq8t+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454837, "uuid": "6db2498e-1245-44d7-8e5e-33141d3019ec", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454837, "uuid": "c1ed776a-a867-4208-8f87-8b8038a9f85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454837, "uuid": "098af8cb-117c-46f9-9921-acac37281c4c", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.9202.5982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c8a68b-9030-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701424936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424936, "uuid": "58ac5661-053e-48fb-ac48-b382201b49d2", "comment": "Malware payload (AgentTesla)", "value": "f1097878f053070a1f1f67d5b7f0fd9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424936, "uuid": "30b69e46-a965-4dc0-b78d-aa5836215859", "comment": "Malware payload (AgentTesla)", "value": "cb25eb7dd5c0e51a327c444749209f063bbee5de1a0441a12bd9bf93f898846a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424936, "uuid": "af1d6925-7a41-41f0-85ff-11aaae84cc87", "comment": "Malware payload (AgentTesla)", "value": "8de816bdcfb944a52f58387cc08d971ebc772848", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701424936, "uuid": "55db0a1a-cc31-4d9d-ab6e-40382a03264f", "comment": "Malware payload (AgentTesla)", "value": "e11c17847589d621aad617a52b8d3c16830e5dfc85fbdc4cd671aa03901b6be1645847b4b5e2450ac33e3ae14ac11127", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424936, "uuid": "a2adc740-8e97-44e9-b24a-563a7170d713", "value": "T1F4F433F1E246987378B900F1EAC1EF6626CCBBB87E238C190F46456244FB599C7C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424936, "uuid": "6471bbb9-2456-42fb-a868-6ba086aa7ae5", "value": "12288:IoxCBEeaEG43mqWe+U5uPV/TxNkBtACWzVP2anGGYpnz+UUWbfUCCzBofvRTfs23:IoMBESWKuPVNNkByz52aHYpdJ7URzu3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701424936, "uuid": "9d090abd-c3a9-4012-b51f-8107b3a819e4", "value": 741954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701424936, "uuid": "02b39dba-a8f2-498e-8caf-193b51bbdadc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701424936, "uuid": "b7d5280a-b74b-4841-8fa9-6e9b089c80db", "value": "Ningbo-Overdue 974356.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487b59f3-9051-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701438927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438927, "uuid": "92fac0b6-e491-4a9b-8537-61739a401288", "comment": "Malware payload (AgentTesla)", "value": "33a2aca5866de0f687e0d5d64c1feb9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438927, "uuid": "2c46c4b0-1b9e-4c14-bad1-6d3bfa657997", "comment": "Malware payload (AgentTesla)", "value": "cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438927, "uuid": "8e5c4f1f-d39c-4784-9cb0-5db66d907e83", "comment": "Malware payload (AgentTesla)", "value": "42c8a406496525574a3954a219968db17eb7877f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438927, "uuid": "717d283a-d277-4d0b-ae13-efc8ce26a415", "comment": "Malware payload (AgentTesla)", "value": "85a1f7b761ff4e5d6aaf9a0321c905350415800a169a0c298cbdc8fa72cc212d2cb1182e8b834d55ed5a000379cea342", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438927, "uuid": "748b5f78-214d-402a-a098-4d8d261afa75", "value": "T140F4F1163378DB03E9BA8BF46052755453FA25AE2022F6581DC235CF50E9FD94AB0BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438927, "uuid": "9543786e-b092-4f2e-a2b4-8dd272e211e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438927, "uuid": "97909592-3837-4bd2-8590-5189fcf6cc24", "value": "12288:kI2ICYm2L/c37RaJFheLHUvGnJ6zsCMgzF+Nm3jZ738FQTft:AX27c3yQL0vyljgzAwjZj8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701438927, "uuid": "44671e83-0fe0-4d1e-b331-8538570c9f1f", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701438927, "uuid": "09373e3b-6b91-4941-b91c-893085f5d148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438927, "uuid": "78039816-026a-43ae-9872-4bee6c4f6a6b", "value": "RFQ_20231201-876658xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf551bd9-902a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422403, "uuid": "2e60f4cf-fc32-4ba6-b253-a83b2ab87403", "comment": "Malware payload (AgentTesla)", "value": "92330463b66638fc2f745cba74d1638f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422403, "uuid": "36bb651d-5ba0-40b8-9170-c0218d620ce5", "comment": "Malware payload (AgentTesla)", "value": "cb56a616b456b089946738d62f352b134934ce2e9e23ce00cfc803e35748cfce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422403, "uuid": "74aba3ef-a7fa-4d6a-bf19-939aba44e978", "comment": "Malware payload (AgentTesla)", "value": "d94d75a811885152bf7764529afbe79e6dfcd078", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422403, "uuid": "c0dbb1ad-d77b-4798-b85e-67f124393a7d", "comment": "Malware payload (AgentTesla)", "value": "783212cbe2af9cd95ae5873c0152f6e80ed96eacca6bce76b98f2a6f3f96f096a6671e5bc088ad853d35af5e123b5851", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422403, "uuid": "5eb4cfc0-881f-4c62-9f63-28f6690e1aba", "value": "T110E4132133999362E17E5BFB6894940843B3B9135450E31C8EE610DFAB32751DAF1FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422403, "uuid": "b3305dbb-07f0-4060-b42a-37be7285266b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422403, "uuid": "464d593e-e120-449a-8438-dfc59b86d478", "value": "12288:ACwAJyImgqzkUB/hBnpxRRR7g6xrZUbygh9sUOd:yAJqBLnjCmgJhrOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422403, "uuid": "2d69c973-474e-425f-8e8a-c746bc3d597f", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422403, "uuid": "d1993907-17f7-47b1-b206-2e7dbf148869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422403, "uuid": "855bd5a7-d922-4e01-a3be-59b16f3ca32c", "value": "RFQ235658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46e9e96-9061-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701446007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446007, "uuid": "8aad9604-3671-46b2-9ebf-13ad7bafcdec", "comment": "Malware payload", "value": "56fc62caeed2c41af42bf26a0d83a9da", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446007, "uuid": "f26fa97b-f0c5-4e76-81c0-0a20aa740455", "comment": "Malware payload", "value": "cbeeaf0c51880bdcafd87ffea46204e7cec5670de293430f9f23b32de68d3665", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446007, "uuid": "1f2342e2-2afa-42f7-a50e-fe2db977597b", "comment": "Malware payload", "value": "8b51e7a2f07879792aa364930f1b8af8c550bdcd", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701446007, "uuid": "9285cbab-557f-4f71-a87a-23d48600f91f", "comment": "Malware payload", "value": "2b896f5d738e24e74246aad6fac4bda2a41c05c08622aa572a2c25486de1cf51a7eabc53c77aad2f13955ede6de13f14", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446007, "uuid": "22931a54-166b-4efa-9a27-02a99480b486", "value": "T1E667338228CBC1F4E9C51C68851B3ADF17F356B68844442CBDC46DCBE5A5FB260B9DE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446007, "uuid": "e156025b-4990-46aa-a101-c596c9e14b3d", "value": "ac86e77886b9065c351159bf0f98d2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446007, "uuid": "d9f40fd7-af67-4853-9709-6f41efcaaaf9", "value": "393216:sSvpGEOnY27pZqAGBuzXONZKWlvY55RWsblQebJFMB0ZTHYbJaEfhFf2vbolt+l:rXsY8pohQ7ONAWYbTpZABw3Q2Tw+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701446007, "uuid": "f837bfe5-365b-4269-9a59-92f4ba7bcadb", "value": 29793280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701446007, "uuid": "1d8eca63-50dc-46ab-a5af-55d9f1d01b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701446007, "uuid": "46fe3c7a-8a4c-4807-b363-be364f65a0f5", "value": "drivespan.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639222d3-9018-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1701414491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414491, "uuid": "815cb464-d71b-4377-bf85-5089c97fed30", "comment": "Malware payload (Vidar)", "value": "16bc6536b2bfda138d28e0be32c0a2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414491, "uuid": "0061c3d3-874f-46a9-970a-ac9e13765cad", "comment": "Malware payload (Vidar)", "value": "cc58fda6767d3d05772223f4267075b2dc2a63bc802a6026f3dbc1403e3efa17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414491, "uuid": "8b151f03-8c68-4e21-a4a7-5fc405eaaadc", "comment": "Malware payload (Vidar)", "value": "bb7c1d6f01006d4f91deb1366922cf7d4c6c0750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414491, "uuid": "0f45ca03-ded2-42dd-a3d4-eb67ab67297b", "comment": "Malware payload (Vidar)", "value": "8d87325f504546447e36916bd4c9819dd6446af7766ece792e0e87f18965c66aac978e8e60b6f5f34ad85c7391295786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414491, "uuid": "c1fa4507-137c-4015-9726-43ae22cede0d", "value": "T13374074392E17D86EA278B729F2FC6FC771EF6508E497B691228DE1B04B0172D1A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414491, "uuid": "e1cc73b7-296e-46f7-86e7-479eb2de5599", "value": "0bd61e688135eda02fcf13008a67a440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414491, "uuid": "11a852d9-5fad-4c08-b930-9bb6602e17f8", "value": "6144:QNU8lR4jSX5fbDkbhmZ00Rkf46siEBjX:SU8Mmuw36PEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701414491, "uuid": "8c2269f7-6092-44bf-944e-d3340aa98c7f", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701414491, "uuid": "ded4de9e-398d-4ef4-a11d-05723adbc23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414491, "uuid": "29f1e70c-5192-4ed3-b2ac-df379be465b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e80aba4-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454829, "uuid": "e07574d5-85a2-4af7-997e-66ce0cc44616", "comment": "Malware payload", "value": "0706455db81c7e96d4f96f6e9ea25a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454829, "uuid": "adda1bb4-3229-4e6d-8f3e-50d892b52523", "comment": "Malware payload", "value": "cd66d3f648a42f0c03f3676e81bf6f29d9a056bd6c6e3d5bdb6994e82f23d6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454829, "uuid": "cb0bbbc8-a674-461a-8442-044e14bb4ec5", "comment": "Malware payload", "value": "c9737fc6c56f05109af2fc3ea14b07250028d11a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454829, "uuid": "55e8a54e-c313-429d-936d-d851ed7b3a98", "comment": "Malware payload", "value": "ffd989ffe2ae320afcb6123424cf38cf0284baffee39ba96b2b430909020a5bfe69ae49a1fee2e9397dc1d110e2f4445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454829, "uuid": "49385f93-ecda-4732-a01e-e5afef26044b", "value": "T17D65F182B5E2B0F2D64F79B04DAA6B36ABB4CA065F14CFC3A764DF1D1D32180593711A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454829, "uuid": "b2d56014-410a-4524-9228-46953113ba61", "value": "24576:vGaYoLGd0VHVM4VM4mETyzXsYSaM82/DJ3t6M2+iStb05KCYj8c9qohVA8x:vGa/Lp116ETyzOaMV/lDdiY05KCiBkoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454829, "uuid": "85f6047f-4942-4f56-aea9-81665ab505f3", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454829, "uuid": "4586ffa7-aefd-4a2a-bea6-aa1396198391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454829, "uuid": "b12c05b2-cc45-4a13-a726-716ffff6a6ec", "value": "SecuriteInfo.com.Variant.Lazy.350581.18544.25237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366531af-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442333, "uuid": "0ebcbc1b-4b97-4edf-89b2-37f5ef45ad69", "comment": "Malware payload", "value": "284b9fc4a34de56ca06b532dbc244e40", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442333, "uuid": "6f8ee719-944c-4a0e-9cf6-02ad24f1b25f", "comment": "Malware payload", "value": "ceef847f377cfadb90ce159261b0bbad2df29eb3cfa0300b7020251c052074a3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442333, "uuid": "aa100d36-7c41-4e08-adbe-26da325dc964", "comment": "Malware payload", "value": "ba4ceec645046e959bd32e8940e3770471ff9df2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442333, "uuid": "4f6a834f-b425-4a82-9cae-c5b4b0214b14", "comment": "Malware payload", "value": "93566dc3117c26e7878a93e3fea7b35b41b7d5c584bf655ae800627f5352d91e0dc5a8976bb63eab0925a7d4a97f8450", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442333, "uuid": "19f486d2-fa58-40bd-a3f4-8c61ba530415", "value": "T1FE560175731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442333, "uuid": "3ee1542f-1c6b-410f-bcb0-4097b84e62c6", "value": "196608:/nDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJY21:7irUVis8O/0giAZ9PDK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442333, "uuid": "bc717a8b-33cb-4bcc-8f58-bc2b0e0a9712", "value": 6368188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442333, "uuid": "8907a6fe-f281-4832-8e6b-b8de1031da62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442333, "uuid": "e2416fff-b1fd-43fa-acd9-64132f963614", "value": "\u0413\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440 \u043f\u0440\u043e\u043c\u043e\u043a\u043e\u0434\u043e\u0432.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aa4217-9068-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701448828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448828, "uuid": "04cb8c4b-25ca-4b05-b197-394dad7347ba", "comment": "Malware payload (LummaStealer)", "value": "9445e5473e3a8dfcb3a7da995c8f4265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448828, "uuid": "f447fa9f-c134-4b8b-922e-aa93cb83292c", "comment": "Malware payload (LummaStealer)", "value": "d09693af02eaf96239b0cfb3b0aeefbfc6ec97a09cba87a89b6b06e292cc5209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448828, "uuid": "9278cc8e-6010-4c23-8880-d1e0d288a531", "comment": "Malware payload (LummaStealer)", "value": "2018ed9a253ce080f641215df263e8d3025e0699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701448828, "uuid": "704b91d8-9734-44ee-985a-3c4f06fe8653", "comment": "Malware payload (LummaStealer)", "value": "65796bcb4a64ad52e6623f529fb3e007cecb45df296a07b781eb9b270f1383ab70534a09cdc6ca11217dcc585f71f098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448828, "uuid": "f4452867-b0c1-4c01-8144-cd21d234ab15", "value": "T10706AE022EB2DF26F11C517BD6DD990813F4E83456C2F72B29B8323D44A2767A856CDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448828, "uuid": "d46a9d25-cb7a-4fc3-aea9-ae712f2512b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448828, "uuid": "389f22fe-dd4d-44d0-93f5-084ef961b854", "value": "49152:0j7jALr98QOgvy/PbXXPCZkDBPdn0LNCa/XTYwGVcvm9TgNuNi0dSS6XWGefr:+4l8JLvCZkDfGNCa/DoCMUNz0URWGef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701448828, "uuid": "50c2a6de-615b-47ac-827b-f1e3ebeb7792", "value": 3901952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701448828, "uuid": "20878c18-4605-442b-9ad4-4f038b94be47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701448828, "uuid": "9d9ee884-6834-47df-94e3-ab2511cc7272", "value": "d09693af02eaf96239b0cfb3b0aeefbfc6ec97a09cba8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6522922d-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454867, "uuid": "00de3111-b8ac-4b02-a8c4-507e71caa2de", "comment": "Malware payload", "value": "7d27a3c40a58de49b27da01c20d01313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454867, "uuid": "4f103531-d814-45da-b1b5-feb7038a9ddd", "comment": "Malware payload", "value": "d179ea09dc4fd47557733c0e1f9ab79adb27f6056cc78167ddda06c156147833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454867, "uuid": "818d44aa-7f41-431e-9fd8-68102c02b74c", "comment": "Malware payload", "value": "592215db27810d58a4a7ed228b9a6bc5b2e0057c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454867, "uuid": "f79d5813-8ef7-4a67-ae19-3752681c057b", "comment": "Malware