{ "Event": { "published": true, "date": "2024-01-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-31", "timestamp": 1706745781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2c818f9d-db34-416e-b7ed-62a82d18b3d2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c397ecea-c080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706736976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736976, "uuid": "6d5032a7-9967-4eae-bad3-48e338394a5a", "comment": "Malware payload (DCRat)", "value": "6467c1d4c14b19a50b3e154be9454e5f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736976, "uuid": "d3e8e250-0f5d-4472-b84a-663ecf514a38", "comment": "Malware payload (DCRat)", "value": "008e23d54a1e360051a894b171233579d90542580d382a7287d462c2bdad9daa", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736976, "uuid": "db14fd6e-ea68-4dc6-8762-54fd540d82c5", "comment": "Malware payload (DCRat)", "value": "c37fe0a1270b8e8c359b57703f35a4471eb513fd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736976, "uuid": "e27c4cbd-36f9-4d36-bfd7-0a84c1aa6f54", "comment": "Malware payload (DCRat)", "value": "62b064c58fadbb8dc401f7bd58292ff1fac4f3081c0e6c27dec74281fcc023f22b864be253c1d549352da3cb48e99eb8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736976, "uuid": "f0a1e270-78d4-4089-a041-60e93679b92a", "value": "T179222B0AFA9A48FEC62D02B8C5374A4FE075B610B75193CB13BD84152F622E176296CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736976, "uuid": "04ed7426-b523-44ae-8180-136165a650dd", "value": "a336492d9dbaa04b23570555b3e678e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736976, "uuid": "75b649a4-a382-46a3-8c4a-01eb0f64f589", "value": "192:7Vf9JqzjLxlxs3eq9q6t4PAq3Q5tfMcm:7Vf9JqXLa3p9qp3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706736976, "uuid": "c85cb1c1-3fda-46bf-a22c-33ebeae51591", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706736976, "uuid": "3e705913-908d-4ba7-bb9e-d477b90b9b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736976, "uuid": "2e92f45d-c952-4680-83a3-7865fe3ac7c0", "value": "6467c1d4c14b19a50b3e154be9454e5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c638edeb-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686300, "uuid": "a17c7e45-2329-4952-995e-6ec87e6002a5", "comment": "Malware payload (Gafgyt)", "value": "9fc684ea05c862667ce34588a62ee826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686300, "uuid": "430961b6-613c-4e8d-ad4b-c6c20b9b326d", "comment": "Malware payload (Gafgyt)", "value": "00fda7300e8f9e8e6420a52eba484f2a310d0ec0f3b26a5e1128c56c029f509f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686300, "uuid": "a2f53304-0b27-4e70-97cc-95481ea17e02", "comment": "Malware payload (Gafgyt)", "value": "c1bcedaaacf1001e4b372e504fae4ca16c9de834", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686300, "uuid": "0dcff23e-c2a0-40e5-92f7-4759fd6744bf", "comment": "Malware payload (Gafgyt)", "value": "7eec8c89ee9681d9d55bc3d80e12e9772b8fac20b2adf1f05ce2d9d7a0c0dc8c74764f34dee96015025814eb90f0fc7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686300, "uuid": "e6b041bb-6508-4a7c-9e6c-bc5e02b7a591", "value": "T12FE33905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686300, "uuid": "3e278a60-b6ab-4194-8e4d-644623fe0832", "value": "3072:ut8iFDKEfFN+Fa+1sW5h7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaNwh7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686300, "uuid": "8ca6f635-ed24-4cff-86e7-721e8c967d9b", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686300, "uuid": "74c9f9c5-97c4-45d3-a6e1-35c6c3fe1c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686300, "uuid": "cd276c7f-4ebf-42ab-9baf-027246cb80ed", "value": "9fc684ea05c862667ce34588a62ee826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616bea76-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706698157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698157, "uuid": "4fc5f4a7-d5a1-4a0f-b501-feb76b2ecce3", "comment": "Malware payload (SnakeKeylogger)", "value": "3a4776feaabd11c4af38048f0bcd9180", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698157, "uuid": "fb8e77e3-5e4d-40c6-bea4-d72a3d2d5699", "comment": "Malware payload (SnakeKeylogger)", "value": "0166e228994082e7800338d0fabeef966cd11349818e9a0cad042286fa842659", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698157, "uuid": "f88fffd3-f3f6-4c74-a6e6-afcc104e06d6", "comment": "Malware payload (SnakeKeylogger)", "value": "4bf15af33feeb363a0e94a02fc344cb640894dfa", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698157, "uuid": "477be1b9-6f0e-4207-a4f2-7e64ba5844f8", "comment": "Malware payload (SnakeKeylogger)", "value": "294b724b3736fbecb1f78fe09909fd751b300b3663bb43aea831b8e888a99a9b67f33fccd2a9b3bb3f34c5a7f9c632c1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698157, "uuid": "d35bb7e4-e126-4961-8bdf-fa29ba6da8f5", "value": "T107510D212ED613DDE2774B367BF9F2774631F8A0E92D8A7C114082848B65680F862F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698157, "uuid": "8ee854dc-4d26-4e1f-ba42-8004734b2a80", "value": "48:8WpIFFYlo8SjJLxbeZMpje3AoiYetabc:8eILYYrCMpje3AYet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698157, "uuid": "b55435a1-2541-439a-ba72-d7149171a523", "value": 2553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698157, "uuid": "06381b14-76ac-4945-8691-906a5fa1ae31", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698157, "uuid": "a35131da-4a52-4cb6-8261-519ff851fd2d", "value": "Tender INP19472.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55864b8d-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699425, "uuid": "87c58419-ebbd-47af-a2a9-e6234412f220", "comment": "Malware payload (AgentTesla)", "value": "f4f88e40de5a002d99a047963febc730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699425, "uuid": "fbf75fa6-0c23-47ac-b7e7-eb501ce5a767", "comment": "Malware payload (AgentTesla)", "value": "01ea27a001c62c8985217c9d0749b6d25e007eb9524a46b89908a1106f6daf9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699425, "uuid": "e41835ed-9e4a-4dfe-aa7a-1f2afb7c21f4", "comment": "Malware payload (AgentTesla)", "value": "b8b8067d628e1157b085fb9eb39786bb179ed495", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699425, "uuid": "97355523-cd4e-4405-88b6-4f0e2b368bd6", "comment": "Malware payload (AgentTesla)", "value": "4a73e350327e581afc04dc5cbfccbee03437a689b549064fd2b350e87a4c610f0912deb1b30b52d7eb1f506b8ec6dff9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699425, "uuid": "d6453948-946a-4f80-aaa6-44b186d35c4e", "value": "T153E4121172655B2AF97E1BF01A21928153F3B4AB98B5E3589CCA30DE3976F008F91F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699425, "uuid": "c70aeb99-5526-4731-b5c1-f445be11fdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699425, "uuid": "68152910-4847-4dea-a06b-b98823b5a516", "value": "12288:pC8j8qshDnZ/LOMN5+G8Dv16Pbd2xGd/tTMqupxcmlTztG13LXrxs:M8bshd3NEG5Zd/tThucITSbXts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699425, "uuid": "38950550-8a1f-4a7a-8127-9dd4404e3581", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699425, "uuid": "1985ac25-8765-4058-bf26-71dc0276313a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699425, "uuid": "76e1c104-277c-44f5-b6dc-2f467c06040c", "value": "FIYAT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2f725c-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706699200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699200, "uuid": "ceff287b-e368-430e-acf9-7f5c6196e371", "comment": "Malware payload (DBatLoader)", "value": "11fd49816ce5880037ab4c89cc8a825e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699200, "uuid": "2fde2ee3-43b4-4d01-ade2-84e11eba26cc", "comment": "Malware payload (DBatLoader)", "value": "034079374ad5663d77f9e36e71f469fc2ef945d8b245db6d3a81f5f1a4512f50", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699200, "uuid": "e28ce433-eeb5-44c6-a9e5-dc19f5d6b431", "comment": "Malware payload (DBatLoader)", "value": "9208fb1159c83b492cab950339bceff341c3009b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699200, "uuid": "ff4bdea2-582e-4695-8229-f29966656ae8", "comment": "Malware payload (DBatLoader)", "value": "f8e2f7bfd3c39f66d65c60854ae9d4f4a3aefb655ccedbac0eba31a3047aa747933f8f08fc994cfa4740e98b011d4bab", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699200, "uuid": "ad075123-487b-4b08-bab8-53467b287efd", "value": "T19E85BF2276D5452DF222B47927A67BACF91CAD3CAC256DC566F4290CFF33200FB08566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699200, "uuid": "e8621583-a2de-4075-baef-eaadb69f75c6", "value": "24576:m7+thTZ7kWmWd+Rgb/THkqlTT5s5X20WXLEHwzT/Q8GJUZfMa7DfOvrXnp+70gOZ:ms7XrHkUH6UbEHc7qvrK0gOzM01RG+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699200, "uuid": "f4b2e040-f7ea-4665-be07-087f06c8fe97", "value": 1870939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699200, "uuid": "6b362f28-4c12-44e4-9acd-1fa72848b515", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699200, "uuid": "d317d7ac-e0b7-433b-82ac-31767788c06a", "value": "DHL_881220128163_10TD01_20230619_17377.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b09526-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698462, "uuid": "b1c8e8d3-361d-4c23-b4e6-a29873aacf6b", "comment": "Malware payload (AgentTesla)", "value": "80dd7b490cebb950f1375322bc8b1f73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698462, "uuid": "50478863-c2ae-465a-854a-1000f25abea9", "comment": "Malware payload (AgentTesla)", "value": "037236f06b1997a9f1db5b809d53fc8729cbb2704c27b1cf39c68538ab85f3f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698462, "uuid": "b36c8f48-c1df-4e3f-9220-61a6f89f53f1", "comment": "Malware payload (AgentTesla)", "value": "5f8429c3982bcc0243d8959df58ba7433e8f25f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698462, "uuid": "a7609dd3-e536-43e8-9134-ebdcfa114ceb", "comment": "Malware payload (AgentTesla)", "value": "e6f5ca6de21a10602612cc6eaa667743c897bc8f721bcdb00ef0ccc5362018c368d655b06f50ff5b9bd0af9acfe296df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698462, "uuid": "0d3a9939-aca9-426e-95c9-9ce47cf4578b", "value": "T12CE41212B7E98F64E57F4BF90660404003B6BA4B7471E61DDDD630DA7572B008BA3B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698462, "uuid": "445cb752-a488-454a-9b8d-19011df7f40b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698462, "uuid": "6c475b7f-f69d-4295-b29b-80a8e1ec95f6", "value": "12288:rT8j8qshDyclM4YFeNTnb8zXfFCG1LRA4LHnBs/vVBcBFTcnXb:38bshmdPpzXfAULRA4T63+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698462, "uuid": "07e42e06-47ab-4d49-af4f-2d5df65258b9", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698462, "uuid": "ce14871c-e986-42db-8534-123f3c64dab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698462, "uuid": "e1d74f3f-86c4-45ce-ab25-cdc17aa1777b", "value": "Payment Advice-BCS_ECS9522024012916420050_38_952.pdf.