payload", "value": "a0f898cd3077d78a57444703e59b879679044d203ce17b10c7136b750ef960563d9ef4659586d146d5ac46ced43a8892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454867, "uuid": "d1070e7b-29f3-4e67-8abe-30112982f219", "value": "T16875BF01F6828577E92781F0487AEF37997EDF110B0D8A8367E4FE5B3D3229095261E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454867, "uuid": "11fd1798-7705-4bc9-97d7-ed4071113477", "value": "432694eed40c89b1f08eefe9c1e7be3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454867, "uuid": "52091bda-5cc7-4cb7-8d44-fa1114aaf7b9", "value": "24576:O6jfcDhhIAH0IKw3EeTpB0uTJf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLYogf:O79hIEKzYrH+s8KuqGaX0ToIBAUZLYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454867, "uuid": "c86215e9-d026-4371-97db-f9ea81d01739", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454867, "uuid": "2072c24c-0af7-45d2-a4f4-0c52e07964fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454867, "uuid": "26bb86b1-de6e-4b21-8fa8-a3b78157dcf8", "value": "SecuriteInfo.com.FileRepMalware.20339.9015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b8086e-9022-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701418820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418820, "uuid": "6b6f15bc-5652-4544-be8f-6829b8b953c4", "comment": "Malware payload (DCRat)", "value": "368c7fe07e9af04159f6d26f9e60c8a2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418820, "uuid": "feb9d270-b8c4-4a49-814b-1f6f9522791e", "comment": "Malware payload (DCRat)", "value": "d26fbb4ec536593894550c4738e22bf8909d15f8bc8bc961e2e0d02d0a093098", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418820, "uuid": "1f634e66-a243-4cee-897e-8f41695185ce", "comment": "Malware payload (DCRat)", "value": "de2538ac77088bb2ad1ad1e2e2bcd4fd8e17c278", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701418820, "uuid": "83edbeb2-e4d6-4694-9e96-eae76d4ae300", "comment": "Malware payload (DCRat)", "value": "73ee9e62dfc4719a3d64208d3f3a33657cc25eab2c8b9bb1269f653afa045ddd59ae7b900a82634fce1618ff5af8f8cd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418820, "uuid": "83db904d-ad19-4a5f-b354-7dab056aeb8b", "value": "T12705E701BE44CE11F0191233C2FF454847B4A9516AAAEB2B7DBA377D59123AB7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418820, "uuid": "c6454e0c-253a-4ce2-b5d2-35163b655691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418820, "uuid": "3064694d-42c9-43c7-a8cd-0f4f0656ce91", "value": "12288:asAvZ29nZTZLNzM0y0UxNAwRIXrbq+mdx+v+bch6cHyU:a1cnZTZLen0UxH4SQmE6OyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701418820, "uuid": "d687e68c-3e3c-4197-ab0f-c6f058c9c19b", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701418820, "uuid": "e75dd49b-a78b-4a7f-bc63-c59a21590d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701418820, "uuid": "5e218ea7-28a6-435e-a3ea-a80f84601407", "value": "368c7fe07e9af04159f6d26f9e60c8a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e0132c-9000-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1701404191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404191, "uuid": "185df767-86ba-4b95-9375-baaf23b2ab26", "comment": "Malware payload (Loki)", "value": "a8f20b40aa25476e0ceef84cbcf583b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404191, "uuid": "e679bfc8-1543-42b0-854a-0a30579c4a45", "comment": "Malware payload (Loki)", "value": "d42c0f3feb463d2bc5899d453f2c5cc05efc8c4a63dff73982e0d0447f41a4b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404191, "uuid": "d95948ba-19ef-48dd-96b8-a696ca3d8a9c", "comment": "Malware payload (Loki)", "value": "9271c751af194e774be1e45286e0ad8e9d5bfd6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404191, "uuid": "29edda03-99ff-4c06-b914-ea4a97135874", "comment": "Malware payload (Loki)", "value": "d520b9b940f1aaba409308cf608c8cef67d3e792c6ffbc28071bf16b41867e68dce4ccef965739130e2466cfaf47297f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404191, "uuid": "8b886faa-eb6e-40a5-84f3-b5d3de4b9b08", "value": "T14DB4021A235A9362D67E4BFBA8D5A404C3B3B417A850F31C5DE200DE6675B00DEA1FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404191, "uuid": "1185e516-5a80-4d65-9679-47c71ba79a6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404191, "uuid": "0f379792-2984-45df-ba32-489813633937", "value": "12288:5CG3JtI9jCUOpoZdMlK2I5qHW9GZlAMLsWd9louH4PhgXq:v3JIjCwGA2UqHW9GXVL8uHqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701404191, "uuid": "c3a60db3-b74a-4b16-bff3-bce226874d20", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701404191, "uuid": "75126bfd-4f2a-40f6-9f1a-1df03dd74999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404191, "uuid": "1b1424ef-c214-4f04-8aaa-5d7b643e8ff8", "value": "SecuriteInfo.com.Win32.PWSX-gen.1907.2567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463e91d7-908d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701464693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464693, "uuid": "44811449-bed6-46cd-9e40-8b4ce5faa555", "comment": "Malware payload", "value": "3fff6b68ec9d18f01572e95e28bcda01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464693, "uuid": "c608614c-0f8a-4b38-a508-0d89a9c4dee3", "comment": "Malware payload", "value": "d44236eeb92cc872600b3d0ae889c11912c1bb08c9a0f9c1657c9e2d58466879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464693, "uuid": "da4bcfb9-5295-42cd-b62c-4792dc3a6f02", "comment": "Malware payload", "value": "8e882c3a22ced47fb0d1ef77e5b4fa929c1fb2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701464693, "uuid": "68f062e8-9ca5-4be5-b38a-1edfecbc030d", "comment": "Malware payload", "value": "22ddcb06cc0afe94ef9da7788cd3bada54f75458a860d87f25411743e11868985a3fd7e7397da2e3e5f2d9ac4fc1e4b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464693, "uuid": "bdc5f5b3-8c46-4e3b-8fec-cf2afc851940", "value": "T1D2545C13A2E06C60E5264A328E2AC6E8661FFF518F3D77DB17546B2F09731B2C562F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464693, "uuid": "74131de2-9746-4927-ac9e-4d5e09558de5", "value": "d3ecaa3ff256d295d638233f7023beb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464693, "uuid": "fabe5ed2-e5cd-40c3-a076-a0a7b80a98d6", "value": "3072:Eb8yXVzi6JLd9LBOr59azRrCLneVsXJnEmtGHJ/JVeECaCb7HBr4u0hlb6C:lMiULdVsV9azRkRX9FupfevbTBdop6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701464693, "uuid": "6e3cb1b5-18b7-4530-87cf-0014afc140a4", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701464693, "uuid": "d77b649c-4c6d-405f-8269-df4dbe899251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701464693, "uuid": "39212ff3-7fa2-4214-9d3b-4e8b35567e79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cabe6c-9074-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701454041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454041, "uuid": "2e93e024-5c99-45b0-85bb-62141c338bd7", "comment": "Malware payload (njrat)", "value": "89e06e5b3a093d20cd0c0bfa56a09684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454041, "uuid": "41b7a7d6-06bc-4ee9-b53b-8597c294ca9d", "comment": "Malware payload (njrat)", "value": "d7ba376e4fceabd41b3e9fe4a82f60919f793c74f10f8713ba2b0b74e7fe3e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454041, "uuid": "1062a239-ce1a-4090-8868-f2102573d2b8", "comment": "Malware payload (njrat)", "value": "3f76a726034cf84d7dab3b0920afce4427c1638d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454041, "uuid": "67ff58e4-fdb5-4d21-b7b1-593aa087daf9", "comment": "Malware payload (njrat)", "value": "7c380d3086abd308f477e03632b501b907446d526b24e298f20c3c6a6b2c848d83e881b9f809cf068e92a70c9819b776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454041, "uuid": "988bb324-deed-4885-b17f-9e15f032c285", "value": "T1EAE208067BE94215D6BC5AFC8CB313214772E3838432EB6F9CDC88CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454041, "uuid": "8ac87623-76d8-4941-847d-231ba4e45b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454041, "uuid": "75f476ca-5631-484a-96c7-4b6d29a93dec", "value": "384:30bUe5XB4e0XjOnPw0Q0mS03iWTjtTUFQqzFoObbn:cT9Bu6I55Zmbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454041, "uuid": "1f47ab66-4347-4ca7-96c0-8067f374a4a6", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454041, "uuid": "785ddeb8-54b6-4905-899b-708c66e97301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454041, "uuid": "045fc70a-c91c-48dd-95a1-fc70c24512b4", "value": "bScu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a44a9d-8fef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701396986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396986, "uuid": "8175b3f0-f391-432b-91de-21a0dce59b92", "comment": "Malware payload", "value": "c2e39d8dd749787932b3602a2d7dd98a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396986, "uuid": "939b49cb-584d-466f-b417-6ec10b2d0641", "comment": "Malware payload", "value": "d919252d2e7f7430c647bfb37ebf073ff1cc0934b1530de0a664f7a01563c69f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396986, "uuid": "6286af08-4834-4682-8041-622f8258b1f9", "comment": "Malware payload", "value": "3d98d40248e5114d81c9afe92041cdbee43d0a1c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701396986, "uuid": "643017cc-e1b7-40a4-819a-93f20362f35f", "comment": "Malware payload", "value": "9dc35919f5577fdaabb0f7a8b45fa0999ff56e60884decaac78ab942feb506f94c922a144d9c8ff12773052fd4a334d7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396986, "uuid": "82c7d677-184e-4023-8d96-dd979f386c41", "value": "T1EC56E082FB98DA5ED8764033C8A7417772579E09894192FB178CF32839739926EC4FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396986, "uuid": "adeac4b6-68df-480c-b8fd-4bc3773b4c41", "value": "98304:7GgnmSD+RbBsxzfNY94FNHT82P8xxhOWctt1MxLoffb8K7MmC81kCSrLrLTo:73HC4EoffQK7McwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701396986, "uuid": "ab325028-eacc-4ab0-b786-2ce985933497", "value": 6035691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701396986, "uuid": "4efaa7be-1c51-47b2-b858-7ca59452be26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701396986, "uuid": "d99bb8b9-d83b-4f14-839d-77293ffefba7", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1151ddfb-907b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701456874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701456874, "uuid": "1c7f2e26-7e19-48c8-98cf-b811bdff6159", "comment": "Malware payload (AgentTesla)", "value": "bc093d7923b582bc37b09a814940a4e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701456874, "uuid": "5396ec46-b094-4ba6-990b-25154b0336c3", "comment": "Malware payload (AgentTesla)", "value": "d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701456874, "uuid": "d949e8e7-bd2b-4392-b106-3a27540caebc", "comment": "Malware payload (AgentTesla)", "value": "4ff679166f942395b2d335757f759f39fe8dcdd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701456874, "uuid": "c7774cb0-ec35-4217-9f74-cd15ce74c6e3", "comment": "Malware payload (AgentTesla)", "value": "17473deffe0f7b6e36bb801c76501d1f9cae3b376353960ea489246b24a965a2104c3855c5d696a39100c39c5e90e288", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701456874, "uuid": "f3c17059-7f8c-400b-b51f-1f2fb50d3a1e", "value": "T109059F517388988FF8DF05F2501E813252B8A99F9156F78E3B43AE6919D3381149BFCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701456874, "uuid": "8bb21773-2e79-419b-a542-25962c4510bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701456874, "uuid": "4245730c-cc7a-4151-a8b5-b17ab839efe2", "value": "12288:QWodJz/ZGPpglaJwnQieFtD6Ba+FdEmp2UdAmhu1qCvRUULCeNPSiyyjK:QzEpglw53t2I02wfU1PnNPd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701456874, "uuid": "ac61d013-3f62-4aa9-920e-dbfc1f252c4f", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701456874, "uuid": "f094fa9e-85b7-4110-897e-84613e1a438a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701456874, "uuid": "107f1a70-9052-4eca-9745-bcedee7a0ed0", "value": "payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbc0bb7-9059-11ee-8907-42010a9c0042", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1701442583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442583, "uuid": "0547923a-bed5-4246-8bcd-63692b117ea2", "comment": "Malware payload (YellowCockatoo)", "value": "f49d3021970471bed6e87a05476aac2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442583, "uuid": "8f8a9f77-22d9-4310-bf48-0591c7aa9561", "comment": "Malware payload (YellowCockatoo)", "value": "daa704e01cde1dcce238cf0a995d6bf7057985d17894c28938bd8d09c45a9fbe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442583, "uuid": "5424946c-0366-438c-a157-3938a50eb502", "comment": "Malware payload (YellowCockatoo)", "value": "fe469c27c7f8bc94c943ef7ffe9ddb99e0bc7096", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442583, "uuid": "eef4bf2a-d5ce-4994-8ed4-e6841690f8f3", "comment": "Malware payload (YellowCockatoo)", "value": "7052e553c412c2a513542bd0517322497a0d55e454428b536bdf399c46e17d60ce8fca384f4fbbf3fa9cb8ced38b6ba6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442583, "uuid": "4f6cc372-26db-43b5-8294-23f65b3d9aa0", "value": "T173256C0677E1C940FBEC67E46CAB5B936B2093F3C6C187451BAE58F1072AB2544F88E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442583, "uuid": "bd84e5a5-24a3-4910-966f-f1c2c04d5a38", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442583, "uuid": "8dd6f61a-4d66-4614-9f8c-4e7ccb8d9aec", "value": "12288:8oTOb9WB4KRko3GEc/7L4P9yjdNJyEx6Z7/ZM5I9yjM99D:BT+WNSo3GEc/7L5j4E9I9yjM99D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442583, "uuid": "f6262049-346d-4cf8-9901-2010b185f3a0", "value": 975376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442583, "uuid": "9201f102-f2bd-40be-ac3f-d0632f9e47b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442583, "uuid": "4b7f22c0-c84c-4a3a-8e99-839eeb90780c", "value": "SABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZjqMUQJjQmNlTYMGKYIsGSOeIYLRNPLPpBOB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f1e7f7-906c-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701450442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450442, "uuid": "9729c947-8529-4af4-84ba-7886050eba95", "comment": "Malware payload (njrat)", "value": "1eeacb1209fce9f46b1fdb78e18403fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450442, "uuid": "4ba7530d-8533-47b7-9d8c-79ae6cac39c5", "comment": "Malware payload (njrat)", "value": "daba90738b0b802bbf4563cf4f48b1b9611801bd251842873ccf03b1eafec46d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450442, "uuid": "583d8203-864c-4f1d-b96d-ffc3ce4eebb2", "comment": "Malware payload (njrat)", "value": "73467473812d18e01cc460fab41b6461ed9d9de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701450442, "uuid": "47d16b27-3b17-441a-a788-c48c963d78f9", "comment": "Malware payload (njrat)", "value": "12128e4b508c7de64fe388e5bfeb1972babddc4346670d78e2792870a92a7eec588361fc90efac89258f372751c6ebb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450442, "uuid": "b1f4a564-1787-413a-8370-0b7caca83d5f", "value": "T19CE208067BE94215D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450442, "uuid": "cc77e9db-1773-4a85-8c6a-fd5195f87bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450442, "uuid": "e7bacffd-8f32-4e4f-8ebb-1596842432d7", "value": "384:w0bUe5XB4e0XjOnPw0Q0mS03AWTxtTUFQqzFHjObbZ:1T9Bu6I55dVbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701450442, "uuid": "f86fde8a-4a5d-4d7f-924b-3b9933d2a7ac", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701450442, "uuid": "c9c3152c-5187-45e8-b2e0-e5c36e0e216f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701450442, "uuid": "531327db-87f8-44bd-9890-e14384832031", "value": "bScp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96c5e32-8fef-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701397026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397026, "uuid": "e131e11c-974b-4598-8c90-1ab830aedf02", "comment": "Malware payload (Formbook)", "value": "a945ee42b9e2b7b5d86d39fd848bbfdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397026, "uuid": "4adaea3c-e167-48d5-8b95-3e1151efdc5d", "comment": "Malware payload (Formbook)", "value": "dba7e341680ce85d5a6faffb271341125a079ba249ddcc78db2d3bbd74c5ceee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397026, "uuid": "31e9f615-c3f2-4fce-b38f-3b00803619f5", "comment": "Malware payload (Formbook)", "value": "864447e507ab37f8c914e289a93cd81b685e7712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397026, "uuid": "3f2917ae-0bc8-4186-bcdf-5ddc7e2de89a", "comment": "Malware payload (Formbook)", "value": "40e209671a92f602bb064a1a4aaf171112f3076e4eb7233e546f1da1a5c84729ddf6a6f83be408f2c7464cdd9ce08325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397026, "uuid": "dcbd4342-743d-4c35-b98a-5151fdaa7520", "value": "T1D77422136BD38977D6B04CB44A37BB7DB3BAD16C1020538F97B43F3B7A611098928666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397026, "uuid": "0c7d6350-fa7f-4de0-9c6d-bdb0c3734949", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397026, "uuid": "823643de-748a-4812-a331-f3350d1bdf4e", "value": "6144:P8LxBsiiQwQkg1wVvKw4qrwUukEJ5aZFFj/YmGe6GAWbFISmIUty3BsNqDSN5W:xzQVkgov3+pJ5aZTGeB7RIftMBsNqDSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701397026, "uuid": "0472b5d0-febb-4289-98df-fd37e0b7edc0", "value": 352026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701397026, "uuid": "1a2bb294-7602-4633-9787-4f1f6796becd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397026, "uuid": "b55b0814-0d07-4fa1-9782-ee4575bc24a4", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.29695.23267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffad90d-902a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701422324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422324, "uuid": "9caf01a4-e96a-4e0e-88ec-1a29b601bf36", "comment": "Malware payload (AgentTesla)", "value": "9e60f887ca21af01d0c370a94d4e73d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422324, "uuid": "b0448ff7-4a8a-47f2-991d-037e1a91c694", "comment": "Malware payload (AgentTesla)", "value": "dbb832a8e39eadb4dff92c86785f16fc52682f8acfe0a831a4ce8b6a958e93ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422324, "uuid": "a517512d-65ef-41ce-9b03-905e80bb3f40", "comment": "Malware payload (AgentTesla)", "value": "fadc53d73ba72988eeec272d0076ad6dcdd0c680", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701422324, "uuid": "704684af-7e13-49ac-a0c2-d8302a7dec2e", "comment": "Malware payload (AgentTesla)", "value": "2d32a0412ac9cb17dbfc34e34a7b56b9b71c8495c60183e9a0b3de183307d4f1450a3b32ffbfc70f3c513aa0994c764c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422324, "uuid": "be871053-54b1-4789-9f24-40c5af0fae9f", "value": "T114545CA137D88AD7F19E02B490119B0647B7D2B7E887F746787466F88E8B3D089794C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422324, "uuid": "c2fdf513-5aba-4f12-9579-6477f3e2674f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422324, "uuid": "6e7f66c8-a05b-48f2-b96d-d15011aef44b", "value": "3072:oQ53wnXOm8tSA4M/msYWkVHF6++4mNMa9W6dfukJL4G5e911rIV3tQZ+vXoxltnV:oQ53COs5W3cG5eRUVRvyepzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701422324, "uuid": "e7be3519-8f0d-4e2b-b30f-9b18e8579157", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701422324, "uuid": "b8a5836c-ead5-4118-968b-97946deb82cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701422324, "uuid": "02ab3a8e-cf58-4cf8-a3a4-e9eb28b89c3d", "value": "Scan_20231201_085902_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40a6ae4-901f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701417713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417713, "uuid": "33a15ce5-63ce-453d-b823-c561fb5a0dd5", "comment": "Malware payload", "value": "e4fa97bcbc15e480f80d274741643e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417713, "uuid": "29c0a0cd-b24e-4450-8224-53c74764805d", "comment": "Malware payload", "value": "dc67281912dc5e2d800addd8fa7ab6bb5fcf2712e443f6e06a2f3641f03956e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417713, "uuid": "6d295b8d-62ae-4304-b08f-6dda1cf8486e", "comment": "Malware payload", "value": "da40d549baca39c520d60dc405d41a8447aa338a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701417713, "uuid": "4534eb04-d734-4a89-a5e8-5bd5bce03881", "comment": "Malware payload", "value": "b55a6ca05a67df1a8e4d2244c7067e21073d8541240f1aa3b9112864c10cc63244dbe7c30ea46817199c063a234c8aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417713, "uuid": "e7e73f4a-1219-424b-882c-5a1e602a797a", "value": "T191F733A0574F8106EDDA1BBEAFD92A6BC52277C407D80529E4CF90EF5971E23C60B14B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417713, "uuid": "4206e077-99bd-458c-920c-c1b63a36f824", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417713, "uuid": "8e99a8a1-efb5-4421-977c-6117422b3791", "value": "1572864:rIpHvAnc6XQBmyNGFNdsSITfZiv7PbdpWBrABI99v/m:rSGc6gMmGEAjDdpvI9JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701417713, "uuid": "dcdd44cf-7be5-4467-a2a8-1002a286e8fe", "value": 74202644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701417713, "uuid": "708cf6d9-c91b-4ce7-965b-520ec41e45f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701417713, "uuid": "a7012561-b721-4428-b987-534fe1bf02a1", "value": "EnchantedRealms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc749aa6-9046-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701434505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434505, "uuid": "25904ba7-0b6c-4a2c-a190-2acbfcc3c579", "comment": "Malware payload (RedLineStealer)", "value": "0b36f87b73a6eff43d351c091e42b33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434505, "uuid": "f4d4db4e-0526-4eed-9910-1a71ebee640c", "comment": "Malware payload (RedLineStealer)", "value": "e07e69559c0b24d62ec790b84075f18c9fa8480780eb8abe7d3bc10897a86a78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434505, "uuid": "b06ea810-d3b7-4ef6-b9fe-5e23d6da21e6", "comment": "Malware payload (RedLineStealer)", "value": "98ecc569f5a62b685c07fdeb25e9f1630b23e606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434505, "uuid": "2f4ce989-a86a-4be4-87fe-6c31db05bd67", "comment": "Malware payload (RedLineStealer)", "value": "be053e42d064db7851e7a1e0811da83cc9e1f873dc44ba0b7c72cc27f705a67fa8240e5b9487d6781b1809116a0e8eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434505, "uuid": "a675b461-3503-433e-9561-9f0f0474f249", "value": "T15934BE685CC590C4E44AAAF6BF90DAC377B6BF316243400C1D5DA2194B677B2ABEF0D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434505, "uuid": "1f0d9f13-d383-44b1-a8ad-5f6bf3018f9c", "value": "dd57e6241193db02ac9b4aeea2df893d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434505, "uuid": "8dcff165-a0a4-4b75-a021-65c41657d8f6", "value": "6144:zfFcZshKmueAkAh3mhlCKyM+jJGTgS/C2s9QCC6aL9XZUdtpNK1:ztcmvutMwGRC2s9QCaL9JU5NK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701434505, "uuid": "ed091cc0-be47-411e-bc91-e8771ba68243", "value": 241880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701434505, "uuid": "b6fef743-5251-4244-8dc9-e2aad362b6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434505, "uuid": "35023afc-811f-46ef-aad8-a56a5ab2c4c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c86d8a-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442335, "uuid": "35f6aff6-e191-4e34-b949-066a7cec81d8", "comment": "Malware payload", "value": "bac99fe19545d6a01c2c9e5199268192", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442335, "uuid": "27490267-5866-4fa8-afbd-6a4a2e8be015", "comment": "Malware payload", "value": "e121db3b47795eb101fef9a5ffb85e3e2fc90da82c9608dbd3de79a0504bcf55", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442335, "uuid": "cee3e7e1-237c-40ec-9f66-2b2a2303e14e", "comment": "Malware payload", "value": "e2c613c3ed919bb287b92f8eb51d7134db719596", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442335, "uuid": "06904012-faa5-4cda-8096-7e953701f37a", "comment": "Malware payload", "value": "c4c8f0c34d745a54b42bafd8a49d01f4b4b08c8f202245345637d5b5a62fdbbbea37d3b7343d1de78e5bcab059cd39b7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442335, "uuid": "560cf599-20b4-4ada-a9fe-01673a7712f9", "value": "T1B0560175731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC0AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442335, "uuid": "0b744daf-9e71-4f64-90c1-e2ebb1b550a8", "value": "196608:/QDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYo:wirUVis8O/0giAZ9PDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442335, "uuid": "14e9e9a8-dc6d-4ee7-84c9-064aac9f61e8", "value": 6364094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442335, "uuid": "98a92bec-64eb-407c-8360-1adf409ceae8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442335, "uuid": "0bb84b93-94f3-493d-ae91-e8b18cd08ca6", "value": "\u0421\u0431\u043e\u0440\u043a\u0430 \u0447\u0438\u0442\u043e\u0432.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26937c37-9051-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701438870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438870, "uuid": "3603b252-8c28-4eba-8123-f9f4420a5779", "comment": "Malware payload", "value": "f23d61d5ff249493e4b55e0690d7b3e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438870, "uuid": "4a41bce7-cca4-484c-bf0f-b22ed4830dbd", "comment": "Malware payload", "value": "e164c86cf3eead4541a719f3cc5f08a7f0b36384fb8e95098116acadad23a69b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438870, "uuid": "cad1476c-13d5-4d27-b7bb-f42b15807c22", "comment": "Malware payload", "value": "a6eccac18cc49aa7fe3863afb24d3975a5cf30a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701438870, "uuid": "7e141d35-8477-4bcd-af86-b46c480b42c6", "comment": "Malware payload", "value": "a41be6b0ad38eefac8683a77d72a5aae23b6d61fa69be9d6dfc6f3ad03bc34708d59721de85091a5d6ef64ae9a370405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438870, "uuid": "8a759bda-4715-4b89-a197-4f88cd94b5ec", "value": "T18EF5ADCCEBACAA44D3D94538C6F6AAB0D17714F19964CD7A68D0221D08B3B5D025ECFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438870, "uuid": "388369fd-ea8e-41f2-9633-74be331bc062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438870, "uuid": "beffca28-706f-46d2-b94a-fa7c0e939467", "value": "49152:3osVZWC0R4XRbTaDmixqWsOFQlrYQBDcLatzB+L0iVBH+nBz0I7C:3Z0RkRbTaDmcsOFQpEwIN+d0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701438870, "uuid": "6e6fb959-fcc7-45a8-a1d9-081b74c5a310", "value": 3343008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701438870, "uuid": "32599df2-ea73-4137-82bf-4ab859bf0f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701438870, "uuid": "e9fc5c15-e725-4d1f-be49-6b7ab1dfa05f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2d60c0-8fe5-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1701392764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392764, "uuid": "fb96aa9c-1b6a-4fcf-83f4-502d96680b73", "comment": "Malware payload (LummaStealer)", "value": "b290b7e24053091c4f35d1f967173f4c", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392764, "uuid": "53221b87-63bd-405d-8d02-9cc75fba7fec", "comment": "Malware payload (LummaStealer)", "value": "e16b28646be4088bc9416f2fd0c2623cf5267e0c8599753d0402a57b6a17a8f4", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392764, "uuid": "83bace19-27ec-4dac-953e-16299f406a26", "comment": "Malware payload (LummaStealer)", "value": "afd08a65f4280c95c44fa637678221332974130c", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392764, "uuid": "4ae00b8d-719e-4cd5-acfc-24057e8625dc", "comment": "Malware payload (LummaStealer)", "value": "24d254d58d30fd0e5cdefb70f8d8a0ea79e091b24b19b37981c54534cdcee2cbe272f287fbaad303bd6e98cb42d6abfd", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392764, "uuid": "17a3b82a-cc1d-41f3-ae21-15d09a56f225", "value": "T1272702C7E6D442F4C486C170A24A536B7191BC4E86BD7F2F3BC62D213A30E685A8DB75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392764, "uuid": "b0c9495b-5d31-4bc8-b2e7-4a1d9db4c48c", "value": "1cea4cd5c60f2b9671deab97265f526a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392764, "uuid": "f40acd0e-6630-4a31-887b-5cf341a3a62b", "value": "196608:/3KibLNmru8Xcqle/gUh00f4ayzDVmbQo4PUeIEsKEIAyaRNElgHhYii8ICtF+if:/3wru8X5cgUx4VzDQbQR0nEcYcuUeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701392764, "uuid": "3d6c9a5c-c5ce-4dc4-be32-5fcb51294542", "value": 20799928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701392764, "uuid": "1d42134c-1884-4ab5-9b96-5d4480414e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392764, "uuid": "be9c0cbc-7edb-4b43-ab7c-48256fea888f", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ddc110-9017-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701414094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414094, "uuid": "fe8b0a10-005a-4942-9bfb-7ba8b74e3989", "comment": "Malware payload", "value": "d44c2f52fc7690d662245168d08b5cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414094, "uuid": "2d0e25ad-010b-472a-93cb-eb00607b8bd3", "comment": "Malware payload", "value": "e2451b60cc19e8d4ca41d0ea4d1e24bf8a6aa07d77762d87b072653286c09bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414094, "uuid": "85cc3d40-f0fe-4aca-9009-c624e273f827", "comment": "Malware payload", "value": "093a335b6a7e8415bd5529cdb70f083072fad70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701414094, "uuid": "0739ba8e-927a-4478-a7a7-d43197472c74", "comment": "Malware payload", "value": "b23881ae908970a33a3b058484cf6580cdab1a12575c001efb3164982b5d74bb2e76f2c5a85b3d54d92719fe4ef0636e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414094, "uuid": "2be2daca-2777-4ac8-ab91-1dcc06dcf445", "value": "T1C0249C2325F0BC61C02B43344F5EA9EC7BEDB8220FA98B5727182E6E59313B1D667354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414094, "uuid": "ca8e134c-fd89-4fff-8b0c-338a6fb76345", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414094, "uuid": "ed2873c8-a65e-4b91-b913-9a713232b2cc", "value": "1536:r+JssII66soPuUL8cPhRcWh14S0KFBXJ9lVSGStTri8Yil5cVJKj07X91DyR+ydf:r+vTPzxBZ9l5qjAuinDeBMKb6pHc5ibK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701414094, "uuid": "43441728-039a-408f-afcd-a433ee35dfcc", "value": 216589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701414094, "uuid": "138d2fa2-2bf5-4119-8ef0-922bda913046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701414094, "uuid": "1de6e11a-9d85-48fc-b83e-4e6d003c72ea", "value": "d44c2f52fc7690d662245168d08b5cb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05baec82-9047-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701434520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434520, "uuid": "a73866c0-a791-4493-9863-35d05e71cf1a", "comment": "Malware payload", "value": "7a6d654cf9fe9cc19d8cd8f4fa92318d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434520, "uuid": "d2929918-0db2-4b1f-83d6-982ff06048c4", "comment": "Malware payload", "value": "e31180e474640b235bfc58d1dbcf25720ab923f3475a039eaf28d3eea9ed8950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434520, "uuid": "856e89ec-11a6-42a9-963a-1d0efee4daee", "comment": "Malware payload", "value": "692e589107f57543bf5b0bc13c51f576ad1ca088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701434520, "uuid": "ad69c668-5d77-4265-bd6d-2121457bc620", "comment": "Malware payload", "value": "1ef05620e8325e29abd159cb44a2130a2dfda9d2c9deed3cd4452bf913928a535fed5dae1b293a2ccb756b122fa6c289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434520, "uuid": "edaa253b-ef50-435a-8735-a23355eb51fd", "value": "T11C257BAC765075DECB17CA3689582C77AA20EDB6870BD203901F45A89E0DEB7DF105E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434520, "uuid": "22b90e0a-5d1e-4517-a326-bb7c97e0faba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434520, "uuid": "558defe4-4eb8-4596-94cc-5c5c9daba203", "value": "24576:FcOVUXTKFHzD8uigUd20pFotTyXE8LBBR72sWmwd4g:FPFTAvld2FtdUW5Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701434520, "uuid": "18330732-39f1-4043-9d44-51ed1e5a3ed2", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701434520, "uuid": "1d868309-a840-4feb-81dd-fd8a2d6590b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701434520, "uuid": "59f3efaf-3dc8-4634-9a05-657efaa86fca", "value": "jMf2iRKPkFNDQy6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dacb7dc-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442345, "uuid": "dc721924-41f2-4e3a-8da2-8c16d0960145", "comment": "Malware payload", "value": "0ed4b4d7f96ae3162fb0688a36eeb0b0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442345, "uuid": "61a1006b-f467-4ffe-8d46-3a40478edefa", "comment": "Malware payload", "value": "e42b418fed4e5e7710bacbae6425d365d96471c9f99a4bfed2588611b559a190", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442345, "uuid": "e073d845-3678-410b-bf2e-ff80a9c46bb4", "comment": "Malware payload", "value": "ac7b32ddcd47c5febd9d8ecc45ea7a9d549fe076", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442345, "uuid": "9ec0df6f-a799-4b47-b34a-134810296f64", "comment": "Malware payload", "value": "ac5351f5ca7eb42ea9828751ada90e3998beb83b47a44fa1cfcdac61266d5e5957888c26ee4eec8e60d745b91722132f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442345, "uuid": "29578b52-4626-44c9-a85a-84e7e28d8269", "value": "T177560175731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442345, "uuid": "86ecaa49-7018-484b-ad44-4f3168aa7302", "value": "196608:/kDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYU:sirUVis8O/0giAZ9PDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442345, "uuid": "d51c7ab8-b280-44f1-9de0-6220b09db0c9", "value": 6368189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442345, "uuid": "33c4a776-ba1d-4d57-9cce-46ac51411291", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442345, "uuid": "0b9e07de-7ee9-41ba-8f35-37f1426597b0", "value": "Scype.