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7720b93-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1706713441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713441, "uuid": "84d63c7b-31bf-4082-8fcf-c38d7cb16e0e", "comment": "Malware payload (DarkCloud)", "value": "cdcfa8aab8a4766ddb88df4635104d83", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713441, "uuid": "1453a4c5-bd00-4732-8821-4f94a38e4ccd", "comment": "Malware payload (DarkCloud)", "value": "0414ef0adb12bfe054d85f9196cee419bee6a7692187d83239bd5f8ee867c4c8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713441, "uuid": "916283f2-378b-4396-b478-b1538754539c", "comment": "Malware payload (DarkCloud)", "value": "7ad43cc7224f694995e53325a581e659eabe2e16", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713441, "uuid": "98750d11-15ca-4eb1-819d-61f8f96c4b13", "comment": "Malware payload (DarkCloud)", "value": "e88cf76edc2c8dd0eb81a31587d893f2d2c3c51b11596ba10dc1fcd76c938d5876c8e42a9efa35ba9d5c6d94391c8205", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713441, "uuid": "92a6537f-3254-41ac-8a72-e107cde1d5ed", "value": "T15F25019CB60071DFC82BC57289901C64AA21AC77432BD206A45B35EDAE3DAD7CF195F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713441, "uuid": "c3ab2f1f-34c4-4b9b-b875-4943722b15e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713441, "uuid": "4280898f-3ce5-4c24-ab08-15e03ddc1017", "value": "24576:FJRsQJVHvu3/mAUf45P3z55KTBmfswlibk:bWgHv0wq50TAfpEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713441, "uuid": "bfc6265c-896a-4c78-93ba-24528083b951", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713441, "uuid": "53a2e480-ded3-4688-abe7-40fbf747cb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713441, "uuid": "4a5ebebe-0288-4e83-a2bd-9a7a382547a4", "value": "payment receipts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f39d5f6-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678477, "uuid": "c392f5b0-254c-464f-8a08-ab0cac1f65a4", "comment": "Malware payload (Mirai)", "value": "dd1e11af2789eda9ef0b2f40650ec749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678477, "uuid": "50826227-3273-41eb-b8d4-04cdb6d24c82", "comment": "Malware payload (Mirai)", "value": "049742a5f377df96d8461abf08bf5daba0c46860223020f764a8070885341e54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678477, "uuid": "3fcf2225-5c66-4f2a-aa52-6cc36b541147", "comment": "Malware payload (Mirai)", "value": "af42302b901f6fbf981dde46ac9f9c878598941e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678477, "uuid": "810bece3-6062-4f66-8732-ab22324170e6", "comment": "Malware payload (Mirai)", "value": "904dcbc3516ef008b92520a0b16f869382d2d77a55a8bd3558f39511ba0db5c9de687f7d4efc894c7b231c1ff0586451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678477, "uuid": "fdaa5124-f0e5-4a08-8568-5d22aa498182", "value": "T1C93302ACB52CDBA7CADF0CFD00E822A6188351B6331A8B68EF109DB2FE51D5E71514C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678477, "uuid": "38896f67-2ab6-4988-9478-71db1660332c", "value": "768:LPdPZU/+M6/odc/hYW7Dm47CzOCJ57TF3pW0iFKWhbGBzqGWe:LPVZpd/odcv7i47IJ5F3pW0aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678477, "uuid": "8b647ac4-d2af-4538-bcce-b1908f667de9", "value": 52004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678477, "uuid": "4fc99dfc-d468-4f19-a89e-f8442d79fb6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678477, "uuid": "042c97cc-93a8-4969-a9f6-a5d200b3e4ae", "value": "dd1e11af2789eda9ef0b2f40650ec749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448ed6fa-c037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1706705410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705410, "uuid": "f84c4b23-f05e-492d-80db-2f39ce7ad8b2", "comment": "Malware payload (Adware.Generic)", "value": "e1741eba2c6bb68bcd7a0ebdb1e7bb58", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705410, "uuid": "d6961256-204b-4bb0-a231-6294bc6a015c", "comment": "Malware payload (Adware.Generic)", "value": "05137f0b447f98189c2a7a7cd745abe3aa8a902196377c19485e09098653a04e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705410, "uuid": "af711f50-3245-4204-b95d-2a1c361582ec", "comment": "Malware payload (Adware.Generic)", "value": "32a0286edb58d27fdb582a03f48fdad1137cca4c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705410, "uuid": "f218c49f-537d-4e11-98a1-def800849be0", "comment": "Malware payload (Adware.Generic)", "value": "316d20463a5c5b51ae5afcdb90be9219e581c6a38262315520883760d280cc5b994d8f8993895d3d1ccbcb68404bab86", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705410, "uuid": "9d70ed07-64d9-42b1-8439-02cadd4d762f", "value": "T14AC6233FF268A53EC56E1B3245B39350597B7A62781A8C1E07FC748CCF721602E3A656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705410, "uuid": "412c6b64-86e4-4865-addb-df41994a3fe1", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705410, "uuid": "29e57a7f-4b57-4659-b58e-14bb26b815d0", "value": "196608:sBTYD1idyynSf+zzSu6unJDcGEgGjtq9KJ+AVAl3Z3mABmXEO7GAvF/i/tiz7hUG:AYmgESu62egGjtq9K0AVyTOZMFiz+o9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706705410, "uuid": "242498bb-04b6-4abe-a2e1-5ca243544e81", "value": 12315416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706705410, "uuid": "d0e3d099-774c-44a9-9b36-034039970343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705410, "uuid": "233e15b8-c32c-4269-af5d-8071f86aa9bd", "value": "SecuriteInfo.com.Trojan.Siggen22.1336.17698.4704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453b3d8f-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687801, "uuid": "08f23f6d-aed4-4837-ace9-e5fe38633e74", "comment": "Malware payload (Mirai)", "value": "04277e9caecdfa171ff4f26bb6f0876b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687801, "uuid": "e28f25dd-4217-449d-ae80-103272b9a736", "comment": "Malware payload (Mirai)", "value": "0601eeb688d03dd487342a2b40ea0ad017a5031e55ed49a594e4833f292089e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687801, "uuid": "072aaaeb-79dc-4051-a9c0-a1742c6b368c", "comment": "Malware payload (Mirai)", "value": "6b66a2a576d7deeeeba2569b176409275a81de5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687801, "uuid": "43fae72f-e2e9-42f5-89e9-3262ecf21d24", "comment": "Malware payload (Mirai)", "value": "936ef1f385589b81f443f33e0bff5b7af94ce9cc590699bbffab64476ec2e23d3a32e4a741068f54d8677ae213cac21c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687801, "uuid": "20499cdb-fe9a-47ba-b491-c195a6500ce6", "value": "T177043A46EA414B13C0D72BB9FADF42453333A75497EB33069528AFB43F8679E4E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687801, "uuid": "8030b8d0-51c0-4603-a9fe-69fe69180653", "value": "3072:CTmyiTM/k8tkxah9OyCMk4vP3RDTBz8Tw/ujcoLM/RQm3s:v1M/R+xah9OybkQdB4Tw/KhLM/RHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687801, "uuid": "2699f62b-c2bd-4e6f-96a8-57900779a5fc", "value": 184486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687801, "uuid": "5c17d644-493e-47ec-a3a5-ef317bf7ea2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687801, "uuid": "da77d84a-cc89-438a-891e-582d8e604433", "value": "bulu.arm7-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf22006-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717582, "uuid": "f1073fc1-f54d-4781-88be-0451baebe76c", "comment": "Malware payload (Mirai)", "value": "c6f3efc1a6e581ae3045b1a2c65af3a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717582, "uuid": "de563109-9af7-4219-8b1c-0b9e35f25c00", "comment": "Malware payload (Mirai)", "value": "067bdf09fae73a3a4fd6f52cd4aa4176a38a6259909e395fd062a9ec5f66207b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717582, "uuid": "0f2a2d49-7221-401c-8d76-854cb63d9e68", "comment": "Malware payload (Mirai)", "value": "a2436f74471f8a49dd79011c1e3f1e7fc9b63e40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717582, "uuid": "00876871-628e-4438-9bc1-a19fa4dd025a", "comment": "Malware payload (Mirai)", "value": "b9e6ac13bbada26011905889061a96b7b2ae37143db605dce96f848f7e597f27788d43f796435826744954a18bad95d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717582, "uuid": "27155845-5196-4b07-bcd0-771694a5e4e3", "value": "T164330225BA2B502FCD9A5B337F7C4309BE45A2B8C0FA6956F0300919DC06B0B6F5559A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717582, "uuid": "b0494243-4791-4298-b7a7-db7aabba1ee4", "value": "768:ZLLj5md7I7SMyTst7Im3JCJ5C2Xa79q3UELwFFjj3ytlLMFBLk3ucJ:pUds7KYt8/I2KaLwfP3vBY3ucJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717582, "uuid": "c3da84e0-e12a-4621-a505-74cfeac93945", "value": 51960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717582, "uuid": "0755ae68-87b6-4ed0-ab6f-4db8c4f3e3dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717582, "uuid": "e0d84091-08dd-47f1-90ae-b092cd610f98", "value": "c6f3efc1a6e581ae3045b1a2c65af3a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb37583-c076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706732777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732777, "uuid": "ff18d8ed-3ac0-41ca-814a-545d4dc384cc", "comment": "Malware payload (RiseProStealer)", "value": "2a3092d61d3c6208400625aeb8baa6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732777, "uuid": "5a2cd276-4752-4353-ac7e-03e384756c86", "comment": "Malware payload (RiseProStealer)", "value": "06ccb8e6100fd654b89367b2c6ea6be48dfc91c404656b4020516fcf1350179f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732777, "uuid": "d37566a5-e57b-421b-9219-db371f01b1cd", "comment": "Malware payload (RiseProStealer)", "value": "a7620193cc85c05e6b341c8fcba18ef61c34b69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732777, "uuid": "988aeac7-93a3-4f87-86d3-b10ef239b7bc", "comment": "Malware payload (RiseProStealer)", "value": "ca1e03509e0f65ee787846e33bba59df8872d14c77996ad1adc5bb51f1f1f6daf3a7ff8ffaa32794522109177ce4000e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732777, "uuid": "07ee238b-60dd-4dbe-bd48-286f1d81634a", "value": "T1DCB533FA8A748291DA371BB4881D16D841CB7D8B4490ADA6006CFCE91FFD5F9A01FF58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732777, "uuid": "0efd0be4-42e1-4356-a94e-34e38a5a25cd", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732777, "uuid": "ba62e560-900c-417e-8e20-7e3a335d5cfd", "value": "49152:w9irDtug2+sw5BmaEQ2OVg+neQOyP1K3H1GneQcgQa:wwHf2UwaErOVgOtK3Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706732777, "uuid": "f501e41c-5e47-4c9e-a651-9d630ef97e22", "value": 2298368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706732777, "uuid": "87d4e82b-e15f-4814-a92e-861fc528116b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732777, "uuid": "a221f036-a882-417f-a57a-46b9302d885f", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14293.13935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9a5172-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678502, "uuid": "3ebedbb6-2256-4382-b90f-a412b5ed69ee", "comment": "Malware payload (Mirai)", "value": "0dfb6d8f56e8ede77f8253fcedca2a0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678502, "uuid": "bb5cffef-ac9b-43fe-8615-3301706c5cf0", "comment": "Malware payload (Mirai)", "value": "07cecdec93ca06b43d7d0fc946cf7c3f01855c7405c907448be7b9dc7d4a3d34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678502, "uuid": "2c11f98f-9cb3-4bd7-8bf7-74714a9c62b2", "comment": "Malware payload (Mirai)", "value": "bfa7d56fe3a63b8f5c3e141282cff1048e082614", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678502, "uuid": "eeccd069-ece3-40bd-80d6-af6c8bd2517c", "comment": "Malware payload (Mirai)", "value": "7bbb4762f491d5c989d9651d11fe6376303e796e9d0a61eb0f103f85fc81df7f657fc096d8c2f79af86937398e6597f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678502, "uuid": "8578fa60-2eb3-44de-b1a8-38402b80bd6e", "value": "T1CA23F2A6F572AD73C5BA0FB75E7E6C441BDBA2A6E5153315917440027C0232EE8F321B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678502, "uuid": "a3846817-2094-4a93-93db-ce2ccfe48167", "value": "768:bSAxGVDnkeJ8HJkOX8TRG1XUVt+7ujyOZQGFSWVPRcEm2h5i1zWqs3Uoz1/:bSrtFJ21XqGBU7RjhSap73m2/ipOz1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678502, "uuid": "be82c806-1eec-40df-8163-9239513c45fa", "value": 46796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678502, "uuid": "c8108857-17e6-45c1-b916-0ad041cdae83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678502, "uuid": "e5110d52-dc67-43dd-a622-eb709ad2c839", "value": "0dfb6d8f56e8ede77f8253fcedca2a0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cdd0d7-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706698783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698783, "uuid": "25719839-de67-4717-a746-a68e8991a82d", "comment": "Malware