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dedf85d-9015-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701413113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413113, "uuid": "78146015-3084-457f-acf7-d404caaa24db", "comment": "Malware payload", "value": "cb4b04c44298a40d122f9b94f63fab9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413113, "uuid": "cb9fda26-e8d9-416b-a90f-8b021b0ce4c3", "comment": "Malware payload", "value": "e53b42bd07456e4c326cfc12bfa3f6810c553a34c63dc4fdfb42a270c1fc1cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413113, "uuid": "418e388b-deb8-423f-a51d-1fa1f9a19a2a", "comment": "Malware payload", "value": "1797848615b361ba0a1edf4f08aa2da87deb53d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413113, "uuid": "7a4043de-a552-4f97-b595-1dea11135493", "comment": "Malware payload", "value": "90571ed1d699966ec0e7808d87f74332dae61dd8dc7aac488e2bad0bb6f4234c5c8c44dfd338758a3ffb5b11bbaf7d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413113, "uuid": "6b19e0e3-f60c-45ce-9c30-65a6c443dcd0", "value": "T14605F151BA581BD6CB74D3FA58109D3303F4EEA62936D2094E9EE1CA1E36F314B41E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413113, "uuid": "bb55f7ba-4c34-447f-a16e-e4e017868798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413113, "uuid": "71db594b-233a-4396-a453-26cc833cc6e9", "value": "12288:QfLYYZXTym7BmFHWA8EbjliWEVGHJlNuCLeV8EqkmRGz1eRLJhDVYx8Ap/2NuWYB:8XTKFHzOVGfNuCqV8tGzKthDSzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413113, "uuid": "d9874147-9a2c-4176-a9f3-c9230b470c50", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413113, "uuid": "df027430-75fc-490f-b334-b3a138c62e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413113, "uuid": "146b2cf4-a3af-41ad-bb77-93af6125b248", "value": "hesaphareketi01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb1e38f-9031-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701425088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425088, "uuid": "887a917e-0efd-44c3-8580-c1683a5a8a46", "comment": "Malware payload (AgentTesla)", "value": "7a7b91d6b66cd23fa879506eaa0cb829", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425088, "uuid": "7e0b8182-e7b6-48aa-abd1-c20426cb5566", "comment": "Malware payload (AgentTesla)", "value": "e5b705e1be26c11deef73ef07f01c2403c63eeda1587bd7604e3a4dceec2bf05", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425088, "uuid": "f5f61dcd-7fe5-4a95-90c6-b98602238c87", "comment": "Malware payload (AgentTesla)", "value": "95e422b7612ed3262577d4a35c8a135552c94df7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701425088, "uuid": "b65e515b-99ef-41f2-ad59-21c563047184", "comment": "Malware payload (AgentTesla)", "value": "a73477c1874874340ee3c060e9a18b4000e41896aed9a2c01ea4dfe3cfdfa0db591487bdb6b9d7dc1f4b62a7e69f42f7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425088, "uuid": "50ff1562-5434-428e-ac8f-b9e0646fa77e", "value": "T171D423038426D1B979721BBECA3BD40D9200295F49B36966BFF511DB117262298F3BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425088, "uuid": "089f557b-de6d-40c4-9bc6-9f18008ecb44", "value": "12288:IXRp6d4oY1dhwhKWtGMzfo3cyjuola/d+4HU6e9+hXpKE5ls:IXRp6d4oGhLWLzfo3cOlaISjhXQ+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701425088, "uuid": "fb2c6f6e-a026-4ca6-8b55-e8d0e75ed574", "value": 649290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701425088, "uuid": "27fdf132-ce94-4cea-a6d8-2721cc2a8706", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701425088, "uuid": "ebccaa79-90b2-4cc5-ac64-84699ab6b1ae", "value": "payment overdue (2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4768fa3b-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454817, "uuid": "80879cea-1ad6-463d-ac54-feaf47353233", "comment": "Malware payload", "value": "178ae28bbeadbec25aa375ec804c7315", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454817, "uuid": "feaff49b-5966-46b8-8c77-13dd0dbde49d", "comment": "Malware payload", "value": "e5c00b5dff3e2d53fb16460ddb8776706a63d1d5007eef90f0461bdb36be4a9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454817, "uuid": "759dabc2-5276-437f-ad7d-d281109cacce", "comment": "Malware payload", "value": "606b26275de100d7e3af68f121667ae0bdd341ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454817, "uuid": "c42ccf65-53af-4c95-af6e-185048ce5d93", "comment": "Malware payload", "value": "6322fe14be60636241c239d41b1633e989604bb8e5b329a608c9328d154cc0d5346a0939075f3f606556e47bb523e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454817, "uuid": "fff2b44c-e68b-40d5-8331-cf660865150a", "value": "T1C7C49E067578E89AD01C993348B3CBF46AA36C21CD52061F75DDB74E6C7330B1AAB85E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454817, "uuid": "1d0e1cd3-0d4f-4dcc-8f15-853318197a5c", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454817, "uuid": "712d7dbb-290a-4a48-b175-fbc25910f8de", "value": "6144:+RR5rhZFQGrsUwF7vlPoSzRuZKlmZhZVzBcziXVq0RuZKlmZhZVzBg:+R5nWFpPoSzRuZvZ3VKi1RuZvZ3V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454817, "uuid": "c4e6c2ee-813a-4e23-a26e-c80b72d8cfe1", "value": 563677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454817, "uuid": "5dcfc66d-908f-4305-95a6-c4fb76333b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454817, "uuid": "f0668497-1e40-4717-85cf-eb35cf3cbe2c", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.29975.15970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f910017-8ff0-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701397171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397171, "uuid": "bd586a47-2b1c-4080-bd62-2b6ead59512f", "comment": "Malware payload (Tofsee)", "value": "f4eb02f3a2587ba66f1036cae85e4770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397171, "uuid": "646d8c0b-6e99-45bb-b255-2a7fbe1a45ae", "comment": "Malware payload (Tofsee)", "value": "e78128c2073dd834976128e47d671edf32ce7e86820bec6b1d1837d58cd7b4e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397171, "uuid": "2aade502-4a0b-4aba-b0fb-508dec025543", "comment": "Malware payload (Tofsee)", "value": "e8ed42963f946e33ec99af067eeabf0412436b62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701397171, "uuid": "be86e01e-a8a9-4a4f-82fa-12a07d89c674", "comment": "Malware payload (Tofsee)", "value": "01f45a534365b305c2d7967b213c83f7167c2d25ab8d7e0754a2ba03444c988acbaff486e4191023d821ea082b0e0137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397171, "uuid": "afe19070-cf4c-40d4-a999-cb96cb754ea8", "value": "T17A64D54382E17D46E9278B729F2FC6EC772DF6508E493B691228DE1F04B12B6D1A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397171, "uuid": "69f84b52-df35-443f-a946-dbbf3f94fc11", "value": "0bd61e688135eda02fcf13008a67a440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397171, "uuid": "4382268b-9aa5-483a-9b96-de4bfff08976", "value": "3072:TTgg3xOPn/SpLwMMrcDPXDzGkP2NakC5p+WrjxxMu63jXdo:gOOf/mLwMMrcDPXDzdvN+WvxajX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701397171, "uuid": "35db417a-a9e5-448c-aab8-15063aa7082e", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701397171, "uuid": "9a34a8bd-8968-4493-8baf-d8a586da006f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701397171, "uuid": "488441bf-cf06-4746-b9b7-bcd01f858aab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628f9af4-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454862, "uuid": "404e7300-c038-453c-9e47-751bdf324388", "comment": "Malware payload", "value": "a4631846930b553b52d6f02ce06981d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454862, "uuid": "fec016b2-8fe8-4d79-a425-9757eec4f181", "comment": "Malware payload", "value": "e7b7cbd4eaf4d6e1896b18d2bf29a3b1bc6ce46f92e5ded7c290ca6cbc10d11a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454862, "uuid": "601ddaa1-d37b-48bf-aa35-8194646748c8", "comment": "Malware payload", "value": "045b02f6cb3a49c84349516d4d07c199c9452cf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454862, "uuid": "abb4e103-8954-4a77-ad20-e15e38e6e558", "comment": "Malware payload", "value": "f68d2791b35fc5e5e5d01f9635f92e87e4f5cbcb9f6e271199688e61da3f4f459bfe117621bec948da88f6243e7c17b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454862, "uuid": "a5219da5-fcb4-4a9a-ada5-8808cab9e167", "value": "T153E43B2539D2C732D0BB16306CEF8764A9B2B9324F21864F77849A5D1D335F1CA3A276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454862, "uuid": "8e3b5b28-3f32-4509-b8d0-d742063ad198", "value": "d7af2fc159a181126558c9a587d41d39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454862, "uuid": "27f4566f-8094-45a9-bd44-264832fd1774", "value": "6144:5SjymAQ4NBFpvKrYT02NpDMkT5TBJCT/ZXe4FAt:zmAQ4NBFpvKrYoOtMkT5Tr+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454862, "uuid": "fabe7b52-e218-48c0-9c92-04f83a2c2095", "value": 705498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454862, "uuid": "995edb58-1dd0-44c4-986c-d36ce30e62a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454862, "uuid": "6594de32-13b0-4818-bab8-901b95b90eb3", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.18410.17843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b5cc4b-8ff7-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1701400323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701400323, "uuid": "f197e82e-fc19-44ae-b1b5-bc779c24d8a0", "comment": "Malware payload (RiseProStealer)", "value": "1fb54a25a79c11ed71b7d59efc00e3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701400323, "uuid": "6d9d613f-27d6-4e63-b7c2-39b6ea1045fb", "comment": "Malware payload (RiseProStealer)", "value": "ea560ecb6f7e6bbf73cc70b5fc1268509d89bf6162d6ff9bd775de831a1250a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701400323, "uuid": "a1ff9244-4e2f-4ec6-9f24-80def2c28ad8", "comment": "Malware payload (RiseProStealer)", "value": "9d8805acbfde18ecd9d3925411f175947cddc5d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701400323, "uuid": "9a820a0d-c3cb-4bc4-b3d3-3700e368aa3c", "comment": "Malware payload (RiseProStealer)", "value": "a7a53f1eeb2f5f069579055eec3b1134d670e9fbf349ffda420dfb3cb898cf3fa1f4a84d53aa993f99849357832b8d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701400323, "uuid": "be928603-3e45-468c-ac6e-86adfe734ec0", "value": "T16EC5CF2574684338F8F23DB3CAE9672945EE9924DB1699E3CBF7EFE0C5481D046310A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701400323, "uuid": "408f6f9a-b42f-47eb-8128-3adfa5034c8f", "value": "fe9e3404bebf8b23e1a17d6558da6aa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701400323, "uuid": "c103c1ab-7a5f-4407-9cb6-eac112588843", "value": "24576:8PuV4kGv046jmG9eKN96qgPt9W3O0wI4uIOP3+Hgg4jrjOKqdTza/NN/zYzMd0wu:NGv046xRS9t9TI4+QIj/OKqdTu/NN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701400323, "uuid": "ea8c7de0-c649-4565-a74d-9606b7987782", "value": 2732544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701400323, "uuid": "83ccb5eb-3d1b-45c7-b206-00cc0b9e0463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701400323, "uuid": "8dad490c-1e82-4adb-9a01-64566daa5464", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce24b1f-9036-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701427526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427526, "uuid": "213f65af-2270-4222-b626-570ade5d007e", "comment": "Malware payload (njrat)", "value": "a15a5df58d55dcc2cbd20603964dcf6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427526, "uuid": "adb4815f-86b9-462f-9a58-7fce9b1433e4", "comment": "Malware payload (njrat)", "value": "eb4b6878310b1e2843c964e02ec1782aacb518e32777a3f10581fd70b58dd930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427526, "uuid": "6e19ce6f-8533-4860-80a3-598614928984", "comment": "Malware payload (njrat)", "value": "d8658715b359bbc1ce78292062ce3c10da653ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701427526, "uuid": "a7d76bea-3b85-4fcb-af91-6c43b2f3f48e", "comment": "Malware payload (njrat)", "value": "b1862cde88e1249ac0348c389faee9040dde4e6d36a54e54c34f8c7e50df5ead99ca6a0a9aaac874411a09df32314581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427526, "uuid": "b6f1a6b4-2f2a-4d22-9dfa-9ff1ac383d3b", "value": "T1E4032A4D7FE18168C5FD057B06B2D41207BAE04F6E23D91E8EE664AA37636C18B50EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427526, "uuid": "962a3678-faad-4c85-9460-71c6d9743579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427526, "uuid": "5030f4a3-98a9-4c30-a449-1ee6a9bc8b71", "value": "384:xUEckhsgwi+vx3+j/NSyszO68HvG32Ar+rAF+rMRTyN/0L+EcoinblneHQM3epz6:6LkKVCNhszO68umAarM+rMRa8Nubct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701427526, "uuid": "d64877dd-47f0-4478-af92-7f00d53496ee", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701427526, "uuid": "256351b4-1ff4-422f-b0a5-ecccdc285747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701427526, "uuid": "55acf61e-63dc-4697-b73a-fec2a7fedac1", "value": "EB4B6878310B1E2843C964E02EC1782AACB518E32777A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b465cc-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1701413237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413237, "uuid": "e712a8a9-bd39-4480-8877-3488754e6183", "comment": "Malware payload (GuLoader)", "value": "2e25568898145bb20f78e0b299066ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413237, "uuid": "7148f6f4-b29f-4638-91a0-31478cec2ee9", "comment": "Malware payload (GuLoader)", "value": "ec56cb8c573cb6c332ce8ec33abc0656d1c3780cac1c55a7dd5febd0be9713e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413237, "uuid": "e2a50e6b-bf1e-46d4-9ed3-dcfdda0679d6", "comment": "Malware payload (GuLoader)", "value": "9b8f53327b224f171347cf6ec57360f7bcb90008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413237, "uuid": "e5711f95-0d0f-4d2e-8183-9603e9d3bbde", "comment": "Malware payload (GuLoader)", "value": "6f9d289bef356fc6af3d88aa50c4caf906c697e30043b8b7ac9cbb81f42326aa544681be01539a236a37000eb8dfa819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413237, "uuid": "9c1806da-9a6a-4dc7-ab31-6e01473c6c2d", "value": "T167E4BE9278CA72AFDD2F4574031FEAB21A796CD07382496E4F40760D4C36A4A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413237, "uuid": "3b1ee38e-1538-4583-af1e-40144de06409", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413237, "uuid": "8f43b268-4de6-46d8-8e9b-850eaff686bb", "value": "12288:tkEnhe2eNtB94uSg2p+PgBAjmT9AU1gf3RfiMv3aqEAdv522K7abjI:bhentT4LIPgiOLsB7EAdv02K7abj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413237, "uuid": "17480720-cd42-4928-86f7-76ac62aaf33d", "value": 662521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413237, "uuid": "6585845a-cd42-43c4-87ac-21af5c590f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413237, "uuid": "fbd08be8-98dc-4f82-be6d-de04357b79de", "value": "Fattura accomp 938-2023 del 27-11-2023 ADC Tiempo Libre S Lpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aecfc5-9033-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701426244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426244, "uuid": "f5cf7472-eb09-42d2-a205-67b20942b5c5", "comment": "Malware payload (AgentTesla)", "value": "60f31c64785034095f8a62e89da663b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426244, "uuid": "c2742b85-6219-41fc-9135-f31d66dd1345", "comment": "Malware payload (AgentTesla)", "value": "ecd9a55e9ea48da28cad77769c47ba4836448ae2ef2b86e87b5f20f0badf1245", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426244, "uuid": "8920dae0-1cf4-496d-933d-3c4d9f1a659c", "comment": "Malware payload (AgentTesla)", "value": "f4942bafff2a7638f5aa7b7ddae3ba9bf6ea5ff6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426244, "uuid": "e73ca298-1a4a-4550-8afb-334cd766752e", "comment": "Malware payload (AgentTesla)", "value": "b0e35e6f7c1e985323ee7ab911da42b665340ad5c1d6b6638ba1d1fb5a7c58d36ec69077abd3fc515c2748469d383204", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426244, "uuid": "990d18f1-d7dd-47ef-888e-0c99662c65e6", "value": "T1C02512A1731ACB95C92F87F614A8500043B77D1B94A4E10C6DD53AEFB73231269D2EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426244, "uuid": "1b3dc07e-dc74-4f1b-9353-1991c26a3f32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426244, "uuid": "33854248-dbf2-47d0-84f1-f42c4429db07", "value": "24576:fKJWY4+KuW5qHbhO3U086VbNm46jYF/3xxvOx:fKJW025qHbhOE0D5CkF/3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426244, "uuid": "5b1ff3cd-b050-496e-ae0a-5da7ea304d40", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426244, "uuid": "0e387be1-7f4f-4416-b0c7-e98855251fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426244, "uuid": "bea62b5e-bb4c-4484-bf26-6e9e5dd14c51", "value": "PO-513211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf320f2c-9016-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701413813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413813, "uuid": "b64a5bc2-1c72-432e-8c4b-d4b9165c0d14", "comment": "Malware payload (Smoke Loader)", "value": "3d22dc3012d14bfeab7cdbffe47b05ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413813, "uuid": "bace42ac-75d9-4fb1-9d84-7e105b2d9f66", "comment": "Malware payload (Smoke Loader)", "value": "ecfc5811ab6904de1bb116da15d2877fb720000de97a99d14091b16ec4b06145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413813, "uuid": "6acc4be9-c72f-44af-b008-4a5c4bdf772a", "comment": "Malware payload (Smoke Loader)", "value": "7ea4ca9887bbdb20f569c695493e14a43e443f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413813, "uuid": "b2dbb38f-08a5-4d28-a55b-1fa575f9c296", "comment": "Malware payload (Smoke Loader)", "value": "604b51cfac1f0f5904d51d3f415827a5c96e197b17f6709901f9fed5292a149273dabb3ffef94237d39b796c44d23c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413813, "uuid": "ace8e3fe-2032-4200-ae6b-813794699a81", "value": "T16E64F75782F17D44E9268B729F2FE6EC775EF6508E8A776932189E1F00B11B2C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413813, "uuid": "34fffe78-336d-4d29-a520-0f0e4b9f00ed", "value": "73f64d5610703b4f05e5f8dfa1eaa537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413813, "uuid": "22915068-5dbb-4738-b468-f87cc9c510df", "value": "3072:IbnRbkvWr8Z7VgjkUgCX+LYF+sMKScU+f5KbIbdpUX35U:iB0WwDgQ/m+sF+tzv0kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413813, "uuid": "1d4ef037-2720-4690-bb6a-afb454bec828", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413813, "uuid": "d267dce0-d498-49f1-8bd1-5c6c0d246f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413813, "uuid": "4bcaf4ca-39bd-4d54-983e-30b50c4de078", "value": "3d22dc3012d14bfeab7cdbffe47b05ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e5fd7d-9074-11ee-8907-42010a9c0042", "comment": "Malware payload (N-W0rm)", "timestamp": 1701454224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "bf074ebb-b3dc-46fc-8506-a7825e62c29d", "comment": "Malware payload (N-W0rm)", "value": "293be67590ab7cec24b79c7a89919490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "0667047d-1bf3-4af0-910c-322376a0e111", "comment": "Malware payload (N-W0rm)", "value": "ed04d8ebbc30c39278f1e22d2442853ff704f97f0e494d069034dee2239bc43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "8a28670d-9c1d-4b88-95e5-fcc7e36d9acc", "comment": "Malware payload (N-W0rm)", "value": "d450038a5712de118dafbf02e7ad267da0a026a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454224, "uuid": "701ebacc-d4a3-4f23-bc70-2354573a74b5", "comment": "Malware payload (N-W0rm)", "value": "da3c01dd109b0ce9ac6745aac1b4c6ff3ca2510180c5f918909268f55376072538c8734d2926333dc359113f7f441731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "607320fd-6f71-4453-bf98-0c8ecb2bb81f", "value": "T1A615231442C55FE0E4EC8DFF9C83AF5043B48B61E663E7868498A475CC1ABCF685A45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "54cdfe44-ffba-4b61-8cc2-f8ef7198f72b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "0ddc195a-7df3-4c4a-8c9b-51bdceaf0dd3", "value": "12288:zbk1BL9d48wCQ6QkJ1oYwo9BLmS3K49M/RPP7+S01te4wOE1Aox4aKvOZYc2S69+:47xw6Jfovkt3+RPySH1Aox4dGYjMbU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454224, "uuid": "3c69272d-ce2b-498c-97d9-aaee96fa7d3e", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454224, "uuid": "64573c13-39cd-4025-81e8-c37f7b2cd68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454224, "uuid": "221274e0-3e21-4a66-b1f1-68d6cdefe6e5", "value": "293BE67590AB7CEC24B79C7A89919490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffe0407-9033-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1701426162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426162, "uuid": "88fec750-ede5-4af5-a9ec-20f42ca34d59", "comment": "Malware payload (Tofsee)", "value": "cd2eb2cfc4675f413db94ff743d195d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426162, "uuid": "b9b8f779-fadc-4f4a-84a4-ce57a01be96d", "comment": "Malware payload (Tofsee)", "value": "ed8e31c2fccca230c75e8246d3e31ee548af0139a1e8dfb4038fa256d362c3d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426162, "uuid": "63f67ea5-f65e-4456-a600-d015a6a2a4ed", "comment": "Malware payload (Tofsee)", "value": "bd7b6b5a94387779d88bbfe1e32fa13666be6e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701426162, "uuid": "ac00f678-dc23-4a63-bd4a-a12707ee84e8", "comment": "Malware payload (Tofsee)", "value": "93bdeb2b6002b267e5718e5e5ec61fe86815d209b961a715ea4ee539695e34abe09301549e743a4bee23c1113885dac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426162, "uuid": "1dc582b8-d08b-4f51-a176-624aea100ae0", "value": "T1E934BE217694C032E12759394971CAB55B37BCA39B6486CB37843F3E9E312D28BB4747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426162, "uuid": "e888865c-6339-409c-a18a-b9bfaa84b33b", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426162, "uuid": "251578bb-b119-4161-8255-a7918cd6bf04", "value": "3072:C7lSzmWVD0wRzLKqBKWBgOlaR+f+TmAC+3IxY1b+wiOMOl3eAwXsUvfXVkwIwC8Z:+4x0YLFoegOlaR+WCFi1bviKeXfmh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701426162, "uuid": "f447ae7e-3ced-4f03-9806-e51e3ccb95f7", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701426162, "uuid": "949da951-df96-49a6-b69d-442af6069cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701426162, "uuid": "1d6f8cd6-ea8a-41b0-90af-a29a2aa70c92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5fcf42-90a4-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1701474632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701474632, "uuid": "4fb3c99d-9a38-4410-944d-9f30ae5bf6f2", "comment": "Malware payload (DCRat)", "value": "0496f2e2d767e405b7637fa7efdbbfa1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701474632, "uuid": "2f127ed3-6d61-4e27-9cec-955140512089", "comment": "Malware payload (DCRat)", "value": "ed994b67609f4ac3043c91c3449672f3ddcbc2da9ceec41a160d1106f59a93c1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701474632, "uuid": "b6268455-0d4a-498a-b3a0-78b5f930db35", "comment": "Malware payload (DCRat)", "value": "4a6e5e1fda75b8ed40c2f2871bfba58efa5ae3fc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701474632, "uuid": "5d2cf476-1ed7-4555-b44a-c72a7b43df53", "comment": "Malware payload (DCRat)", "value": "46c18b8df29b2eaa7fcccfd8fcd7146e806af43a9e8392d12f9eb9c23e0c3d9c5aef7bf4b2bf32057c537fe2d7193907", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701474632, "uuid": "92525cc7-4963-4a70-a53f-496803e0032e", "value": "T1DA85C0096787DBEBE74D17B5902018946BB5CE0AD1A3FB6F5849B2B1EC8373819050BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701474632, "uuid": "4aeeda94-b71a-47f6-82f4-cfa2bbea922d", "value": "49152:pM/ApAt8SkzQ50PKMX0AgU5pFLQsTiNpN+XVo3hIw:YMXVl5pNlYpso3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701474632, "uuid": "9309ee57-fabf-4523-9138-cd797e12836e", "value": 1744384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701474632, "uuid": "7388ffb6-48a1-409a-90bb-fb225ccfd403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701474632, "uuid": "f01e2066-d85c-4466-985c-90f851c62756", "value": "0496f2e2d767e405b7637fa7efdbbfa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b54cdb-901a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701415594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415594, "uuid": "a3abc8c5-3d18-4aa7-9cc0-c20bb713a3dd", "comment": "Malware payload (AgentTesla)", "value": "d6393631100d7160ca348397cb01943d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415594, "uuid": "2b6f82ce-5e68-481a-9c28-ff50df7b5595", "comment": "Malware payload (AgentTesla)", "value": "eea977d6c736325a557a0c31552c49c51399748fc138db772735109fb6510757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415594, "uuid": "86d4366d-474d-4b91-9c7e-016b125e835c", "comment": "Malware payload (AgentTesla)", "value": "3ff0803ae9fd31efc74bcb29006c1cbf29b03f75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701415594, "uuid": "04964275-78a7-4517-bd6a-d766314c5987", "comment": "Malware payload (AgentTesla)", "value": "01118ecd823314f22c0fc4f03e146b2f7c400a81d7baa54afc350f061e9849b793dc0bd27b6788c7f19470f9e835f477", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415594, "uuid": "99c8a52b-3074-434d-844c-dc8b58543c47", "value": "T14745A403B646CDADD3D7A776C5EB0C305B7CE9816623D70F398A635A282BB779844603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415594, "uuid": "cc6f0a74-af21-4775-9530-95c80c25ba5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415594, "uuid": "e801bbb1-621a-45d1-9b46-04f5a86f0c0d", "value": "24576:X1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:AKfRdtsS0e4GIV3GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701415594, "uuid": "392b1575-3f8c-4b14-9666-39e61b71b1c9", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701415594, "uuid": "4b4f2707-981b-416e-9bf5-8391395430d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701415594, "uuid": "8cb65c8d-9d00-4b45-bf83-c6d3cac47f40", "value": "SecuriteInfo.com.Win32.PWSX-gen.2752.29887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476cef0e-8fe4-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1701392110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392110, "uuid": "7d4a980c-efac-4bba-94bf-dda3f6bb3076", "comment": "Malware payload (njrat)", "value": "123ef258fdaed181fa78d002b467d542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392110, "uuid": "f911f723-44e3-4b7b-a0d3-da6ac0b03bfe", "comment": "Malware payload (njrat)", "value": "ef328edd2d4d563795b868ef451eaa0727bc876990b50efc7129365f0459acd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392110, "uuid": "c01f4c68-c0d3-44e8-afb2-20785a859648", "comment": "Malware payload (njrat)", "value": "665fe2c0e02f831622479da806ad27672cd3ad27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701392110, "uuid": "feb63c96-fda8-460b-9832-2425e905fb18", "comment": "Malware payload (njrat)", "value": "5badde2a66efc85fae8047b02184e3aed60b155d220a0aaaae564f579b8e1f073566e845731c3f1bc60bbaa3fa8f35fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392110, "uuid": "57c9a176-e336-4f02-8413-f57a5eaf3967", "value": "T1A23612ECC21995D6E356A6B8493390F94C3AEF4BE54EB359C88276FE2C729F043500D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392110, "uuid": "0eb18677-51c7-477d-9c88-2a95dd10cd34", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392110, "uuid": "291932ca-c174-4617-a00a-017f17bb1c6c", "value": "98304:G6ejxyd7f7l5dV9mHl8PpR2HQVal+YBtoCgjaG41qYfyXbutpUwLUH:1ek1f7lvmmnJ1YBtzgjax1XfyCtpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701392110, "uuid": "bc06d1a7-f2bc-433b-aa58-5a113f27a8ed", "value": 5338112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701392110, "uuid": "cf8f5383-a3b2-4478-8bc3-274b27974896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701392110, "uuid": "aecc1bc6-bde8-4546-bd91-97be37b2d80a", "value": "123ef258fdaed181fa78d002b467d542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99a46de-9024-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701419843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419843, "uuid": "4a303d33-58ec-45f8-998f-aa0d7c9ee8e9", "comment": "Malware payload (AgentTesla)", "value": "4ae4d0fb0486b9bbb59dc708bf893f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419843, "uuid": "df58a259-2a5d-4413-9b83-dc146122be0f", "comment": "Malware payload (AgentTesla)", "value": "ef7927d67d1dac8ad59e4166fbbe9a61da10635247187714bdba605937106665", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419843, "uuid": "c4ada9ff-9fba-4774-a686-2781b77ebeb7", "comment": "Malware payload (AgentTesla)", "value": "ca944457aeacc99bfb61096444aad01bb5a927bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701419843, "uuid": "7395ff84-da70-47ae-a6d6-57e0a958a1b1", "comment": "Malware payload (AgentTesla)", "value": "584c03fdc5345871066054029c3547780d4d448a740b780e00d4d58de3ee5a29ec8d4d3416bc7246054ba18e58af219b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419843, "uuid": "6ccc0ff7-b01c-4f6b-bdf5-5c34d3aac123", "value": "T125C4D020E2F96B62C5FE93F1041466140FF77C9AA87DF32E4DD9A4DA2665F004A42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419843, "uuid": "318f8327-5a5c-43fb-a917-583498bee1e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419843, "uuid": "5127563b-2f71-4ae7-9c34-66dac004f73d", "value": "12288:MEdIqC+/AAB3BkX5CbbZQtZJlAGP94qEUDGloS:HD/r5BkXkbbZqlAojG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701419843, "uuid": "69e79537-5bf1-4afd-92b1-66cead1b7b65", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701419843, "uuid": "7ac87799-ad4d-4a2b-b39f-c71cb90b6e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701419843, "uuid": "ad897290-4338-470b-9b03-50e568466722", "value": "4ae4d0fb0486b9bbb59dc708bf893f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67312bb2-9000-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701404190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404190, "uuid": "15cc058b-a107-44c3-86c0-5e678ef3a59b", "comment": "Malware payload (AgentTesla)", "value": "55d2f33d2a5ead061c3a413cfc5f0e33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404190, "uuid": "75517087-8bc6-492c-878d-857579aad630", "comment": "Malware payload (AgentTesla)", "value": "efe39c5110b88d729074100bc89af380138174b641501f76eea1a8650ac88c8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404190, "uuid": "cd5623b5-8978-405b-8d77-2e6fc527ba4e", "comment": "Malware payload (AgentTesla)", "value": "b243632d63c020713b9fb52d27f938eb5cb95946", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701404190, "uuid": "1985a633-56be-45f3-a2c3-5ebb6c423901", "comment": "Malware payload (AgentTesla)", "value": "e5bd2897462908b5741c36a1a2a9b1a39f3520ec1b37a146882560ae320f52ec1c28684c1413806528423396be6a757f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404190, "uuid": "5f4f366b-a531-4417-bf80-fb94addc36c0", "value": "T1E0E4120233A59BA3D97B5BF714D4A0048373F41BA850F21C8EE505DE6B75B01EAA2ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404190, "uuid": "bc144428-f926-46df-a233-0fd67064668a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404190, "uuid": "5c00a0ff-6ab2-40bb-b39d-434ad4f277e5", "value": "12288:dCOFJxI0vCos9XWW5jeU99ZwStmILE+zx7YRg1F:pFJlvWXR5jeUZm+VJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701404190, "uuid": "bb06ebe9-9fb1-4afe-9dec-13091d71696d", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701404190, "uuid": "3cb6f5ed-cd8f-4e60-8c2e-813b48961cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701404190, "uuid": "3f9795e2-35b0-4a63-9857-ab68e66c9093", "value": "SecuriteInfo.com.Win32.PWSX-gen.24536.26483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7cfeb9-9074-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454126, "uuid": "0429eec0-3e7f-4b63-a592-df6fa66a316b", "comment": "Malware