payload (Formbook)", "value": "7bd3390b49480a7d6360f3056ad1927b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698783, "uuid": "0371fb00-f13e-468a-b3ae-a7d876bce3fa", "comment": "Malware payload (Formbook)", "value": "07fdcc0a6a5564ddf03f23ae29b72e917a27c32239693fa240fb50a417c198e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698783, "uuid": "a1f7f03a-add6-4a55-876f-0aadf77267bb", "comment": "Malware payload (Formbook)", "value": "63b06f798c6d0fce4b43dd495c7e660f734f44dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698783, "uuid": "010c42ed-a03d-4790-b5a1-04a2868f2037", "comment": "Malware payload (Formbook)", "value": "9b097944973d1c5649c1f51bc35fec48884467bb3b4dcfe9fb478ff31829a3bca3ed572f4e82623ba64c5cf84ff19e62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698783, "uuid": "31ee19ca-65c4-458d-8c31-c376db930f35", "value": "T101C402289A749F12F93C0FF621B4B911E3F122976606D7B95CD920C52BB3F250B04EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698783, "uuid": "87c70a10-9728-40e3-8de1-8b9d63a1aba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698783, "uuid": "c4dc29b2-b807-4112-a7b7-182c05b1ae4b", "value": "12288:6A+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:6fa6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698783, "uuid": "ee4c867d-b3e6-4daa-9e7b-b2261ab32f56", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698783, "uuid": "49594675-72d5-4784-86d5-1be87eca05c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698783, "uuid": "eed89213-240b-489c-86ae-4c46127f7373", "value": "AQUA CHEMICALS-RFQ#013024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48642926-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687807, "uuid": "147a316b-20e0-432d-b67a-56db2ee2301b", "comment": "Malware payload (Mirai)", "value": "3daa425dcff60a1409f71a9b7146f129", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687807, "uuid": "2683d972-fb37-41c8-9542-c47b9233ec88", "comment": "Malware payload (Mirai)", "value": "0a975d2b523fec92b77ed016c1b64c10fc1165149c3ef80f4e19730ab3bca1fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687807, "uuid": "da977727-ebc7-499b-a457-adb0b2c71f28", "comment": "Malware payload (Mirai)", "value": "8e127613e91ceed00c11cd07b1016ad3b9765f9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687807, "uuid": "ea499d64-8772-4f22-bfd6-fe8c8b4492f0", "comment": "Malware payload (Mirai)", "value": "1a1eae636d4f0fa75705eeed6367f46a9e4658c0746211e986137ec65319f5e1a7ca179c61c275273fd8986e9de61352", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687807, "uuid": "e0d83ba8-f41e-44ab-8f6c-6985c8b7b72a", "value": "T1B504E816AB510FBBDCABDD3706ED0B0139CCA55722A43B363674D628F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687807, "uuid": "ab6bb628-bee7-4877-9292-aa6ebb6c83e4", "value": "3072:xriHzvHbPa1GboNGCc4s4wKRcGgG4BRguc:xUzjPEGKS4zwHBhXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687807, "uuid": "8b87ffc7-782d-4a07-9104-3cf826305f23", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687807, "uuid": "edcfe7a6-328b-440d-a4e2-bb6d3276c35d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687807, "uuid": "fac730b7-47cb-446a-a57c-fcdd988df206", "value": "bulu.mpsl-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6b540e-c05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706720566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720566, "uuid": "2effaae9-f34a-4afb-a2ad-55020d4f6816", "comment": "Malware payload (RiseProStealer)", "value": "6a3ff23d2e1676915af36bb3c186cb61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720566, "uuid": "9cfe4604-10e6-4a56-a74a-268b98c5165e", "comment": "Malware payload (RiseProStealer)", "value": "0b2c728149c97d33786ad31a01a4ef95fcf7d5f5043fec43f067d7bacb12dc1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720566, "uuid": "ba786644-4bc6-41a4-977c-deb9b835976c", "comment": "Malware payload (RiseProStealer)", "value": "6470fe558a6389222a63592ab2dbe38e8a411d29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720566, "uuid": "2a83cbf1-d452-47c6-baa0-c9d4751632f9", "comment": "Malware payload (RiseProStealer)", "value": "f813314f44ee92366835be1bb6dd598a9a4a0c8a61ea359d62e2c829067159e2b30015ae6cbe86256c375587a99eea3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720566, "uuid": "7a6475cb-74bc-4436-9af3-be7a5e9a0898", "value": "T1F3B533C088FED760E953D378A721822797A37C03DE00166A3E66FA34D7BD2B52955EC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720566, "uuid": "1d4f3037-56b0-4ddc-adec-e824d8eacd39", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720566, "uuid": "040c418d-28dd-4d7b-ae49-cca0b347dcd1", "value": "49152:CcmTaOKtK/8Kzct4rGqo28fz4jTEmzHy5JUZlNVyjg6zu2Jie:umOKtK/bCqXdzHy5+VkxuKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706720566, "uuid": "33313f2e-7e67-4caf-97b7-65e5b81715f8", "value": 2321920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706720566, "uuid": "c84924ba-0cc2-4657-a4d5-59a8a91a0e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720566, "uuid": "2a298c0a-e00c-4b56-b33c-f51cb6277ad3", "value": "6a3ff23d2e1676915af36bb3c186cb61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2798ba6-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706715875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715875, "uuid": "1ea8e5d7-0705-41c3-a865-4a821935defd", "comment": "Malware payload (AgentTesla)", "value": "8763ec1cc89749580c78359c43111832", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715875, "uuid": "5e4a3750-5e20-4769-bba8-9a2bd9203cfe", "comment": "Malware payload (AgentTesla)", "value": "0b5daf38ed40d3f00f18aed1e999337cc3473565f60bef2665c594cab3b744e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715875, "uuid": "e94f8692-80f3-4996-a072-13f91ec444ad", "comment": "Malware payload (AgentTesla)", "value": "b4a2c93730049e6400420ac43f1c9bba0cc06b1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715875, "uuid": "1af37992-2780-4775-b2da-47b8d3a5e06d", "comment": "Malware payload (AgentTesla)", "value": "a6c6ba57bf2540b9949b78169e8da8803544f47eba76693268a1bea844ff83878415344eb6cf49415572b9b4f5106a82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715875, "uuid": "cc290813-bdde-44bd-b0e9-240c7e32a08b", "value": "T1B815AEDC721075DFC817CD368E682C64A6217CBB931BD207A06335ACAA6E693CF155E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715875, "uuid": "42b4402f-3f25-4db1-9abe-64f2035d63f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715875, "uuid": "203231f9-efe4-4e55-8634-becbde2c6c24", "value": "24576:maI8bshxCnTepzY/4205fY0xsvKWgXw9GBi:mgbyQzEY0h5wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715875, "uuid": "0f12f700-bda5-48ce-ac10-e1a9f09784ee", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715875, "uuid": "ffc8e943-0a3c-485e-9d73-92d38c2833c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715875, "uuid": "4fb91250-52e5-45c8-9b4a-90e526931c43", "value": "Amer Salman\u200b Nasser Quotation 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446976e4-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1706697249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697249, "uuid": "14747088-42e1-4258-b5a3-4b0135a37818", "comment": "Malware payload (zgRAT)", "value": "82659385a3faa68194726148a3654109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697249, "uuid": "32e6d99c-9116-4c48-8a32-235156fd3b29", "comment": "Malware payload (zgRAT)", "value": "0eb169839dc6a46f957ae2c3dd1c31574a90d10cb3e883ceb764e2cbee332c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697249, "uuid": "9e765b32-379b-450d-a478-cbb581870798", "comment": "Malware payload (zgRAT)", "value": "3360abcf463d310a115c940cb186ded4f7e6a216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697249, "uuid": "108eb309-70c4-42b4-98da-7d8c21cfd404", "comment": "Malware payload (zgRAT)", "value": "7def8c9586bca3310f2afa24afa5740ee6abddf43ccc83473ec11b49f745e3f4408b0edaa24bb68ad73ffbc71d3aff04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697249, "uuid": "efb663ce-99ea-482c-8543-0d2c0b2c9af2", "value": "T101D551485B3F0695E1518C74A1334663A8BDBD1CC01CAAB5CBC09B556B9FF21A1FB3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697249, "uuid": "d87f0db9-cee7-4290-8887-4fda3f7af767", "value": "8ce33933ad4d67656fc05f8f5cea2055", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697249, "uuid": "66cba576-0852-4279-b7b1-c72d31c28a9e", "value": "49152:l5lOgmBuV7YyqlRYAxqyAjtxCsvVpSKkBG01eiFKwL0a6Zp2hCkHp5E:ZmMV7YVlRYlvCdLGLixLkpYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697249, "uuid": "2cb874c3-79f8-42ba-b757-892ced265e30", "value": 2874880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697249, "uuid": "783d6730-321d-413e-8943-9fd41f376961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697249, "uuid": "fd313dbc-7a7d-4312-9f2d-865d5831f77a", "value": "82659385a3faa68194726148a3654109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d108bf-c03b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordRAT)", "timestamp": 1706707053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707053, "uuid": "17ced92d-b609-4e20-9c57-db5f1e5e989d", "comment": "Malware payload (DiscordRAT)", "value": "b0e2fb810d84976ca81d3fc8130f97ae", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707053, "uuid": "99e8f884-f97e-4034-b109-c15569eab1cf", "comment": "Malware payload (DiscordRAT)", "value": "1004ec56662bb7f748ceca118b5be12cb57746e0918a3d07aced6d3be5d91e76", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707053, "uuid": "09a1551b-0e6c-4902-9293-82a47cc6363c", "comment": "Malware payload (DiscordRAT)", "value": "fffa04a5aee0ca44d7885045a4c7f1a84a11ef22", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707053, "uuid": "eb345399-2089-490f-a2f2-ccec981f753e", "comment": "Malware payload (DiscordRAT)", "value": "216027ce45962917cf8a4834b493e92c4a7e6ee618d71dd188d25c83646f98b2c6d212cd770e165e7458c5ccfce7ba8c", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707053, "uuid": "f3540f52-2d5f-42a0-bd84-78bf95b89b6a", "value": "T1BD73B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707053, "uuid": "2c130a95-7443-4947-a750-3a06174a2c2a", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+4PIC:5Zv5PDwbjNrmAE+cIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706707053, "uuid": "7be65c76-7f95-470e-a060-25858c3f1a22", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706707053, "uuid": "d1eb6611-4d98-446e-aef8-5347573ff3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707053, "uuid": "f8579c81-d2b8-4b59-8486-8b915624616d", "value": "tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9844a47-c068-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Babadeda)", "timestamp": 1706726678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706726678, "uuid": "cb1e513f-2b30-4837-96f0-22ea585fbd44", "comment": "Malware payload (Babadeda)", "value": "89c3080450032840bb51a80be936d69e", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706726678, "uuid": "3b488758-5f39-4533-89e0-3305141fba71", "comment": "Malware payload (Babadeda)", "value": "1120c72e96423635515bd260a0d9b219a6a7d17eca7f21d2ab63e3a6d2319539", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706726678, "uuid": "0fe40141-0f0b-4671-b7ff-b919c09ca9e6", "comment": "Malware payload (Babadeda)", "value": "b2b8cc29fa2b5a75b1254f164c4c9c8ec6742392", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706726678, "uuid": "8fda0c48-ee8f-43ee-adbb-a74b819b7649", "comment": "Malware payload (Babadeda)", "value": "f762b2924e191c39d75465670c270d8037c11ddad2ce097d79870935764f87d1d5df127c1e2de040647108d244d18744", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706726678, "uuid": "be882e23-a442-4c8b-9c1c-c170c7e86378", "value": "T11107330EFAC702D0E9D796779D915EFAB20B3B2143D6495C4B16F70528436B22272BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706726678, "uuid": "4ace12b7-39b1-4161-bce8-b3d7730a2eda", "value": "393216:QLIGp071zZfacj5sdJl4IhyPrPAkQFh2QiqS7GDacp5pDkLgpnHdWeneOjfGiKWt:NGp0/SJjhyUkQO6S7GDacp5poydnlfGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706726678, "uuid": "3cffa085-5ee3-40b3-bcc3-c44712320b91", "value": 17802285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706726678, "uuid": "9aa90dcf-b033-4903-abea-393aa641769e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706726678, "uuid": "aec62aab-f72b-4fd1-92a4-c340a9f6352e", "value": "ClipPlusCommunitySetup_ns.