payload", "value": "a8145015691ccb73460a69fa0a8b0304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454126, "uuid": "78d3e918-1ace-4a7d-8837-727e2b88b07f", "comment": "Malware payload", "value": "eff416f17b83327e6911308b2b9678f52fb4b4d20b99a96f43c2478e5dcc10f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454126, "uuid": "233bfcf7-0bc8-4a20-9d80-e584c6e5e154", "comment": "Malware payload", "value": "d1f61cd7ccf682868720dacfc91f50ce4e70412b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454126, "uuid": "94718433-f211-4ff2-a207-92735ffede3a", "comment": "Malware payload", "value": "668ba29b7a2d523bf41d1cd10d15df7f7104fa9e0d7cfc497029e192f81d590d1962aa83b51accecc1dbe97e0ab2c111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454126, "uuid": "b3852795-d7a4-444d-808b-3a9a92f0bf2b", "value": "T133A46C0402655108CB2ED3B9D1535142B7B5BE22A622EBB67FFDF5E31EBB3D4660304A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454126, "uuid": "884341b2-9aa8-458a-8894-5a1f485c592d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454126, "uuid": "bfa97e87-3955-44bf-82df-a22c00f91065", "value": "6144:I1/tBaOZZfURQrLmwCn/2L04fiOFnZitWpqdc6WwjLC6a2HEZ+rG7tUW:mtbRURQ+wC+9KtWpqSNg+6RrqtUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454126, "uuid": "f50548a7-800a-4af9-8fb7-27d6f24509b1", "value": 467832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454126, "uuid": "936d546c-413d-4f2b-a2bf-6d9769416f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454126, "uuid": "6c8eeff0-6236-4c58-bb16-075aad70128c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccc5d16-9015-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1701413111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413111, "uuid": "ef2aae7e-bba0-4693-bebf-e040ad1edc5f", "comment": "Malware payload (Formbook)", "value": "cddba7874c56f368cb1c5bf7161fccb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413111, "uuid": "f25944c5-3f91-4eb0-800f-c621ae6d0147", "comment": "Malware payload (Formbook)", "value": "f00a9cbbed18444814a417b56253fee30616cbc4f93975441fcd8d1af028ef0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413111, "uuid": "a855c968-fb1d-4fe4-b6d6-baf2ab82e308", "comment": "Malware payload (Formbook)", "value": "437141c39d595a80f69fc09f720dc410d813ce8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701413111, "uuid": "e4acf29a-09b4-4c51-b9e2-2dcba01eb5c3", "comment": "Malware payload (Formbook)", "value": "953058cdca98d6da977a08a31703552d55c83af4c38e9a0d4e16238d0470e6676f14bfbd713087e7036f8767fb03247f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413111, "uuid": "72689a21-84fc-4545-8e0a-72b8729f1052", "value": "T11DE4CE92399975AFEC2F4A34035FEAB22A746CE0739249AE4F40760D4C3654780EDED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413111, "uuid": "e820f1dd-e003-4d00-bb23-4e4c1d171c8d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413111, "uuid": "0960b087-8c35-454a-a641-e0a9301ab6b1", "value": "12288:Mnhe2eaCnhTUqd6/+aTZlDcY7tXVn291YLWEWedWO0:Gheg6wBFZ2YJ52zYyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701413111, "uuid": "0ac82eb1-54dd-4b83-bba4-9716c86e1c8f", "value": 673584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701413111, "uuid": "e3a282a0-0b61-4981-b62d-a76821e9ed96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701413111, "uuid": "81c56f13-3cc8-4c7e-b499-fe8d13bcff57", "value": "Transferencia-16.280,00 EURpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599919d0-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454847, "uuid": "cd3e6f05-4cd7-4302-905a-2b40d1fbe84f", "comment": "Malware payload", "value": "76caf7dc0d435978aa05e03f16d1f900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454847, "uuid": "f76ecc3c-b616-4f2e-a370-dd71f0955d97", "comment": "Malware payload", "value": "f1eba51d52c5df2eda0dfb76bc753d3df253c2ce4df53789061f34105a2ef511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454847, "uuid": "00c8c9a2-9019-40c4-b755-c214b92e7624", "comment": "Malware payload", "value": "b850eac43edbf9989ff12b5d0c23317562b303ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454847, "uuid": "a56fab7e-f2cb-48a8-9257-929eb102f3a6", "comment": "Malware payload", "value": "95860ac5c4864fff73b5ebaadddd7840a3526e7e93c1a5b5a47f75a916c7e021bbd5c2bc075d6b9720033ffad9981774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454847, "uuid": "d02192bd-901c-4a3a-9bac-6a91d20a08a3", "value": "T197357C1731915033D6B239354A2B42ADC926FE261D38386A6BF99C483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454847, "uuid": "de5579f1-1ed8-448a-8b21-026dd0904aff", "value": "24576:j/iwHPZfyk/AHee56qvQW7hJB4mnkFVKgq7fkb4HJF:LiqZakUZ4uzBNOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454847, "uuid": "f2f3f369-e5d9-4f27-be3d-115aa272fcaf", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454847, "uuid": "0ad06626-52ba-449d-8be3-9a0e8131d13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454847, "uuid": "1871d6d7-2ce9-483f-9c9d-df1793a8384b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26217.29705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e08b783-8ff2-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701398108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701398108, "uuid": "b7cdf1e5-cd03-4a95-a2c1-af8faa675643", "comment": "Malware payload (Smoke Loader)", "value": "60447052a59cc70521340146cd7fa723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701398108, "uuid": "b74e55e3-ccb9-4632-b78c-7fbd543d24c2", "comment": "Malware payload (Smoke Loader)", "value": "f288a4bcb81b6eb549af0679d3cb173028e56bef9c71f17ed6f137aa3c076930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701398108, "uuid": "fbcda510-81e6-4892-93ae-00f211ee2121", "comment": "Malware payload (Smoke Loader)", "value": "1580c95b69102fd239c0ff73e474686df5ebe81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701398108, "uuid": "ce6d30fd-ea03-4a3e-b49a-b8c17ec5d5ea", "comment": "Malware payload (Smoke Loader)", "value": "edb6f69ec917ca6df919830d2c34354b9d424b5189714944213eb70fc27dc88e0f013482b0aaa20b3645cfe49fdc9be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701398108, "uuid": "62746d3f-dabc-408e-a6b4-25fb89edee62", "value": "T17A64C50392E17D46E9278B729F2FC6EC771DF6508F597BAA12289E2B04B01B6C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701398108, "uuid": "6c915410-d403-45fb-9415-5413448da4ea", "value": "0bd61e688135eda02fcf13008a67a440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701398108, "uuid": "b7490dc7-2b82-49af-b2ec-f7107aecd314", "value": "3072:bTQigqOzNveoefhSJ2kSh9SbwzNFxRl7aOdU43PnGBGbI5P4EMu63jXdo:YsOzvefhK2kjbwZz7Bfewy4ljX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701398108, "uuid": "08875812-67a3-4c2c-a45f-1e7f0f3488b4", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701398108, "uuid": "589f7256-a71c-4a15-a8ed-0a2501f4e682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701398108, "uuid": "6d592ab1-2e76-4a5a-9b9a-27af75c31497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31efbe3a-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442325, "uuid": "3d959ab6-0271-42fe-9042-3384b8d3fd55", "comment": "Malware payload", "value": "c93c6ea5b0b37597462d46ffec424e26", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442325, "uuid": "4c17a15e-c95b-439f-ae43-bde7e8b95f92", "comment": "Malware payload", "value": "f33faa17e05da27f074acec326dd3b4162ca83b2ad78fbdb313d68ceafcc8cd5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442325, "uuid": "4c28718a-c608-4bb2-9ff6-6a5f5e8ed32b", "comment": "Malware payload", "value": "464e92ae5ebb1d4ef0aa6340ff58459a9891951c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442325, "uuid": "bda6e9c0-b1ea-4fbc-a4ab-eb3427bab3f4", "comment": "Malware payload", "value": "ace3b92a1df084723f83f20c110464708f04ea7e97fcc2e5f64b3729ea48fd703b46022a6589390e991a50623f4ba44f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442325, "uuid": "2fdd837f-4925-4376-bbe7-eb499d8137b9", "value": "T14C560175731CF40BE073DE316371814F71E185E51A72E312AB07B8585DABDC4AAAEE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442325, "uuid": "2b4e76f1-2a79-4ce4-8eb9-484ada5d07fa", "value": "196608:/yDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYIh:mirUVis8O/0giAZ9PDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442325, "uuid": "19fd7b20-eb36-41d0-97f5-e345ba010035", "value": 6364090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442325, "uuid": "c258feb8-1550-45ff-8620-14092ba6d763", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442325, "uuid": "9d4751a6-d8a7-4d82-af81-4178074d83e9", "value": "StartFr\u0435e..apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a273cb9b-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435213, "uuid": "e3dce66d-c162-41fe-bbcc-65b81e03c4c1", "comment": "Malware payload", "value": "18dfc7691fa7a3b2c5d74594b33151fb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435213, "uuid": "cf40819c-dc9d-42f6-bf65-72fcad8db3b4", "comment": "Malware payload", "value": "f480bec46790084f76dd28efdd0021300b5a987b05bc25639174eb2ad09f655d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435213, "uuid": "efd92f1a-c2be-4f98-8617-a6afbf962198", "comment": "Malware payload", "value": "6f903889e8c2353c8155ef47d4397044d16169a9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435213, "uuid": "4a0aca18-7784-4255-9547-7c27cf6761b8", "comment": "Malware payload", "value": "b448a0fb5f2c937f2aa00c92e653234ad81a397622ab34f2bbef298a90602b6b0a47e440731efa6e656dd1393eaf33a5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435213, "uuid": "a5aa7800-4525-4d8e-9d99-c6693cea50d8", "value": "T121560179731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435213, "uuid": "e74d1ad0-c1e0-4d70-96e0-a81f693cf858", "value": "196608:/TDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJY1:firUVis8O/0giAZ9PDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435213, "uuid": "38d6a012-5990-4c17-b1fc-0478e71159f9", "value": 6368191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435213, "uuid": "7a71d105-4cdc-4fa1-a675-f3e371164bc3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435213, "uuid": "220af2d0-6dfd-405a-af05-8b3bce063171", "value": "Only TV - \u0412\u0438\u0434\u0435\u043e \u0437\u0432\u043e\u043d\u043a\u0438..apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c82232-9014-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701412623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412623, "uuid": "8599d9fc-3aa7-43df-987a-7530a53e068a", "comment": "Malware payload", "value": "ac6ad9592ffc35e5b413021d340a5f72", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412623, "uuid": "5c9d9aea-c735-440a-b6b6-f704b62bce30", "comment": "Malware payload", "value": "f4a89161403e700a0006f1c71ee0cf34a4a98285fcb73f211a6eb84992bcca62", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412623, "uuid": "ec1cd202-76e4-4f1a-af19-e9244bab25e9", "comment": "Malware payload", "value": "3c337a8a227c059a2cc697329ed520d6210fcf17", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412623, "uuid": "2725f015-8108-454f-85e3-4adc30d9cbdd", "comment": "Malware payload", "value": "e9c0c4e5e1cdb06e51f5171d89b9732f62ac0050415507d632faa77be37df4268ed64eeb30d9ada01071902b13903569", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412623, "uuid": "bd2c87f6-b887-476a-813c-06139ec51a71", "value": "T1C4D423BC30A633F49981AE75F7BBE955931C79C1F651E09AC72CFFAE1E2C8881564210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412623, "uuid": "13f9f33d-4b25-409c-a4c2-7848cdef51a6", "value": "12288:bpFdMEhO0SeQAS9egI9RwKxipbLxZqVW3bEnNennQZTPYyUSG3bR6Ent:bpFdMiOW7CegIwpbLxZqV2EnOnQZgSOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412623, "uuid": "c06dd8b5-ddbf-4f68-95eb-26cb7362f612", "value": 610956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412623, "uuid": "c30a4318-b224-4aae-ab90-63b71a5730a2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412623, "uuid": "a2456f39-91c5-45a8-89a2-78231c7aa5e8", "value": "##Nuevo orden.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5deededa-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454855, "uuid": "65c81b1f-ec90-4fa4-a4f4-9a230f89e14a", "comment": "Malware payload", "value": "467d74b0aef5211b917ddf4fe7fc3fb3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454855, "uuid": "5c4c7f7e-5d6a-48bc-baef-d763b7cf8d9d", "comment": "Malware payload", "value": "f4cdf1751ba881d6d716d8ff6d0c3d141c21e147a743e82fbcdcf22e0fc3c6e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454855, "uuid": "2f68799c-64c3-4f10-96c2-23dfa8f0695d", "comment": "Malware payload", "value": "395739fbff259225286583d83898fcb811c43ebc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454855, "uuid": "1b845441-667e-4924-adfe-4c7981a4cab7", "comment": "Malware payload", "value": "291058efbb8484c22ea0a2778dda4faec7bc89863e09ebbd17d1bad086de1ee8cc0deaec26d978e2ba16f494f583b12b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454855, "uuid": "859960dc-54fa-4134-b860-5daddc1c670f", "value": "T1F955CF25F3D6CB2BF02B9D70497A5B6AE522FC615F028113376A378E4D37BA8D4C405A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454855, "uuid": "0bc9b87d-6a8d-4667-be73-889bf98d8c9e", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454855, "uuid": "d1360ec2-c62d-4e55-8c9f-36df5fd4e715", "value": "24576:KAFf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY6:9J+s8KuqGaX0ToIBAUZLY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454855, "uuid": "43949f3e-9fec-4fb6-912a-7cf6986fe8d7", "value": 1297184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454855, "uuid": "a14b3c65-e206-4218-9b68-f5f7c382f714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454855, "uuid": "21d256ee-5dde-48f1-87a8-6fd12dfa3142", "value": "SecuriteInfo.com.not-a-virus.RiskTool.Win32.IMEStartup.32623.28773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c89f82-9038-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1701428127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428127, "uuid": "70ca29ab-44a1-439d-be13-dbd2f51d3985", "comment": "Malware payload (Stealc)", "value": "54949edc577362922381b3fb3dda9cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428127, "uuid": "89aa63d4-8506-4e9b-8a58-65419181526b", "comment": "Malware payload (Stealc)", "value": "f648067f341eeea223fd16bb53637c6fa7ab42a808d3df6886e296b19825d66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428127, "uuid": "772cb4ee-4f0c-4569-93cb-ed579c18d670", "comment": "Malware payload (Stealc)", "value": "fab179e4be375e9ce3d068389ca6b3a0a75d2625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701428127, "uuid": "12857d5e-765f-4926-aa05-4e0aaacfb443", "comment": "Malware payload (Stealc)", "value": "7ab5e873925f1be9a6285319d49610d0f0e05ec8837f359430084157ead834e4df9b0e8466e2a7ab5426930381e86bb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428127, "uuid": "f5f171b7-fccf-49f6-baf4-f0aa5952aa3d", "value": "T18E34BF2176E1C432D2275A350971C6651B2BFCA2AB6146CB27903F3E5EB23D1CBB9707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428127, "uuid": "c5039d87-11e0-4b2d-a1b1-ad9147e3b23e", "value": "e8e51dea98dc7701b104446165cbe5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428127, "uuid": "1b9a5976-62f4-43f4-b483-c0fe2a00bf40", "value": "3072:Y07lSWqaRqhGO0UmMgBttoIDAtN7oxUyQ5jzV8/Y4RKh7L0LC9LrLZZEMw8OwCYc:ldkh5mRft9DAtNUvQ5jzOxRnC97ZXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701428127, "uuid": "f2c0e004-b656-40f2-92ad-20f367657856", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701428127, "uuid": "1d7ffc5a-0da0-4ed5-8cda-82143a55aa5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701428127, "uuid": "27f34d4a-0f56-4625-bdd9-4ceaaed34780", "value": "54949edc577362922381b3fb3dda9cff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f408bc1-9053-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701439798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439798, "uuid": "ab7e6141-d813-4927-8d51-79d668c2fc34", "comment": "Malware