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f8e1bc-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706715753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715753, "uuid": "6f256ca0-536f-48cb-9cdb-2780a09f25ab", "comment": "Malware payload", "value": "0fb344270cd9fc06d12ffdeb3d6836ef", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715753, "uuid": "fe074c65-2e98-4864-8b16-c4e31905e717", "comment": "Malware payload", "value": "1140bd43933277d7629fc5882b978a2ecc62a705e2ad786c5af661e845a3718c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715753, "uuid": "f4b6f69f-3e00-42da-8067-1bfeae701699", "comment": "Malware payload", "value": "7f891a372c4ad309881c91b6ef8e4e3825373a09", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715753, "uuid": "6e06cdad-fc28-4dfc-a83f-d1d6ed8e21d0", "comment": "Malware payload", "value": "676739ff7070844a60d21833819630d8a29291c3e287868efbc37d74cb97b964580f79a83663e3880a17fc1d9f6db051", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715753, "uuid": "f4bbbfdb-9345-4c5a-8b70-bf6b681db999", "value": "T12153F16ED6654DBCC02E213D291298A0984BE272CBDCF7E720346E117B0EDB7535532B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715753, "uuid": "092707bd-e63b-456b-9445-8fc9192dfa7c", "value": "1536:bnk6cq9/RdUGWfx0I7tsRv6+7FsIJpR52f34:r77/kXfx0IuRThs21G34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715753, "uuid": "aed4bfc9-b2c4-4dd6-b546-c00a93caa938", "value": 64378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715753, "uuid": "3d012d50-7274-4c42-9a2f-9ad13ad040a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715753, "uuid": "8913e96a-33c0-48bc-bdd8-c8cec37ab2eb", "value": "VT Price List CHF incl. VAT February 1, 2024.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4381b7-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706718091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718091, "uuid": "6acd300c-5779-48b6-b45e-30c67c1406d2", "comment": "Malware payload (Gafgyt)", "value": "fa08932e9f77084a93441fe18c640311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718091, "uuid": "9357f2ac-e98c-4621-ae63-d0e1f59ffcd1", "comment": "Malware payload (Gafgyt)", "value": "115ccf89ebfd2d142fc3f5a8597beb92859973c7cdf08dba8ad71ea66c92e80e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718091, "uuid": "83b1076b-fc04-4c7f-8bad-ba5e8fbec9a7", "comment": "Malware payload (Gafgyt)", "value": "186a266a31abc5506d4889e669755fdbc64985c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718091, "uuid": "da5cc0c9-f588-42ae-91f5-3bc7befbe765", "comment": "Malware payload (Gafgyt)", "value": "83b505565473f71b72b65f996402901a05e94f8967118cfaec77fd94f1f3370a446e302c9c93532c67d0ccc4875cfc58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718091, "uuid": "f1475a2a-a040-4db2-bdb6-0ae28625944c", "value": "T15D830826F6138B23C1DA167112E74F31ABB1D7C53AFF625776A02DAC6F126803412F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718091, "uuid": "3347b6cb-3305-41f7-9660-f7adf1ca7b66", "value": "1536:1VGNBGFQOF8tP05LtZ7EhkmkiEh8PdFEAwSn:qNqF8lkT7EKmkiEh8FFEnSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718091, "uuid": "7984251c-17fa-4f7a-89a6-e7f22cadc165", "value": 88077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718091, "uuid": "0fb0e5d8-3e50-4bdc-965a-fb8861988447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718091, "uuid": "f70b066f-3fab-4809-8bbc-52f5f34e7ff2", "value": "fa08932e9f77084a93441fe18c640311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b25593-c022-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706696493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696493, "uuid": "0bcdf0d9-d927-498b-8bbb-b7078fdb88f7", "comment": "Malware payload (AgentTesla)", "value": "194df4f86da6c217855b4dd6b5adc78a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696493, "uuid": "28b64ea0-f978-4e23-a57c-bcb6800f4923", "comment": "Malware payload (AgentTesla)", "value": "125e9917a2d6a92d1de0be04622f3a57995f5742b5e717c3d9829a84ad2303af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696493, "uuid": "5ca0d867-dfc8-4329-8599-150b178288c7", "comment": "Malware payload (AgentTesla)", "value": "600d8c9b2cb7b3a33dada1de88258f4029177f94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696493, "uuid": "9be76535-677e-48ff-9d22-a0428ad8bbb5", "comment": "Malware payload (AgentTesla)", "value": "6c4e67a96f9b2401c7f295d86d2a568318c4ad995777618e65ead109b836d39d7754f15a0a7d18e9dac869b3e78d1472", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696493, "uuid": "eba69dc3-e8af-4f5f-b203-1211e1eb1ed7", "value": "T18BF4121473C45A27EA6C8AB4CD7151CC97B6AE243E85F3DF1C84309C96F67C69AA4313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696493, "uuid": "393da691-f609-4c85-acec-1cca62bd773f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696493, "uuid": "dc111cae-7b8b-4b3c-af81-8ce38ac2329c", "value": "12288:Izq9u9SCF1O5cXYiAev8sx+u6rbUOXCJFbt5ufULysChw2G2/aGw+TrqjJUVrRd:MMu9ZkcXrDv8mcAFnp12G2hwOq1kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696493, "uuid": "f5e7e689-f134-4c01-972f-84f1f90a1a23", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696493, "uuid": "3428a730-e603-478f-965d-ce8ff8c52dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696493, "uuid": "9a31a267-da46-4fa7-a3a0-e28cc9e21ce8", "value": "863037-Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000e0b7d-c012-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706689403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689403, "uuid": "acb528c7-7be9-45b1-9f30-ed4178efda6a", "comment": "Malware payload", "value": "8d617fc9eeaea6a30e67f98dea4c2785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689403, "uuid": "b1293b54-132f-4829-9731-5968ec4dddc6", "comment": "Malware payload", "value": "131f2c6100fcb9c1d8a84f539e6f2d4b17a2c5cfbbe64c429c331754102afe97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689403, "uuid": "a00a816f-ba07-465c-a108-4634721f8174", "comment": "Malware payload", "value": "ff5a9162e3d2fd69f66006c5c4ac4ebbc0e2b754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689403, "uuid": "f05c1bcd-9fea-4737-9d71-2fdc08c3ac93", "comment": "Malware payload", "value": "1aa8917e36fe1966c9338f8546995f9257fafb243ec705debc573acbd69b4c289bd133232545879bddfc2561d960471b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689403, "uuid": "1467fdc7-7424-4a05-96bb-dccd407f89f2", "value": "T1C225BF8E739ACBB7C162D77CDE91F62363F07D10222167C77A86541E6EA36C088E4716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689403, "uuid": "2b6e9c7c-887d-404e-8cae-ee1af6f9cdae", "value": "9485779f49723b4ba80bc1a89fc46186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689403, "uuid": "dbe3ced1-4c79-4462-bce9-73f07597df58", "value": "12288:wDU9yjh7RucsdNvJ41YFTSpkP20UxCj2AqeMQmV6TnSEl1yt6zzng0Lqz6TnSElW:wD/jB/s5CYFTSpkPxuGKFuRqUROn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689403, "uuid": "61cf09e0-3a2a-46b7-ae6f-32fe511e9127", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689403, "uuid": "0e159067-c445-4747-9a7c-5ae05dcdf72c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689403, "uuid": "14ee9eae-491a-4af5-a45c-0f0a6305d944", "value": "SecuriteInfo.com.Variant.Lazy.396670.22287.2975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c93d8d-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706678536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678536, "uuid": "fced80c3-5cd1-42bf-9ccb-660e003f090f", "comment": "Malware payload (Gafgyt)", "value": "d2697d6b0be4dd857a4f1b85155d9266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678536, "uuid": "1d2df45e-b265-4748-b6ce-89c6cc0be8a2", "comment": "Malware payload (Gafgyt)", "value": "141102e5880d761463b1767e8d3d92ec0fa78b8e59a517cb5047664aacad6e14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678536, "uuid": "eb1c21cc-cfe7-4cba-b745-36ecf354f284", "comment": "Malware payload (Gafgyt)", "value": "a64916df2d8af0777b02f90343ece6a1ec081adb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678536, "uuid": "baefa180-b051-4239-8e93-15930962073a", "comment": "Malware payload (Gafgyt)", "value": "8370280bc3280aa852558376a833f2d1481e88368643d4e87bf443baab7d15ea92a27bf97007ad4428ea8575c7bc8879", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678536, "uuid": "aab4e6d3-36f9-49fb-bb62-d79e83780abe", "value": "T19003F12BC4FE4944D869F1335DF7372A9611A44BD0D023F2ACA5513355A3E2A2FECE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678536, "uuid": "9a81de23-6502-429e-8355-bb5bef9b49ef", "value": "768:T82TDcxAgErQpYImJMdxCOIVZQFH8d+W1OA+39xyrzdobnbcuyD7UyQRjN:CAn8yVMdxvyd+WEyrzMnouy8yyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678536, "uuid": "050b5679-ef42-4186-9863-ab1208636f7e", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678536, "uuid": "4404281f-f9bf-4ecb-8b59-9ab80047a19c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678536, "uuid": "b5ab3794-ec5d-4aab-8cc9-604f793d7f24", "value": "d2697d6b0be4dd857a4f1b85155d9266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7d9e13-c088-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706740237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740237, "uuid": "442782b6-c9a7-4a8d-a3ae-7d7d5e2076ba", "comment": "Malware payload", "value": "d7694d9e2e9a138e7ae1fe0b9f2e4762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740237, "uuid": "210ab42f-3076-4981-8865-3b5f08d4ecf1", "comment": "Malware payload", "value": "14ca03ae965b28ec745767381eb7998c82362ba6908b837942c662c50ede7e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740237, "uuid": "39e0c0fe-44ca-47ba-ba45-fc58fa49eb28", "comment": "Malware payload", "value": "5a2effd4dc8ae033aad4590849b2f89a278a071a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740237, "uuid": "0ef9cd80-6cbb-49ee-b982-b2915ea99bf4", "comment": "Malware payload", "value": "332c8ba0251ec04eb82437be4e8eeadabc91daa3f6244bd243e3766d0058038294fca3d0e73dd13f71e3e39d761a672f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740237, "uuid": "662ece1c-198e-4704-839b-082d50039628", "value": "T194449638EF9C7C8BF425643B49A3047B466966C7425382AE70AC2D1CD947B2C7D13E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740237, "uuid": "3e730534-1cd0-4a92-bc10-6a9bb8218aac", "value": "d75fc9503e01888cffdbee3411d98de3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740237, "uuid": "50716fbb-5270-4d42-910f-578dcd0709a6", "value": "3072:fR2Q0yQ/wEjCdrIZ0ptuHhBCEuV7dKzzKmHffj/zT333Lrz0+fr7jPZpvOPkVKbt:fHpO2uBUHWkkvBIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706740237, "uuid": "ee6cbedc-ac94-40b4-9511-c944d6615eb4", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706740237, "uuid": "68ca672a-4cb9-4ce1-b931-4ecc5769df8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740237, "uuid": "1ee4c75c-27e0-4157-8fcf-a7f8fb5b2cbb", "value": "SecuriteInfo.com.Variant.Lazy.196437.3128.5939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefa181d-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717614, "uuid": "11aff778-b39e-4f87-935d-fa41796a9c36", "comment": "Malware payload (Mirai)", "value": "9f75a6c34211daaf9dca9ecae37804b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717614, "uuid": "36c3ace6-f1f0-44b5-b173-ec07eacefa01", "comment": "Malware payload (Mirai)", "value": "157032cb1048d24f61f5d3e4acb7ac2bacfc9122ea6439a2aa647d533d3fdc3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717614, "uuid": "8f34c4bd-24e2-4381-a15d-fb5c967a89a2", "comment": "Malware payload (Mirai)", "value": "92fa7be4dfcd44d128b26906e573c086c3eecc87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717614, "uuid": "14da305c-19dc-4aef-a17d-01b0d3d2dc2e", "comment": "Malware payload (Mirai)", "value": "f08e7f414a121887ed42e78cf394f3cfbb663673ef3e3da6b307da26c92faee5b2b93063586df1c55bf290d81c05c5be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717614, "uuid": "2c5b1168-102d-4e70-98dc-aaca4b24dc72", "value": "T199042A46EA404B13C09627BAFA9F42453323DB58D7EB73059528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717614, "uuid": "9df9a17a-8b58-4c07-918d-90c4e0789763", "value": "3072:lfqksBn0yiKjlzaZAQimt6pbvmA1gG0K+XPSorM/RrXup5A:lfqn0B2NaZAQimtkSAqG0K+fTrM/Ry6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717614, "uuid": "65be2c12-cd0e-4b46-ac46-46c5e7a8ed3e", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717614, "uuid": "3ab64317-1062-4771-bf28-d02cb89ebe05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717614, "uuid": "23554485-095a-4c67-82d3-e639dde9285d", "value": "9f75a6c34211daaf9dca9ecae37804b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd432873-c060-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706723275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723275, "uuid": "3306e377-b0ad-494e-80e1-386eb4dc759e", "comment": "Malware payload", "value": "d093da9bca1b166f723a5028c446be74", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723275, "uuid": "94536887-d096-454a-b9d4-94ca97e82220", "comment": "Malware payload", "value": "15d0696d8fd165f55f0e8a9b30eb302f9554323c02b0cea87e3c3c93a05a3363", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723275, "uuid": "02ebaa17-813e-49cf-adcc-ebd66056e8a5", "comment": "Malware payload", "value": "482f289fa19fa1898f64d662464b86dd9b2547d1", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723275, "uuid": "4e5bec7e-fd07-4fd9-b9e4-c263a4491d99", "comment": "Malware payload", "value": "275c869336ea253992f48121cbb12dedf0021b79d9e732fc43ec8d45e13ac776f5da70fd344d73fc5ea6ee148acbfd04", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723275, "uuid": "12675990-22d3-47ab-a976-dc118f5f28ee", "value": "T1E59633C087F88CCAD36B0D319D5A5089BE67468887004DB7CDA33AAADBD67F52611AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723275, "uuid": "a46c91fb-702e-4d2e-9d86-6068d01ec5a3", "value": "196608:xjMlbvMYOZwF7slanwX1OP6dhILSlaPKL4wjVnusAgzH:xQ1vdFpwYP6DmS39jVnug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706723275, "uuid": "c4c10477-e55f-49dd-9dfd-6941949dc313", "value": 8834946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706723275, "uuid": "912fa71c-9181-4307-93a2-c4905740b66d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723275, "uuid": "8084f2b6-4b73-4c07-8b4b-68d04e5f3953", "value": "15d0696d8fd165f55f0e8a9b30eb302f9554323c02b0cea87e3c3c93a05a3363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6193d058-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699445, "uuid": "5152d680-be0c-4a9e-b3a0-9be3877048ad", "comment": "Malware payload (AgentTesla)", "value": "99fb208f6b120c0c7cb794a8846cf420", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699445, "uuid": "5f481c2b-2e5b-4c25-a0cd-07f313544b00", "comment": "Malware payload (AgentTesla)", "value": "15de6d1a92b4f26a9220a4f8e38d3c774b0f294d311886d23ffd1c99d493d7f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699445, "uuid": "6dc42205-3010-425d-8fa2-da849b1464a3", "comment": "Malware payload (AgentTesla)", "value": "899e0f083f910de04049dfe7c64f4165ce5e4150", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699445, "uuid": "59bd5daa-df3b-41fe-bedf-98c0f531a5b2", "comment": "Malware payload (AgentTesla)", "value": "f5b751ee36472922e49acc2c8e43d87d01341757daa64663e892e1113a4bd0f7c4ac9b4bcf2bd84babecccc1ab7f97f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699445, "uuid": "70c8e171-1647-4d65-94af-46884b09d1d6", "value": "T1C1E4120162F85B23DEFD6BF955E8611897F274336422E7494E9524CB2E63F044EA0B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699445, "uuid": "d608bbc6-acbf-4e04-8a60-385f66be1e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699445, "uuid": "b495998d-5e5d-4669-bb1c-ff1f5ace98ee", "value": "12288:YQB8IAYQ4ZL44rzvZpRDnsadf3Mi5RupBSJ0B5cFsPq9lBCeHXMXi:/2IAscIzfRD7dvMi5RsAJUuFsPezCeqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699445, "uuid": "d524b2fa-1519-433e-9196-15d9453c6888", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699445, "uuid": "be7b180c-dbe1-431f-804c-75993f6a134a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699445, "uuid": "4600f7b2-f0ed-4206-8fb1-a6829d0408b6", "value": "T\u00dcB\u0130TAK SAGE 2024-48559 NUMARALI F\u0130YAT TEKL\u0130F \u0130STE\u011e\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6acb1b6-c044-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706711185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711185, "uuid": "373d7ea6-69dc-49cc-b8e5-f395ee7b2d2b", "comment": "Malware payload", "value": "3f7a80d8e34f1887dda051563e55645c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711185, "uuid": "1aedb477-30db-4fd9-bd1a-ab906c100023", "comment": "Malware payload", "value": "15f22999aba73f952c3adf0827ca20a573b244490714984eb6cefe80cf96c164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711185, "uuid": "98cf5eb8-ccc9-490d-95ba-4094e93bf693", "comment": "Malware payload", "value": "626a2d03950b41add2d131583c1b7490f839a6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711185, "uuid": "d9ac8b5f-08e8-4485-9c9c-4ce02223ee29", "comment": "Malware payload", "value": "4b1544e7aa1af0cd3a6a198188f3f931d15a24fdd510232645579bd4d31af8a9e827bea72085300156b88f462240923e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711185, "uuid": "08953aae-a8b5-4899-9672-ace2caa2b695", "value": "T1A984021056D8CF60C96FBB7E51571800A3FAEE8196A7F75D6FC316980E339808E19B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711185, "uuid": "dff42639-17c8-4a9b-a01c-2b793d5b4335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711185, "uuid": "9d189edd-b699-4f42-8f89-df49290bb29e", "value": "6144:fH02PSUmW2PSUmDfKuOPSCVv9yADq2744zH1M/OP2PSUm:fUhWhrgvgADq2c4z+/sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711185, "uuid": "9078abf3-5d3f-4aff-be12-fcead4b133ae", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711185, "uuid": "f6c34475-6bd2-4454-be06-b6f843d7afca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711185, "uuid": "a109d4ea-ccf7-4429-bd76-b58e1cba36d1", "value": "SecuriteInfo.com.Malware-Cryptor.MSIL.AgentTesla.Heur.10421.24075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672dcc1c-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666383, "uuid": "5e9a0bea-d2df-4c2f-a86c-e9653dd8f4a1", "comment": "Malware payload (Mirai)", "value": "3a1b44b0a7689e335cd06a5f55c3fb9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666383, "uuid": "4ecf9937-4cbc-4d13-9b7d-81b1d4939cbd", "comment": "Malware payload (Mirai)", "value": "16dad61a1d396c69b9ffc2a81282571baba925a13542bf54003593d37e7d72e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666383, "uuid": "24603062-faea-4920-b725-eab5c8995992", "comment": "Malware payload (Mirai)", "value": "9797698041aeb79e4a4b80b968799a5dc06d2f4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666383, "uuid": "af2848c9-aadd-49de-a7a6-2a243713a6f3", "comment": "Malware payload (Mirai)", "value": "1b4a33025fe4c592ef09bc08cd5002ddbb0d4bd6f1204a7aa713d9d656a23b8115ca5d351abf0b300b0e0b2ada5d29ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666383, "uuid": "54ecaf54-d0e8-472f-bba9-a9685a7aa74e", "value": "T19C04A81E6E228F7DF668873147B78E259B6C23D627E1D684D1ACC1101E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666383, "uuid": "864ab97a-2fed-4171-bb34-1c2a7a69bf09", "value": "3072:C+u2H6rkbL7K5wo2AeSg/1T+jDpAhTR0kRTtBsu/:C+u2arkv7K5wo2Ae5Ouhuk1te4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666383, "uuid": "58a3a692-5fef-47f3-99a3-f7397f551053", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666383, "uuid": "050dafe2-2b35-4042-963a-9c0a920afbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666383, "uuid": "bcc67571-0fcc-4599-a4b4-cd6c003447d9", "value": "bulu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a18038d-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699433, "uuid": "dc531b82-97d0-4aa1-8649-16831177b1a8", "comment": "Malware payload (AgentTesla)", "value": "33d891e6ae57fb345e65baf29197c95c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699433, "uuid": "e85f3c13-e0c5-44f1-9814-411d2ef6d3fd", "comment": "Malware payload (AgentTesla)", "value": "170e1af5e1a12cee780b43feee20741951ea23187706a1a104e82c833075cb0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699433, "uuid": "80cf9943-2f6d-4195-9144-93b7c01cc02d", "comment": "Malware payload (AgentTesla)", "value": "d74cc7534302c8843154d0437a7457586de7c79c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699433, "uuid": "2851df17-ce59-4b99-8875-128acc65eb2e", "comment": "Malware payload (AgentTesla)", "value": "58cffe0829465a36477acffb0d4aa55cc712f3641910a3dbbbb1db93a7000a936654785d39aec5d3d55b0e0efc54824a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699433, "uuid": "4336fd42-2514-43c5-bba9-76996a8123e0", "value": "T1D1E4129669F54B16CAFD5BF504A191040BF274239C27E7AD4ED26CCB1A73B810E20B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699433, "uuid": "acb8fa0c-700f-4ddd-928b-982a58e4a7bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699433, "uuid": "357418af-10e2-40b7-9b7d-5f82cec16926", "value": "12288:/AX5IAYQ4P0bgP72/bcDUoFNG7btZXGoNZJplpGgjsmlMfmdRbpoXUUM4MM9JOuk:4pIAx074bse7xYoNLIzm7bkUUwNug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699433, "uuid": "7b0dceb2-50bd-4629-a22a-0c4cbcf5ba37", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699433, "uuid": "0444c30d-7e59-4d0d-a321-b05f57aee677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699433, "uuid": "fd1fafab-edfd-4740-998d-467e905746bf", "value": "Fiyat teklifi Istegi 23070 PER 1000 Adet \u2026scanneed 00101.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a028767f-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699121, "uuid": "f3a748fa-e976-4586-a131-e0fef4eecfd5", "comment": "Malware payload (AgentTesla)", "value": "36001377b9325cc245677d2f32a3d853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699121, "uuid": "beef36f2-33ab-4f19-885c-2f8f02099521", "comment": "Malware payload (AgentTesla)", "value": "1861f353f835f60fdbe8e4b38311085c472980c1b52a700663551a5a42145d3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699121, "uuid": "a0ba3fd4-0963-4acc-a0c5-7a59a819f3a2", "comment": "Malware payload (AgentTesla)", "value": "213787ffd6a4298022a44fb508acbe85eb3c6ae0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699121, "uuid": "422a8e63-610c-4559-85db-bdf3ea162f9a", "comment": "Malware payload (AgentTesla)", "value": "8f966c165b4c16fe9cbacf929774ae5cea8036eecbee52fe93b32ae1064fe426f63ea4b27db429ad5417519cb0cb7d4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699121, "uuid": "2575da1d-d954-4821-a3cd-d1cad1856458", "value": "T143E4120E16BD0B03D9BA4BF4A9B040104FF179276867FB692D8159CF2D7BF508A60A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699121, "uuid": "071888b4-6ea3-4387-b72c-2067c8c3317e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699121, "uuid": "46f6f219-a5a9-435a-95aa-0f7a38755a7f", "value": "12288:6BE6IAYQ4s76WCOYgHg+yI811IOJwHHxP571sWHQ+I2rFf3QAtng8:wbIARRCOpg+yI8nINnxB79PNrg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699121, "uuid": "826ff0a5-e57d-41df-83a6-0f44a993b1df", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699121, "uuid": "01ca551f-8cb5-413b-a941-e0a74dbdf61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699121, "uuid": "86619a3e-8fe7-4371-9a2e-453aaa12d588", "value": "ERA 6210 FFFP2 V NR D [BASERTELEKOM SAN .].bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb63cf3-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706713399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713399, "uuid": "a82fe8b2-9f51-42e7-977e-66ee5ba8d1e2", "comment": "Malware payload (AgentTesla)", "value": "7c20979d0a1878813ec4f062f8e1cfa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713399, "uuid": "d0edc465-3b9f-4049-97c3-c9d5ab85b00b", "comment": "Malware payload (AgentTesla)", "value": "18ac96e96cc73915037fba65ae3191c953c51485b4851a38de3cff90745530c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713399, "uuid": "1df7a787-40fc-4671-9a7d-f1dfc5cd102d", "comment": "Malware payload (AgentTesla)", "value": "4802b36c2a45e8bb841dc8b38648dd2e92b60528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713399, "uuid": "281d9f47-6dad-4f54-8fb6-cf08f1dfba0a", "comment": "Malware payload (AgentTesla)", "value": "fb115e6ae85b01980e738395b9f39374a709bde88fcbd33e365348f3aa4bc028c1c57ea3aeb94f079dfa3eabd727a185", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713399, "uuid": "9da9f750-8894-4c9c-9431-8ba0e5347d4c", "value": "T133359C0E7391803EFEAAD173DB66B23146BC6C24713385EF12983D79AD7C1B1162D662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713399, "uuid": "f59a1224-7a80-4900-805e-41088a32c8fa", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713399, "uuid": "83f10d79-4946-4af7-a31e-d8e552daf092", "value": "24576:2AHnh+eWsN3skA4RV1Hom2KXMmHakt9e+95/swSKOhG/5:Rh+ZkldoPK8YakTe+nEwS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713399, "uuid": "5eecf7c9-8bc0-41a0-aedd-a02363ecc1bf", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713399, "uuid": "c10201e7-8d1a-419f-b9cf-56621dd25c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713399, "uuid": "06a05a71-897f-485e-82ef-563e074704c7", "value": "ND689868900R-576T7367897T.XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f67a4b-c048-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706712737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712737, "uuid": "b8980573-7358-4d0f-a0b3-79c4ec8674b1", "comment": "Malware payload (AgentTesla)", "value": "cd0e01db0073bb79d7db8adb762e945b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712737, "uuid": "7c7b6b69-7b38-44ca-aed0-1abc8a8953f2", "comment": "Malware payload (AgentTesla)", "value": "1994ca93abdb13e25fecc514dd06ae7853525f8495e006dedbad9972dd27955e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712737, "uuid": "6bf0e683-4a24-4a02-8720-0d2a49cf4f6d", "comment": "Malware payload (AgentTesla)", "value": "478551df415fbe0714a059055b7eb2f667500b4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712737, "uuid": "3a6be18b-859f-45c5-97ca-e13497d64355", "comment": "Malware payload (AgentTesla)", "value": "44903d82ae31d6d9fb5e0f278e17e371b0117f71730c056388d936e1dca0adf4090f8105120d7a3ad46b471b43b5a014", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712737, "uuid": "3a1daa2c-4065-4a3a-b52b-824c10eee47f", "value": "T153F3D51FBB6689B2C38A173AC6D7168C0372F7957293E609398F13E65A033E79D42507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712737, "uuid": "c182697d-cb49-4d71-8986-9ee85fb76de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712737, "uuid": "47b1789f-2905-485a-ad73-53af8132208b", "value": "1536:mpFdZhrKMG9+iPhmq8N25s+L/c6z3G6y6Qc1nqXy370YsNat3Jn5hUNNS19XZ:w3PrKMGAi0fNU1z3HZqX0La4Jt1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706712737, "uuid": "bca021c2-b8d0-46a6-a1b9-f14620f013ff", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706712737, "uuid": "4b6223a9-adf0-4fea-b4bf-6b57bef53c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712737, "uuid": "77d2e794-a422-432b-b0b5-20cb8b7ded8c", "value": "Amended Purchase Orders_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b004d86-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706696911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696911, "uuid": "efae9596-7cde-4593-9854-efb8f0af4c78", "comment": "Malware payload", "value": "f4959e947cee62a3fa34d9c191dd9351", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696911, "uuid": "a9a101dd-3372-4efc-8604-b7745f0bc3c9", "comment": "Malware payload", "value": "1a7bb878c826fe0ca9a0677ed072ee9a57a228a09ee02b3c5bd00f54f354930f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696911, "uuid": "3b7d15a8-3363-4f97-91c0-739ee6754917", "comment": "Malware payload", "value": "517974f980309d978e731a135fc4bf6450e446f1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696911, "uuid": "b1ee6761-759b-40c8-b10d-bac82b0c40c7", "comment": "Malware payload", "value": "93460c51439e9900d16ba793303ce0ee922a6b3666386d640c73fdef04dad6cdc65c0aef66e9d1d4c06f83fe4fd80a79", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696911, "uuid": "b0169198-48a7-4a14-9bf9-b7c117d51c3e", "value": "T19344AE17F66DB1E8E176E234A9820A15B7717C3107789BBF079047261F63AD0BE3AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696911, "uuid": "15165fd9-27e6-4039-9f1c-7b791bfafc86", "value": "48b74a60787e54387294ac125b7ed128", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696911, "uuid": "ea8ded5b-1518-4154-be7a-08e63e00f164", "value": "6144:VvWsAv0ek4hGWZJ12yu8r9TyXaCjHa3VYc:VvW98YhGWZPxu8r9TtMHYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696911, "uuid": "b592138e-43c8-42dc-9e18-8d21ee202076", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696911, "uuid": "3cfe8d3e-fe17-4381-b4f6-39f979a03eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696911, "uuid": "1aae2645-fc53-410e-abd8-875aebc1feb2", "value": "FinanSM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309e9d4f-c047-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706712248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712248, "uuid": "48c1a193-4ec3-45fb-8ce4-4b5cc772950b", "comment": "Malware payload (GuLoader)", "value": "7dfd8643db03575d693bc1b869db804d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712248, "uuid": "f787759a-4488-473c-b84a-8d00f49485bb", "comment": "Malware payload (GuLoader)", "value": "1afa97a4a2c1d6bae74b4b76298b85de076a084bcee539b9503a3d4bd1d13016", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712248, "uuid": "c2d60344-6734-401e-a204-aacb021e92a1", "comment": "Malware payload (GuLoader)", "value": "f4ac1dba10c97ea3d73ca06655bb59d12b6dda90", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712248, "uuid": "6c053de0-b3cf-4a96-bf35-22878cb478bc", "comment": "Malware payload (GuLoader)", "value": "5d0bcc94e8d9ef49bc732d7ac270e1e4da5bc1022a8650c0b2f2b176656cb140ba5875897bc2660e7c279486fa33c821", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712248, "uuid": "6b3a2de7-3628-438a-b153-2bc53e2dae73", "value": "T177D264754942560525CA51F2E00CC83EE8572FAE953094632D1FF7743EEB3902A7E6F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712248, "uuid": "53b60c31-43bb-41c2-a933-a1bdf32b1c0f", "value": "384:4TFS6TUL9BSzLsMUNQZK235QSKpZZnvggiQi1PLltwGRKCst:4Tg6T09B48NQZV35gyQipLlzRKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706712248, "uuid": "209405b5-3dd1-4e96-9dfe-90254ad8baf9", "value": 28346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706712248, "uuid": "f33ffa1a-63e9-4558-ae76-3a1b36794591", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712248, "uuid": "1149a674-7eaa-46cb-b7d0-f3c2bde06c3c", "value": "1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8565e02d-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678460, "uuid": "28f254b2-eeac-4fd7-9018-5ca46ae01330", "comment": "Malware payload (Mirai)", "value": "78b2c57b7dda404d1900366c778d4bf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678460, "uuid": "588d8ab4-07a6-48f7-8178-c893d09880db", "comment": "Malware payload (Mirai)", "value": "1b18d12cc52f0e60c90b212b0ca3c75d72f7cc900f5a8ef448409cfda8920a15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678460, "uuid": "c632161b-173f-4a03-9633-c39d990f3381", "comment": "Malware payload (Mirai)", "value": "eb73b13fc5bd126d4ca89bcdd0d82073ded9b294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678460, "uuid": "db838903-1c86-4f66-9805-13cdfd94c669", "comment": "Malware payload (Mirai)", "value": "eabfb5544c8e851f0a28ff1e61b0e3540b47bb6e0ef32cf2298372faa16397ed675142d3efff9a608f03b32a5e348a45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678460, "uuid": "934a3362-8d07-40f4-8466-f65bf3891785", "value": "T1C7B35A73DC256F58C560D070B0A59F796BA396A142872FBE5876C2708883C8EF645FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678460, "uuid": "457679bf-f677-4ffa-8bbe-0d4206b32e4e", "value": "1536:qjgGZSqcq/CIKA7Cha3K0HPLZAWGlB0LpKxfaAsm5hPL:Mqq/uAJK0H9AWkyKxfavm5hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678460, "uuid": "a9072273-a4ac-4389-b6ef-fd07e2c7618c", "value": 113952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678460, "uuid": "2b1ba0bd-4d95-457b-9e5f-ae69cc67ea6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678460, "uuid": "572814c3-c138-4929-a3af-18cdd4e92ee0", "value": "78b2c57b7dda404d1900366c778d4bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634234b6-c06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1706729083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729083, "uuid": "25e3fad4-f1ea-4d6c-a987-653a9dd9bb15", "comment": "Malware payload (Cobalt Strike)", "value": "170e2c01d82e74c7fc757bc7e076d53a", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729083, "uuid": "6df326db-bd21-478b-8d47-27e1e5b7d0da", "comment": "Malware payload (Cobalt Strike)", "value": "1d136f734995c03543a9eae5a47f88c9e8f20096d783e6bf4fd3b220aa5b4293", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729083, "uuid": "bd902a92-ac02-4ca5-b4ba-8c01b53a3204", "comment": "Malware payload (Cobalt Strike)", "value": "7fd4aaa3f81891335daeed1f3e66bc4c02335ab3", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729083, "uuid": "995f0320-cfda-4177-8a93-63b569d57600", "comment": "Malware payload (Cobalt Strike)", "value": "8495e94341eaaf25ce8465f6e8cc24f2f3d79d9e98976fd6e1472ed71d7d1968c5d25c3d436315f956107c1fd8a2eea3", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729083, "uuid": "e9e45406-fa0c-4ae3-bc18-aa0297442838", "value": "T191762324E6928E7DDE175AFDA04E45EBAA6F9DE313C5003327F095D1CAA42D0841FE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729083, "uuid": "e2ea17fd-bb7d-4687-9b00-50679f8a2915", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729083, "uuid": "9bc338fd-1261-4d32-8d91-361f2297e070", "value": "98304:DwIm3vc0p5at/7rTM9n8fl/tIi5A/K83k3fYChTkxAPljwl5ShlnAb3u7lu3:DxWvtC9TM90tFYk3XPljwlIhmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706729083, "uuid": "825386f5-2d41-4510-93c6-0ce9130f1db6", "value": 7260624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706729083, "uuid": "6e274ea7-42f5-4866-b936-afffe31d4fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729083, "uuid": "2b366a43-38cc-4cdf-ae4a-e6da0b3304fc", "value": "SecuriteInfo.com.Trojan.Siggen21.29401.2729.27835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3d3f39-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666362, "uuid": "f367b4e8-c47b-43c1-b5a9-66aebdfdec62", "comment": "Malware payload (Mirai)", "value": "5f4dff32f217aeb125ae48af8daf8435", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666362, "uuid": "4e8a96d7-c69e-47cf-8034-d567f27cabdf", "comment": "Malware payload (Mirai)", "value": "1d6fdbd4e1312c3cceeeb4b13f9e60fbc6d11d02055ae8860601543393fd2d45", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666362, "uuid": "92e1e6e7-9f4d-4752-9d2b-3b30f17b454b", "comment": "Malware payload (Mirai)", "value": "e28835857594c84399571621cbc9b101461148e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666362, "uuid": "f081484f-8aca-4bf9-8d6b-f4665ed343e6", "comment": "Malware payload (Mirai)", "value": "7e475bf37826af3dfe6227ceff4884949639ab7a7ebe3db67a2f5b9f8731ecc31942a6947955af0a81feefc15b518509", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666362, "uuid": "791b1ccc-8727-44a2-831f-c8c954dab989", "value": "T18EE33A07B4C180FDC4DAC1744B9EA53ADD32F4AD1238B26B27D4AE222E8DE315F5DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666362, "uuid": "30e1ace7-dd56-4878-8846-8a8c731f9db6", "value": "3072:1X2c5i+V0uPOAldHcKAOu6epIL3Naogsrw/Sly97kg3j2:1mc5i+V0uPOAMOtNh2Qu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666362, "uuid": "f420386d-0deb-40ab-bde8-0a1d2feffa58", "value": 143832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666362, "uuid": "10d3ef0f-b750-474e-9ca5-b149747d5fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666362, "uuid": "2ec4e3c2-7ffd-4797-92af-2d6f7642e23b", "value": "bulu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43886f54-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1706697247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697247, "uuid": "bfd9c617-066d-418d-8fb4-f2138b263176", "comment": "Malware payload (zgRAT)", "value": "faff4b61432c892dddbb4bd562056f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697247, "uuid": "7bdd9f5a-2f75-4405-94d5-62ab22af1972", "comment": "Malware payload (zgRAT)", "value": "1d916ddfc50ccf11e01c694f757c39eac4249222c2ebaddea2dfe9f58fac70f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697247, "uuid": "08b79733-4c79-4359-8907-3564c825fab0", "comment": "Malware payload (zgRAT)", "value": "82132fee18481efe5bb33ccbfe5c0e25036f13aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697247, "uuid": "441db1c1-e1fe-4ce1-abc0-fef63b1555ac", "comment": "Malware payload (zgRAT)", "value": "2fd3c77395cedf4616f0356f9febd76f7c9654a51c31aef5b6ac906614f2103c32d273e4d6e70bb7a7503b59db441d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697247, "uuid": "346ce8ac-a53f-4a70-a345-282a6c810ec3", "value": "T1C485015263924AA2C7A46735D6A75B000761FA73A1B3C30767CA62E914073FF9FA1F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697247, "uuid": "3baf5c28-6a45-421d-8e08-709edde2aaf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697247, "uuid": "c41966b1-b3d5-43ba-89bf-c977e6518679", "value": "49152:4jF93LkcJ4O4hqgg9ma/Q7mrQOSF61A9mb9:4jn3fNmAQ7oCEmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697247, "uuid": "dfce8f74-e4c1-446f-a922-83ec640b779e", "value": 1754168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697247, "uuid": "05de228e-2e29-4514-b1d7-7080391c62c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697247, "uuid": "9976039d-1b3c-403c-a863-a3e5e8156891", "value": "faff4b61432c892dddbb4bd562056f19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11fa645-c065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706725349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725349, "uuid": "8fc69547-c662-4e00-88b1-656c0d8f35b8", "comment": "Malware payload (Mirai)", "value": "35820bf0429b77008c473b71e0e8b960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725349, "uuid": "9e011e83-8dca-4c94-9719-8548c35b6c02", "comment": "Malware payload (Mirai)", "value": "1e1f129ce38039ac30123a6444309c2e4ca339417a332e0f660002f19f5c00e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725349, "uuid": "deb4158e-863c-484a-b0e6-d7a350bec6fb", "comment": "Malware payload (Mirai)", "value": "6885408242375d5b72afcfc7e6ed3b3a76b76f32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725349, "uuid": "45ca9857-aad2-45e0-9749-25ecabce914e", "comment": "Malware payload (Mirai)", "value": "b552d584f01e203a9b971a636b7afcee730925df01850a2cac6298887c57d9ba0ae7147579c5a0a1f60ed62c6a4d9fd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725349, "uuid": "23012c5c-63f0-47fd-9e40-62d11f488401", "value": "T1C9D2D0BDE3641610CCAD89BD168E6BF36D60660673CBDFDCB20408899738598F40E5B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725349, "uuid": "e3514bfa-ba9b-4a5c-8edc-6f42d7166ae5", "value": "768:xpP5brCsdTo93dUxCq+/K+5NWEAlfXmQydo4NJcYW3:xpP1JWddm+/wV2Qyq4Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725349, "uuid": "73870c92-b39d-4f0b-9056-02639768142a", "value": 30672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725349, "uuid": "16259fab-507a-49f5-8cba-7d8e4495e1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725349, "uuid": "3772f869-6255-47a7-bd0a-883d02265798", "value": "SecuriteInfo.com.Linux.Siggen.9999.370.4487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1f4a60-bfe2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706668974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668974, "uuid": "7a587431-f95e-4539-9595-94e6748b0167", "comment": "Malware payload (Mirai)", "value": "eceb98b8bae71f4c823747b2f9f91225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668974, "uuid": "ab27afe7-93b3-4226-b651-f2f8c73f474e", "comment": "Malware payload (Mirai)", "value": "1e998160b02170476c4aab47bae858cb17e09ab8aef7b3d75b5a790150960eca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668974, "uuid": "a15b1de7-ea8c-475d-a699-92f9589abe8a", "comment": "Malware payload (Mirai)", "value": "a40dde90fc42434189f61886a5c6b3c5983b2f30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668974, "uuid": "fbdb58d2-ca01-4960-9a6f-b33a5d74df24", "comment": "Malware payload (Mirai)", "value": "2dbf74e160b848eaf5e7ca2afb921e6cb142872878e74214c972f3533691003981f5e81937bc6b3a5ad6185e7e4ef1db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668974, "uuid": "ba6a2443-bf7e-4dfd-9190-ec0f59490563", "value": "T14EC35C73D8256F68D694D1B0F0B0CF795B53A99182872FBA19B7C2B44043D8DF905BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668974, "uuid": "16786dd2-292f-48e5-80a9-2a96642cf36b", "value": "1536:masMr93/un9t47UQ+Dg0+UNECuKp68A7q6qYfwBWfnEeToqOkXB8h:mrG3YWL0+TIpz6qvBW/EeKkXB8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706668974, "uuid": "43e8370b-6469-46f2-881e-20d15ede0073", "value": 120736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706668974, "uuid": "b00f429a-68d6-4615-aac8-f06d36acdef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668974, "uuid": "590e783d-2084-43bb-af05-37e063b0f1eb", "value": "eceb98b8bae71f4c823747b2f9f91225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fb5c59-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698782, "uuid": "df957799-fc89-4a32-b321-c20e33aaac7a", "comment": "Malware payload (AgentTesla)", "value": "9c29cc254e7cb52c616ba1948f3bbefe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698782, "uuid": "4c0777d0-d862-476d-bee3-acd29d4b14af", "comment": "Malware payload (AgentTesla)", "value": "1ee9a8d3cde839b4bf0b42162e6118eed4e1f6421f91665b50e6ba03fa278480", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698782, "uuid": "29959429-b5b3-41da-9a86-9fb1970c6465", "comment": "Malware payload (AgentTesla)", "value": "3af21fa9ff2604eb9ed80f2787c208315dd1b953", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698782, "uuid": "b07b25c1-1383-4554-bc7c-e6e51daa63db", "comment": "Malware payload (AgentTesla)", "value": "da131a4a591c552dad360a60b4b159473c8557895f813df90dfc0897516669ce1a04b6368798875a30ae1680e7809b88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698782, "uuid": "cdb0bead-3c92-41c6-8ac3-3e9db00f76e0", "value": "T184C402289A749F12F93C0FF621B4AD51E3F222972516D7B95CD920C52BB3F250B40EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698782, "uuid": "98f815c6-440d-4a1c-a606-4ff6e8f94400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698782, "uuid": "07a24ff1-25ba-454c-9a5c-d846627f3ceb", "value": "12288:zA+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:zfa6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698782, "uuid": "5479262b-9406-45a2-ae63-fe042cac69f0", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698782, "uuid": "fe84f08b-d37e-4185-9719-dc131fcf65a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698782, "uuid": "a1358821-2cb9-4dee-baa1-e192e82dfbc5", "value": "PO96545700009.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620fa726-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666375, "uuid": "3393d51e-de77-4daf-9533-0bf177eb007f", "comment": "Malware payload (Mirai)", "value": "1c0da5ba2dea3468adcd609c2b234bca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666375, "uuid": "42d3d450-203d-44fb-a9b3-028e51b32811", "comment": "Malware payload (Mirai)", "value": "205d627237c39610312c22f28cf5408a79b19b67fb5df8693e84120c035084ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666375, "uuid": "749555a1-603a-4cff-8063-01b624ae9897", "comment": "Malware payload (Mirai)", "value": "59988e1f2b5eaf57c99655aedd7661e9c60f85cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666375, "uuid": "0e3a0d6f-fc69-4973-890d-cb6551bdb8b2", "comment": "Malware payload (Mirai)", "value": "de93cd9ad62582c9ceddaffc6a1ab2089c03bb35d4fe302c6d7a0a50614df84486707a607913d6d071678edcad4310d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666375, "uuid": "28459abd-fc92-454e-9831-0dafa5e3ed52", "value": "T1EA04E816AB510FBBDCABDD3706ED0B0139CCA55722A43B363674D628F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666375, "uuid": "7d1fdd1f-0960-4eac-935e-fd1523bae300", "value": "3072:xriHzvHbPx1GboNGCc4s4wKRcGgG4BRguc:xUzjPjGKS4zwHBhXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666375, "uuid": "36721f88-6bca-4522-ae10-2447dacb4045", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666375, "uuid": "a9043e73-d487-454f-81f4-d72c237e462a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666375, "uuid": "e83c26f5-059f-435b-a744-6ad1ecd75858", "value": "bulu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0314f1-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699225, "uuid": "6946ef94-6173-4862-8849-c791db621221", "comment": "Malware payload (AgentTesla)", "value": "8379bd2f50f7fc865cb0c1a0cbe521b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699225, "uuid": "3e53a50c-68b7-491c-b6ef-a92e660dc70d", "comment": "Malware payload (AgentTesla)", "value": "2080e3bdf4a4fa1d7992191194641201cad947bd6fb9905792d600789be4e1c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699225, "uuid": "dac35aa8-3d10-48ee-9864-afed28322b34", "comment": "Malware payload (AgentTesla)", "value": "ee3ddb477c4a5d0442bdbdf3a609618e7750b891", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699225, "uuid": "5697f253-3cb8-4d22-8c51-a9ad03878460", "comment": "Malware payload (AgentTesla)", "value": "bcab9c33465dce41ce678fc7458bf6c523b277dae41ad35b608d39b5e6c243f062c6d48ac175e3d28a3c12b83253b04e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699225, "uuid": "66106e34-bfb1-4c86-82ab-b65838dae6c3", "value": "T143358B4FE39280BDFEEA9D73DB55B2C556BC68E40123852E16D81968E8F00F1233D667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699225, "uuid": "c93a9b87-516a-4b2e-af94-baab7ae18e38", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699225, "uuid": "e9d438ea-ef3e-454b-8990-2529179fe224", "value": "24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaTStpRd9e5:8h+ZkldoPK8YaTStp7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699225, "uuid": "648c32f5-737d-4a4b-b645-a883ca77bb7e", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699225, "uuid": "72224316-3ee6-484e-a585-fa96559f283f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699225, "uuid": "de350740-0725-4412-b800-52b6d6ff79c5", "value": "DHL_confirmaci\u00f3n de direcci\u00f3n de entrega DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c8b9df-c072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706730920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706730920, "uuid": "453cbf23-ae09-4900-9803-418588b8b5d8", "comment": "Malware payload (DCRat)", "value": "4f9f159cf4ee9fdd10d3ee029137449f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706730920, "uuid": "a0a739cd-11c1-42c4-af0b-d0aaed87827f", "comment": "Malware payload (DCRat)", "value": "20ea4bd44c356f2d3ca1c678394fd0eea380c1115f98e0d981b81e74d1bd9946", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706730920, "uuid": "80319b7c-2cd5-4a69-a37b-6906f592360b", "comment": "Malware payload (DCRat)", "value": "e5518e221a96927de4aa9712524244544da09f04", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706730920, "uuid": "e4632693-f1e5-4c0a-b23b-317561faa3e7", "comment": "Malware payload (DCRat)", "value": "5971f21de7c9ac58958d394cd23d4a2467aa7e4378dedee1557887a629237c53ae11f2e5fa8770b5e20306233e44234f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706730920, "uuid": "643e352e-4404-4261-a464-0914e893f320", "value": "T185363304CDD30D3AC85CA27C5867DBD43790EFA90B4B171768D5AD7BBE372022E96A60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706730920, "uuid": "e2d022b8-07ac-4e4c-86b0-63919feb5dff", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706730920, "uuid": "b5fb6445-56fa-4b52-ade1-580312b9ae10", "value": "98304:k9Pu7pUQpNJC/c4tjKYMwbt7re7pXWtW6mXvFAoWhdrj4couHGqE65Be:kvQpNQDM+teNXW07Xv6oAhj4couHUqBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706730920, "uuid": "b9f64af9-d13a-4add-a03d-7d4b2fabdbd3", "value": 5070848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706730920, "uuid": "75c566a2-3c13-490c-bbc1-20e4c1645f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706730920, "uuid": "fc8dd2f0-7565-46b0-a277-a20953ee92bb", "value": "4F9F159CF4EE9FDD10D3EE029137449F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efa195e-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706686019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686019, "uuid": "dfef9138-c966-4126-a3a1-d081252ac044", "comment": "Malware payload (Formbook)", "value": "7d49ce109a7d61ffc3361c4e7719134e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686019, "uuid": "d246a3f5-46f8-4849-9757-c555eda522cb", "comment": "Malware payload (Formbook)", "value": "228e76e661fd3e328fa59d865345df6089a228cd81df4a519aa94c620edad4fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686019, "uuid": "19a4f0b7-b009-4bec-a1f2-e69e3fd76152", "comment": "Malware payload (Formbook)", "value": "8794104745971fda5e3f562718132d073a3816d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686019, "uuid": "a7210b09-5c3d-4ac5-8a26-c9ca08bd3ddc", "comment": "Malware payload (Formbook)", "value": "4d205029e28100cd534250712fadfd4c80e69bfc1a5c5b396d5d7e2afbcd3058222f4322f1302cb60c2d985f3c126dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686019, "uuid": "49abc5e6-e381-469c-9396-5664d3c316c8", "value": "T159E423806AB9D379E2A92B7B6404418107F6F5DB7425C7067E45B0CF3EB3B960792F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686019, "uuid": "89c35f04-2ef6-4513-959d-a1061ce2dbce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686019, "uuid": "439f6ed9-67a5-45b7-9d8f-5c3aa6a5b0e5", "value": "12288:elhlfu8liC5utKhr8j8qshDSKbbNdy8GLIwqFNHMZYj3fvkjcPMOvdWfrC/TA3p0:VKhr8bshhbbNdyxIz5mykjcEaAMAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686019, "uuid": "a4d6a0a0-f7cf-43a3-98f2-049103dc1879", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686019, "uuid": "42f7e1b1-2698-450e-994f-e74162b3dee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686019, "uuid": "21e01a32-de59-4ea4-a2bf-e16867906dfc", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29443.22875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370fd6a8-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1706699374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699374, "uuid": "c67202b4-4d53-483b-9b48-e5c0f685515c", "comment": "Malware payload (DarkCloud)", "value": "07ecf716a8c177510d8bbb67c9023589", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699374, "uuid": "febd0e79-f8d6-459e-b484-e956dedcbda1", "comment": "Malware payload (DarkCloud)", "value": "22b5dce4881004cd5491a450ccd459dc4790f28e8dfd9765e040b51003cccab8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699374, "uuid": "4affbc30-59ae-44e1-9fdc-b31d33714bc3", "comment": "Malware payload (DarkCloud)", "value": "ff8623958dbacdbd2d370e34b91d55823906b0e1", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699374, "uuid": "dacbac70-cf9e-472d-b334-447782e84c00", "comment": "Malware payload (DarkCloud)", "value": "7cf6d6d9c11ac3e7e6f718b2d721b3ded19dfe7cb29fd65f770bf2f4d9c6d554c4b5ee390caf1fd3c732fef30dea8bcc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699374, "uuid": "18d19df5-ebab-4605-9d11-0418ea9d68dd", "value": "T1D515220036A8056BCA7C43B8DE6682DD07B2AF017D56D3DF6EC9348E52F278647A2717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699374, "uuid": "6fe3b935-ba99-4d37-8ff9-49f2dd603079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699374, "uuid": "14acbc4b-0be2-45ff-bc12-d90d8d887379", "value": "12288:pjgO9SCF1OevUUGQv0R4jesqzAOzS7EPoHWj9cy1eMX9ECcCVu5brNKtqFJ/hkaC:xgO9ZzvzKLAkDA2xcyB9uJGG/hWuzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699374, "uuid": "e4ca5ff3-bf50-4b81-a539-2a816bfa7c7e", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699374, "uuid": "170ccba4-fd94-4a7d-a666-4beba0baf519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699374, "uuid": "78cd4e6d-9faa-42ef-af49-dd55833bab8d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659ede7c-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StrelaStealer)", "timestamp": 1706715773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715773, "uuid": "b0a0fd6d-59c7-4f6d-ac50-8f3d2fde0806", "comment": "Malware payload (StrelaStealer)", "value": "6a6c6d9614e572fedbfb8d2eb108bb42", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715773, "uuid": "8594c7ae-c444-4aea-9772-53215cd7a913", "comment": "Malware payload (StrelaStealer)", "value": "23107ced99838695bf4391c1271bafce47fad96e95b28f52df0a060038f80a7b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715773, "uuid": "f1009489-0213-4e15-a79c-3193e681219f", "comment": "Malware payload (StrelaStealer)", "value": "347b37c4eb1c9d6f6d18d7ec13291436b43bab79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715773, "uuid": "24070fb4-98e1-4944-ab34-aff5086c6f70", "comment": "Malware payload (StrelaStealer)", "value": "c762bacf77fe3fe1fb747a65aa5e9f3f6505e987684ee2ae5d73f2a7990a3108996c5cd0614d86a6301cf8a255019b41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715773, "uuid": "3fb2c187-5089-48ae-922a-66fee642c812", "value": "T16C651AF476E077D30FB5690D73CE41B23D64B857F4EDAD86228D0E1E928034999BADA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715773, "uuid": "b09317ed-5f87-44fc-b23d-ffa94172bc78", "value": "24576:68+ynjkFpqZ5YszaGTWeo2a2QQrcuCUw2eQBJeOsvWthPVtd9qu2X+DlvCu0903s:aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715773, "uuid": "e2781109-a494-44b9-a117-0f08d4353d67", "value": 1448447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715773, "uuid": "23ec18ee-17af-4757-8f99-a9b28b4b8fed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715773, "uuid": "d856d5ca-20d3-452f-a674-579d2e1d218a", "value": "28836_2593959416481.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a8d32a-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706660507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660507, "uuid": "d4b38e44-bf0d-4f40-a95c-9506e8367140", "comment": "Malware payload (Mirai)", "value": "88a5592ad5cfeefd09378886647754ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660507, "uuid": "012f2f8c-c7f0-4284-bce2-c2f984370346", "comment": "Malware payload (Mirai)", "value": "235754d63f18d4cee3aa71bcaa95c8681bd2e73463125e719089e75fd2974278", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660507, "uuid": "8eb7763b-eb55-4f9a-b5b8-877f4987d2ff", "comment": "Malware payload (Mirai)", "value": "e22ed4a488769b051ba157759f730ad25bf33de2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660507, "uuid": "9cf1ba81-b4ed-42ed-a59f-582b51749a29", "comment": "Malware payload (Mirai)", "value": "211adef543556baf646be4ac229a2b0d9a2369b3b5ab6b005ac939b291ec216ac1c2dede3e450042882811874342df66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660507, "uuid": "c5658887-c27e-48f5-84ba-06120bb141e6", "value": "T1B223028B17D064EED6317277D5CCB30F20162BB905D8618A78EDD56CE8E2922BDA7902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660507, "uuid": "e08c8bb5-077f-4595-9ebf-d56176b0c7c5", "value": "768:K61kz7xPPOb3L5taJaadQ98CfpA6ITY2QQeKUfIqTgycriWsD0msxOBY3UQwAT:KrxeDLHPAQp3ITsQeKUlbc/I0mw9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660507, "uuid": "5ff11b47-01c0-4ae7-8262-3b11a6583a5a", "value": 46048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660507, "uuid": "1390c620-e566-4e61-9be8-d7676f3950b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660507, "uuid": "dd1a6468-8b5e-41c5-be3b-1be189f7baf4", "value": "88a5592ad5cfeefd09378886647754ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a525921c-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699129, "uuid": "789899a7-c671-42dd-ae48-99822a4f4cd2", "comment": "Malware payload (AgentTesla)", "value": "331d3af3e1162e789397a9893c0a0297", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699129, "uuid": "e1edfd5f-0298-4408-9a88-32135f446a75", "comment": "Malware payload (AgentTesla)", "value": "2387723e22b1d6b5abaf9393af92c6d1ebcd3f7e1c94496d668358179987f6ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699129, "uuid": "510e67cc-da35-44b4-a371-6c13ca42dfd3", "comment": "Malware payload (AgentTesla)", "value": "9eb701a49470bb50a16ef1d4e425363cbc65cb15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699129, "uuid": "7cc420a5-86ac-4332-a369-f26c171a7a1b", "comment": "Malware payload (AgentTesla)", "value": "1fbbd9c1652372d5144d864d2441d406139c5f8d4cb8d1daa92e2b61cabf9a07b51a0dba5de4754b49625f1a6987c673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699129, "uuid": "e3bcec17-dece-4aa0-bf11-edf969d0b7a5", "value": "T16DE4224477BD8B17C2BA6BFE6866400447F33A936405E35C4E87B4CB272BF4189A1B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699129, "uuid": "81ebcce3-10b2-4eb8-9985-a25dd73fcdff", "value": "12288:aTMS5USHsVe3vEDzyV1NcWNJ02XnwkbNd+rAmZuUVXlPxOKnPze8Nu7/jjMeqacB:/SVMKvED83cuXnzE2wD1FQ7/Meq+/Pt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699129, "uuid": "b595db00-ae88-467f-9687-9d251e0a0c87", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699129, "uuid": "2d5cc981-bdbd-49d7-b2c9-de97fc618ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699129, "uuid": "45a728bb-1378-408a-8ecb-b30df3ba25a3", "value": "000-2378