payload", "value": "633d241a171897adbdc737400fb090d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439798, "uuid": "ed278866-2f43-4f45-94cc-cb907f815fec", "comment": "Malware payload", "value": "f71db7e25e720622d7c160761f5c50f72a0c57cd2e87646318df24b368ac1612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439798, "uuid": "3b52eb25-6fcc-425d-89ca-c5d043e0341b", "comment": "Malware payload", "value": "5a25449709869ef3de55c7a68aed4a23cdf7b01c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439798, "uuid": "1d71ff12-eac0-4c6f-9dfd-1819ce9da219", "comment": "Malware payload", "value": "70ec14899bf5348648a19cf3b25d7291825e33a2f3291220cee741bcc4d126308ba18b5a50f8862c7d40ca58c3dd52b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439798, "uuid": "4ab7b9ed-aaed-4876-b494-946ce6a9ae12", "value": "T18217BE73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439798, "uuid": "8315d5ca-7cbe-4182-9b11-d4ed0dfbda34", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna6:sXyWSpV+Wu7rI3JEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439798, "uuid": "89059db6-4bec-4555-ae4d-01d789a6a7f4", "value": 19267584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439798, "uuid": "ba75c096-6860-4a8e-8a0a-3340591f5b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439798, "uuid": "ea27b8e2-80b9-4eed-836b-d8f784d894e6", "value": "f71db7e25e720622d7c160761f5c50f72a0c57cd2e87646318df24b368ac1612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed86f36-9008-11ee-8907-42010a9c0042", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1701407773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407773, "uuid": "3314e19b-c5c7-413e-8610-56ff853ba80f", "comment": "Malware payload (Socks5Systemz)", "value": "ae9bcf9c7d77bd3e77ff0887c799d320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407773, "uuid": "356a4365-6169-4e4d-87a7-51121b1f7cf5", "comment": "Malware payload (Socks5Systemz)", "value": "f7583eda61dc4afa0b4e5cee93e7a55f27df3a8de3cb5236cc5c649e982aeeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407773, "uuid": "e9afd2fc-5a6e-4db7-904c-03f3205de6b1", "comment": "Malware payload (Socks5Systemz)", "value": "e098830de01981d75305627d5e5025d93c2fda5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701407773, "uuid": "be699fc8-bf1f-4407-9a99-5ab8fe2a18f4", "comment": "Malware payload (Socks5Systemz)", "value": "1648d8c37d77e02bee2b5a4bb7a88c199d66cd9dd3e71c3ae7f23a89573cc5c82a0c0bcddd7ab3ed67f1c4b947678c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407773, "uuid": "a0955acf-dd4e-4f8b-99d7-5b9ffc0cca9c", "value": "T1B0E533414A5BC4B0F671EA750FE3DA80825BB9A334311DD991DE4F5F6B2D382B82B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407773, "uuid": "fa6d24ef-cd6a-40fc-b1e6-b7e2cc3c3312", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407773, "uuid": "3065baef-c6d1-46a3-b76a-5b0a3319f821", "value": "49152:k22LK66sfh2ceGIkPOdSQcjWuYvaXqAv48k5NitFUKa37NxMzr02E/sI:p2g+qkmRcjWGXqAv4DNiDkAzr05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701407773, "uuid": "abf02a13-2f12-4c77-a357-4c6d5b0bbd0c", "value": 3217801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701407773, "uuid": "69e82057-82ad-4df1-a00e-2e07f71efcbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701407773, "uuid": "ea672455-2941-4002-9026-6d2df21affd2", "value": "SecuriteInfo.com.Trojan.Siggen22.21079.16908.16861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811efe3c-9053-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701439881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439881, "uuid": "f26d0b5a-d4bd-4b65-90c3-2512a7e109c4", "comment": "Malware payload", "value": "033d219e580e1bbc300bc06194db2cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439881, "uuid": "d9b2fa40-abc7-45bc-8520-b35fecdaf411", "comment": "Malware payload", "value": "f783a5d7bd7825854b33f231a70a803a59d29b27c0995ec8cee20cad7438a6af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439881, "uuid": "3b3bf5a8-d53a-4df8-9a3f-28b696a82c1e", "comment": "Malware payload", "value": "77d8d6b34fb477e43e7f4a29f4fb0cbe633cea9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439881, "uuid": "89199cbc-4de7-42ee-86f0-bf2f7f86f0bd", "comment": "Malware payload", "value": "eeef74fe223b943d2c87eacaa880c758632f463fb3d9f1eb475f12ad5c087de669e65298fcb160857ed1c5e6d8c8a96c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439881, "uuid": "d4d1a04f-bcd7-482a-bc89-a6ff99b75e0d", "value": "T1E937CF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439881, "uuid": "418c1e29-8408-45c2-94ce-bbff9e470258", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439881, "uuid": "b7ee9345-c79e-4742-91df-7ea7eb9118d4", "value": 23068672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439881, "uuid": "48a5acc6-2f22-46c8-8310-7d3f264437da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439881, "uuid": "36877c89-85e3-4fac-8bf8-0397131fe113", "value": "f783a5d7bd7825854b33f231a70a803a59d29b27c0995ec8cee20cad7438a6af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4244be62-9011-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1701411429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411429, "uuid": "b9997389-e03d-4dea-809c-110cff449fdb", "comment": "Malware payload (zgRAT)", "value": "a24875d9da9e87370ab3fd2b5b16c8db", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411429, "uuid": "75d28a02-2ea1-4a8d-805c-5975e55ff93c", "comment": "Malware payload (zgRAT)", "value": "f7aaa33843aaca2505b51dc4527be10bb9c3635394e5cfae9ad0910602cfbdc2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411429, "uuid": "7d041001-ea05-40b8-b4a3-f2012e5c73ef", "comment": "Malware payload (zgRAT)", "value": "05db674b84ac86b59f58a39a5557f44b6e0fc84e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701411429, "uuid": "ab4691b6-aaac-4f76-bbc3-9ff19894ea15", "comment": "Malware payload (zgRAT)", "value": "0f1c040afeb56f858052bcf4e21cc340fe4b7b01ff5355036bfba25af8f730fe43786cac78718ece6379fd4c1bdc0cef", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411429, "uuid": "a794ef31-e9ab-4ce4-8507-a0c79a9d91a1", "value": "T19725230E27DE4239D7BC673EA6F5694481F28267060FF3AD720C85ADAC76BF75212241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411429, "uuid": "25d16b64-fbd7-4099-9052-acea5516288a", "value": "24576:c+/FE45StEDfjTITgAPDAF1KtyKz/ZBmgP7R3Dnk+f3jtB:FE45cEjIMAbAety0fmgPxDku3pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701411429, "uuid": "8a41fc1c-57a2-4c62-88cf-7a71b5f66227", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701411429, "uuid": "1707940b-c778-4dff-a2ee-860017f94da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701411429, "uuid": "53cad3b2-8fcf-4ad5-8da6-b25cc9dfb71c", "value": "a24875d9da9e87370ab3fd2b5b16c8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b221f979-9012-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1701412046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412046, "uuid": "3e970c59-d05e-4a6c-bc46-a2f078c19d50", "comment": "Malware payload (RemcosRAT)", "value": "f91fad767cd2b51bf82e41ea006d636f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412046, "uuid": "b3430dd9-a0d2-4d92-8807-91dbb265af4a", "comment": "Malware payload (RemcosRAT)", "value": "f7b30dc1f94300574b8732927571cb9c63c8e986849f4079a8ceda881acf8c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412046, "uuid": "38470aaa-deb7-4641-ba35-8647cdeaa8da", "comment": "Malware payload (RemcosRAT)", "value": "2a28d1d079265bc5f3b7bf760b2c013c068880fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701412046, "uuid": "9a064eff-9862-4493-91df-5a3f361ac31f", "comment": "Malware payload (RemcosRAT)", "value": "1c28c43bf6082bfbaa7960d1264674691a504dda956d56ccccce2f448e5f37db253395872452c85eb3dad3b23994e74b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412046, "uuid": "a700356f-0b58-4e0d-bf11-b4b81054fc70", "value": "T196152220239AD766D63B5FFB9880904053B2E913B415F34C9ED350DEABB0790D662EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412046, "uuid": "ca68645d-d4a8-4e49-a7f1-edfdcab92b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412046, "uuid": "26e1d721-dbf3-4f35-b609-9fd80837e8c2", "value": "24576:/sJpy9ZFI4XBIKYk8AVia/UonE1K8sEYNs:/sJo9ZRXBsk8p3GeK8sLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701412046, "uuid": "d131e435-39b8-4bf7-bd84-ed8e6dd59c93", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701412046, "uuid": "d4c0a061-dea5-4032-85c3-c582101b81ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701412046, "uuid": "e8c81fc3-00cd-42eb-8338-420c65481bbe", "value": "SecuriteInfo.com.Win32.PWSX-gen.29177.21879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ef73b2-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454873, "uuid": "01a3d5c2-0a65-4992-8bf3-8e0aae9d60ff", "comment": "Malware payload", "value": "c7615d415ae90601410a882930525148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454873, "uuid": "bcb1363c-8169-4501-ab14-ea4d73037cb8", "comment": "Malware payload", "value": "f7f0b9dbadbf32973112392cabae1756c613d00d2afc196fceea8d9004a01a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454873, "uuid": "af7488f1-1b18-4021-b74d-8ea8ee26de82", "comment": "Malware payload", "value": "9ba72e2ed2e114a8d49b54b99e64d9f56b6db19a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454873, "uuid": "d2b350b3-ffec-4e27-a10e-1e02930f747f", "comment": "Malware payload", "value": "0e1a0fc8a043843eaad1efff71fc7a2551d71e158238bd78c08cdd9fc75fdefb704e66031a3d90c364006444285d88a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454873, "uuid": "4a27c513-ea91-4ebe-a633-baa97350c50d", "value": "T11AE4EFF1F9014BF9DC23E471F07AC964A7AB7D2EA594A54522E2F64A4FE302B443B407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454873, "uuid": "470ff603-9213-4e66-aae4-6353f5113813", "value": "70fdb1cc5a7f08af3dc8a9d56cb41801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454873, "uuid": "e3797764-8f83-41c8-94bc-cd44ef6d4c46", "value": "12288:AOtNrR+gOdfh+ouQ9JIX7X5hn9FNDE6iYGQSy2WSMLFy5:A0NrR+/U9Q7IX7XTrN3veTWxLF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454873, "uuid": "20f7ec24-05bf-4a7e-ace1-f7d364f6f3bb", "value": 716771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454873, "uuid": "1401d576-8489-4875-bc81-856eddaa8b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454873, "uuid": "0d91c5c4-36ab-42be-81eb-0f904147f45c", "value": "SecuriteInfo.com.Trojan.Siggen1.42086.18549.5643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0980932c-8ffe-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1701403173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403173, "uuid": "29729abd-a9e2-4b80-b52b-856f1748c953", "comment": "Malware payload (AsyncRAT)", "value": "ecca54061a0ecf25ce57770baa92bc1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403173, "uuid": "955667d9-d213-4d0d-ba1a-0520dc79035a", "comment": "Malware payload (AsyncRAT)", "value": "f7f5e52a83cf839d901b6579c9df98755953dae650a43ed9aff8a57cf3b41382", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403173, "uuid": "d84309e5-0c75-4747-8d24-d06a990a538d", "comment": "Malware payload (AsyncRAT)", "value": "770b2cf2a37858d869a5e4afee8d97b9592ba5ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701403173, "uuid": "8f902625-8262-4f01-80d3-b957b7286ea8", "comment": "Malware payload (AsyncRAT)", "value": "e1ef8b6141c52d5b2771a81d539bb65a92b6930e09911be12abce8be8451510928860bb98637c10e6c638346ca7c2077", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403173, "uuid": "3e9e6f09-7ea2-4899-8395-794fdd5e6239", "value": "T1CA65AEE7ABD84E0BCE8D16B7A0218B0D47B6CD47A3CBFB867845E6711CE23525989113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403173, "uuid": "aad742bc-8e10-4bce-8a6f-636f758675fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403173, "uuid": "e202f944-0567-4a33-89ae-4dae154abaa7", "value": "24576:JT+uVDs/OidipoctaUF8VcN0Fk1MeVrItlNx4df0sS2mjxpf9vQ3x9CmK0G/m5tX:Ju+aUF8VcN0Fk1MeVM4R2lQbCmKZ/WtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701403173, "uuid": "af547909-6009-4009-8b85-98f3400f08a5", "value": 1423872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701403173, "uuid": "b4fdd307-425c-4dd9-afc7-347814dcbd11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701403173, "uuid": "c14674d7-f082-4de9-8b20-9b5e22865d73", "value": "ecca54061a0ecf25ce57770baa92bc1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6200aa-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442316, "uuid": "ea3f854a-32c1-40a2-a707-e65580c11a36", "comment": "Malware payload", "value": "211489311c4c72da12c78806e8490bbe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442316, "uuid": "67e12043-fa0a-43dd-a8a9-f02e362de40d", "comment": "Malware payload", "value": "f8cda74a8facb2414608dd285a6c06cfe3929b78b5eb86de2d826fbef332300b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442316, "uuid": "a4dda029-c7be-491f-a790-9a98e85c6436", "comment": "Malware payload", "value": "ac5171d4cd08ffff79ae32ec8fcc9ff23b2dcd9f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442316, "uuid": "3f912fab-9405-4868-80f8-245c4b892c52", "comment": "Malware payload", "value": "f312bcecf7ccb5216e7f26d89da085d79cf59ffa5bbbc3b4f209474cf6e18da620909c7451f0fa58064f3f2d4bc8fcdc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442316, "uuid": "13d1155f-3963-40d4-b78a-534d2a599ade", "value": "T1E3560179731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442316, "uuid": "0c8e4b67-81ed-444a-a19a-81c5ea49c09d", "value": "196608:/9DGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYy:1irUVis8O/0giAZ9PDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442316, "uuid": "ed7ca751-56af-4e2c-b544-b0860925d501", "value": 6376378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442316, "uuid": "f5f697d7-316e-4141-95c0-ba9a1edfe28c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442316, "uuid": "97df6b47-fca9-4952-8728-87f1f546c2dd", "value": "Wildberries Pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b35c8e-908e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1701465248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465248, "uuid": "f05c191d-9e78-4f02-bbf5-d35210ab607e", "comment": "Malware payload (Smoke Loader)", "value": "7e3246dcb9d64a41cbcb1eb300baa32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465248, "uuid": "ea3dc38c-17a2-4cf6-86d9-ae202f3d84b7", "comment": "Malware payload (Smoke Loader)", "value": "f9f907751c49dea798b2da38071a47ea63a4c929ca776bf3b1a4b9817ae13f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465248, "uuid": "d9035889-ef32-40f2-9beb-7557d33ea2e1", "comment": "Malware payload (Smoke Loader)", "value": "508afe1eb935e3c269648bbce1a33053bcf5b959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701465248, "uuid": "aa90fe8d-1470-45af-9696-4222e7236632", "comment": "Malware payload (Smoke Loader)", "value": "31cae3a997cc447c9b2babb323cf3b787fda4f29e015fd7ae0674b4abac14791f4e7c7bbc5e4cc9ecef6c6978470272e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465248, "uuid": "accfdb69-915d-4ef9-b89a-bfbb23c2da80", "value": "T1D1642A1352A57C50E9264B328E1FC6E8761EFB518F7D37AA1218AF2F45732B2C162F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465248, "uuid": "5f95cf9a-f19e-4c51-a1bd-3b966c3aab0b", "value": "8aa6592c860ca75b6935350915f6cb30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465248, "uuid": "d96d4ce6-999c-41a2-b43f-9f7186f9c41a", "value": "6144:7lETXShoFOfq328Q/laLci1LZRxABf2p69a:7MfOfq32ztA/1yB+II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701465248, "uuid": "10072671-fe0f-476e-b9ea-9ba48a481c7b", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701465248, "uuid": "d1322638-2816-4ffb-a8a5-ffd9ce9f1384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701465248, "uuid": "dbd5f3c2-4ff3-4eab-bda7-712734a5f0f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1d2355-9053-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701439851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439851, "uuid": "ae2e1620-6d1b-4b79-967b-fbeea883c239", "comment": "Malware payload (AgentTesla)", "value": "cfba352b6f12bfadbca73ca3a541717b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439851, "uuid": "b08f8131-7f86-4013-bd9c-9cc92bbaeb42", "comment": "Malware payload (AgentTesla)", "value": "fb0514347c4e3087847d4457e4dad6e14bb018ab1881bf7d64ea3bebdc308391", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439851, "uuid": "6f6a2e52-c4e8-4e03-a777-2d71de2be4de", "comment": "Malware payload (AgentTesla)", "value": "2d58416e94cdb543c5ed9c2703ce139ea29936cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439851, "uuid": "f5216613-84be-4980-b400-2c5b21794c0a", "comment": "Malware payload (AgentTesla)", "value": "57955977e4e2740106dfeaf737e8ba3e6af0423fb79d71229ce0e1c695fe5698ee9274898b1c3e880185eeab348bdcde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439851, "uuid": "51fcc4ac-187d-4325-bff8-1e2308a44144", "value": "T125F4E124E1FD5F66D6FE93F1111066100BF678AAB53AF32D0EC9A0DA26B5F005942F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439851, "uuid": "cd542473-886b-467f-8c78-ead12d11648e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439851, "uuid": "742b46cd-8a25-4852-90fd-8262a64dd500", "value": "12288:VdIX2lk31cLDB+p6ZtULyQLU1mOlEzODK2w3l/EMMbBq:V3lk32nw6myQ6wzOtGVEVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439851, "uuid": "4753b3ff-7c49-4448-bac3-35f7ca7614c3", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439851, "uuid": "28f027bc-5970-4a82-9bb2-9a40cb8e2337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439851, "uuid": "f5330821-901f-4f39-8e44-2376df188223", "value": "1MARI SH.P.K EUR64.5210 2023121012023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa3b128-9048-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701435208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435208, "uuid": "c9cf9ed1-185d-4d07-9837-3524f95a96d3", "comment": "Malware payload", "value": "7b563d9f6f5b9c2bfd8e678a56faeffa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435208, "uuid": "f75502a9-2890-47fb-8cfd-8d17b52d7042", "comment": "Malware payload", "value": "fb055fa031fb8a7b7ec6f028efc9710d665ece130ef655b646382e907eeadc22", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435208, "uuid": "fdeb9d61-bcb3-4bf3-b7e2-749d4887402f", "comment": "Malware payload", "value": "d94df3aad964975e135769ee6b422f30c2eb79e5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701435208, "uuid": "9ba0690d-02fd-4c6d-9552-2cf231112856", "comment": "Malware payload", "value": "160b4712654ec2b746a0b3ad7e7c3da4204832cfb8ae602d81c62fbc73388b787c0a1cd6a845da129ffd69b3fc254c4e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435208, "uuid": "424e249d-64e1-4c17-8f8b-22849a445dae", "value": "T15C560175731CF40BE073DE316371814F71E085E51A72E312AB07B8585DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435208, "uuid": "a33b5fc4-86b4-453a-a21d-b58810efdf67", "value": "196608:/cDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYp:EirUVis8O/0giAZ9PDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701435208, "uuid": "f0fc7255-e9e2-4d27-bbf5-91982f68f49d", "value": 6372285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701435208, "uuid": "1a99db0f-9cf2-4b18-bc9f-85f275cb02a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701435208, "uuid": "a2fc2d84-e51c-43cb-91eb-50e6e5c199f4", "value": "\u041a\u0438\u043d\u043e\u041f\u043b\u044e\u0441 pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0923f219-9053-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1701439680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439680, "uuid": "7deb2918-f887-424b-8efb-fbd5ca0cfc03", "comment": "Malware payload (AgentTesla)", "value": "61c60fb261c9b694821c16cd6e6a1285", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439680, "uuid": "d3214dc3-65b7-4976-976d-f0eb06f84714", "comment": "Malware payload (AgentTesla)", "value": "fd587ce57f6dd70465fd3d9e6115cfb866baae9ed94993d17191a50f76570eb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439680, "uuid": "476797af-310d-40cb-ab80-d6008ef1964e", "comment": "Malware payload (AgentTesla)", "value": "fd5d9f2c7e3e663910412ee9b84f88365ca4ff17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701439680, "uuid": "a382e4fe-5922-4289-917e-0bb9c6e628f6", "comment": "Malware payload (AgentTesla)", "value": "a979bca587727fa4764251ba9b8fe7046f4b7cd1ae4aa81bcc1711d78dd1a7b253a9ae1a131b3bda12c5afbeb69a69c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439680, "uuid": "b722abd1-f1cc-46df-a133-bac6584736c5", "value": "T130E412912B094392CCBE9BF76494181893B3BC17A8B0F25C4ED230EF577279195E2E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439680, "uuid": "fc5e74b2-6a74-4840-9b54-d8bb41c66d6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439680, "uuid": "55cdac5c-a1fa-472b-823a-3d085529276a", "value": "12288:MC5gJzIbIxH6r2VXZfSXsRti+ooRQu3RTKbZRxWGbKIiZcbgJ3jQGOfpDDgcA:PgJiIr3SerQ2TMF5bPscbgJT5YpDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701439680, "uuid": "eeac8f9b-b7cf-4f77-a88a-fae6e154e79a", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701439680, "uuid": "deca0405-2760-4fe8-b754-b953b75035aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701439680, "uuid": "2e6791f4-8751-41d0-903a-6fbda459932c", "value": "Jooikb3Gb3fksCH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645fb431-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454865, "uuid": "57dac0c2-fc6f-4f35-b810-0fd770d0be1f", "comment": "Malware payload", "value": "03b04f5849554617fdb3801464a7c29a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454865, "uuid": "9f2b4f9c-d464-4d43-a076-b7b3408c1f76", "comment": "Malware payload", "value": "fd8878371f93b8f936c30254a449648d8fa758acdab886d432d9ad2b5e104498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454865, "uuid": "365811e9-5916-4dc2-b94d-d474838cbedc", "comment": "Malware payload", "value": "b82cfaa741d22830552f00f218af86677c5b2d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454865, "uuid": "2bfbf4ac-2ae3-43b2-bdf2-b7e6fcf1e5aa", "comment": "Malware payload", "value": "9614f44310643156b113fc71fd1f3661073eaedb0a12ed0689b29fef92bfbca02e7f322fa0a7b2a3be210e182f0f7338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454865, "uuid": "a62dd999-2b0e-4b3a-9f74-be3bdf640ccc", "value": "T1F4357C0732915033E6B279364A1B429DC926FE261D78345A6BF9AC483D35643FA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454865, "uuid": "babf339a-0437-43e0-934f-86a4015e8197", "value": "12288:fGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3v:fKvzcrnyaLO+3Yb/wQeAh/7Ri13K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454865, "uuid": "03aa8dfb-5ad6-41b8-9945-34b82b61b6a3", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454865, "uuid": "c1e51283-e956-4166-b57a-cb2cd06e0929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454865, "uuid": "258d4fa1-01f4-49aa-bbc9-de9647c1c258", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9795.11942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d981ca-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454861, "uuid": "566d10c6-7786-4ff8-aa86-5f270cd0cd06", "comment": "Malware payload", "value": "12e32d5decbe4d5fc2d91d4335064dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454861, "uuid": "be5b9434-2689-4627-849a-1d306d200274", "comment": "Malware payload", "value": "fdec074f50760b34b81601b57b45cd262ed7a857ebcac77bb9b11e77bd14ba16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454861, "uuid": "d6709bb8-beef-4133-a0a0-f92504fa35f9", "comment": "Malware payload", "value": "f4911be2eb9cf98742426899aad4d0939a01a731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454861, "uuid": "50f56a6a-3323-4ba2-bf5b-d10a0126cc1c", "comment": "Malware payload", "value": "ebd2e1cd92cf673f77b9d52c16ad3456713ed72f702cd22f726d55733307020c459799efeb4b60eceb8803d044565cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454861, "uuid": "efdebf1c-e2fc-491a-ab06-d5471ae89a03", "value": "T165B5F191E5883377D2752D710827114CDB2E2FE228BCE56F07A7B64D3A722E7B832465", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454861, "uuid": "31ac0e67-840c-4d87-80ba-a5784ed85e75", "value": "fc359443b4b20a243becdef32149face", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454861, "uuid": "7bc31497-f99a-46f6-9256-6dfd42577a2e", "value": "49152:mLqcfw5mptswhpYsSP1jSdMML8IgBLFu63QOME9:ALfw5mpPYsSP1jSdMML8Ig5dQC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454861, "uuid": "e8683f86-0997-42f6-8780-6317e5890fb7", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454861, "uuid": "be5c2aa2-c313-4b63-a65b-e4826e07e7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454861, "uuid": "97c7c8df-76f3-4ee7-aba3-f01821555e7d", "value": "SecuriteInfo.com.FileRepMalware.14325.6058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dad917-9076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701454821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454821, "uuid": "6db40d2c-e640-4a16-a3ba-0f27b86c099f", "comment": "Malware payload", "value": "744acfe80ace7787da325bd11914d3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454821, "uuid": "049c86f8-8285-494d-ad8d-3c9a8d9d06cd", "comment": "Malware payload", "value": "fe6b490973a5ab2b4a0582e31121f41a4bdde75c8d8298f4cd41427e7c760ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454821, "uuid": "080e696c-f605-49ba-9381-e702c2d839ba", "comment": "Malware payload", "value": "c58fec4aea34d2cf80f333978f065e3df39a7748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701454821, "uuid": "589a0b95-ae82-4e67-a47d-2e84c6226a04", "comment": "Malware payload", "value": "b6aca506ffb4e40fbdff226ee48e90a2931bf52e954fafaad12a675ddc7f2c596c3608941b4b88e05931fefc6e2904c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454821, "uuid": "4472afdf-a98b-4677-b942-af05d75b697a", "value": "T1D99533036D7E35E9CAF85D356559321A1EF4DCC84A36DE14628CFE4EED36A36201B2B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454821, "uuid": "1b93313e-bd08-42fd-9cf6-58ddb4a4656d", "value": "0418d612e2b82f182a57fc9cb243ee5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454821, "uuid": "9bd8cbf5-f85a-44cf-9935-a014a71e74d9", "value": "49152:YGhUlb03k4SNASQbpu9IoxCb8YnySMzwB+SUuNh46j:HU5s+AR07u8Yny/wgWh46j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701454821, "uuid": "3accd682-1711-4ed1-a473-9ff239a5f49e", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701454821, "uuid": "656205f1-bb30-4df6-80ad-1c924c1acedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701454821, "uuid": "98b34955-20cf-4c54-88b9-d2796e8b6057", "value": "SecuriteInfo.com.Win32.Evo-gen.4040.13771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1893aa7-905f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701445143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445143, "uuid": "4aaa0094-d322-4884-b745-989de5977535", "comment": "Malware payload", "value": "87e782c7ef3f46a86d7df12b399d6fcb", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445143, "uuid": "2ad62b85-58e5-465e-ad9e-559527083eca", "comment": "Malware payload", "value": "fe9be947238b7d3c842a9890df865ea732a9e75bd0f5f33bfeb9878d52f40720", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445143, "uuid": "68c7e375-a643-473f-8a80-228dd5e059b2", "comment": "Malware payload", "value": "0690d591289c6b8852af022969184385b100d245", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701445143, "uuid": "d07f0b0c-8749-4b58-9521-b3e23416e934", "comment": "Malware payload", "value": "fc304b8c4f7166bd93e22e6dff7520b35367f59e49eb0731d3ace41db0007f7b841ce1242bbd06e6bcabdcca611b3a0a", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445143, "uuid": "2a3f6325-ca98-4b5d-ac08-114dfb64ab62", "value": "T13013980A6AE04932DCBA9ABE677763F007EC6F92685DE5551390333AA63C1D67C01F34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445143, "uuid": "21a4463d-9323-451c-890f-25d6d704863c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445143, "uuid": "1e169beb-ffc5-4f3f-a288-cc389fb6ee42", "value": "96:UFZm8MrZxiMBSndI4H5kdc6PkBNNlRGGadekHytUZfLJh6OZZR/YmWZrzNt:UeR1bBcI/G7qfLJh6OZ4mWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701445143, "uuid": "a368d594-9fe6-45f2-8cbc-a83acfa94bb6", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701445143, "uuid": "29184c6a-020f-4ac0-8d13-e6a59538f3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701445143, "uuid": "832dd14c-a600-4503-bf76-b4931accd72e", "value": "Stealer Resou_nls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab6b961-9059-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1701442340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442340, "uuid": "8a762925-d769-4c39-b921-4739db057f2b", "comment": "Malware payload", "value": "b872530e8bc83c0f3f1e0cd5e4a4be71", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442340, "uuid": "b557e747-7cd2-4022-9674-ae117ac3c57c", "comment": "Malware payload", "value": "fea65aeb5719a5f48b94e6159482a4cb28a0f9d918bc074b378bfafd67bfb655", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442340, "uuid": "ae615180-28bf-456c-a33b-8ede3db3de09", "comment": "Malware payload", "value": "70e55b0c1ce3e7b546d4bb63c1e989a30e1cefe6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701442340, "uuid": "455f8dbf-a225-40a0-9a52-1818dad704a0", "comment": "Malware payload", "value": "e4c78ff47953b411c73bfced43631e06f9a59e338f24888c7b4c00dba4548d61f5c7903f13290cd559c436ecbfd024ea", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "smsagent", "colour": "#B59784", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442340, "uuid": "f7043b8f-6763-4db3-9f1f-ad0e2b1a3f10", "value": "T19F560175731CF40BE073DE316371814F71E185E51A72E312AB07B8185DABDC4AAAEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442340, "uuid": "3890cdca-2b80-442d-9024-407e666913a6", "value": "196608:/PDGhrUiyicN0foB/SWtwzL3AiAZ9J9DCJYXan:DirUVis8O/0giAZ9PDrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701442340, "uuid": "c7549956-bd7e-44a3-9b03-044a293799d3", "value": 6372287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701442340, "uuid": "33894e3c-0cef-4c81-9f64-9f04bd02bd19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701442340, "uuid": "cf7c2d5b-fb50-4a21-bfd0-25dbe2c05e8c", "value": "\u0424\u043e\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u0441 \u0444\u043e\u0442\u043e\u0441\u0441\u0435\u0441\u0438\u0438.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0b1f9f-9073-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1701453808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453808, "uuid": "9aeefd14-2725-428a-bb85-74779ab08270", "comment": "Malware payload (RedLineStealer)", "value": "3bd5d6cacc487153a1bd9cc05dd5b277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453808, "uuid": "7da81b36-5dca-4221-a6ac-8ea83c9e2b92", "comment": "Malware payload (RedLineStealer)", "value": "fef6d24e7083f617789a51d353d5b1bea8700c5eafae1ea9e64de6d2caba2a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453808, "uuid": "85bc14b1-d98f-45d8-9808-a343da2a0cd6", "comment": "Malware payload (RedLineStealer)", "value": "041dfcf8ab77d4a1fcbc06bad919c3f383fc1b85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1701453808, "uuid": "ba1c9988-37d3-48dc-bfed-7f9a3dbf8c61", "comment": "Malware payload (RedLineStealer)", "value": "425e3f8ad05fac7811e8d89d4d0981b708f87a16f661df6514141203b659d8b22e7432203f24f7422a0c8fa4429d1a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453808, "uuid": "6a2c43ec-d92b-4ea7-8bc0-12c46d0935ba", "value": "T1CD5405C15AA2B060C84256B61E59BF9E63B42F01300AA21D7F5DC711276F3F377E6D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453808, "uuid": "9065e883-bbae-4bc2-a972-25dc9cf9d4e4", "value": "dd57e6241193db02ac9b4aeea2df893d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453808, "uuid": "e95f4c38-f3f0-4f2b-8892-f4baa877becc", "value": "6144:j+b2hKHrqeYhVX2wfnJXw/RdGL+huThuK1:j+aUrqIwfnZu3GyAThuK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1701453808, "uuid": "b9c91255-44ad-47ba-beea-f3895d8ba2f5", "value": 296664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1701453808, "uuid": "a3ae3035-8b15-417e-83f3-7b35a89db965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1701453808, "uuid": "03947300-bc44-4d79-9ac1-e2b7676ccc55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }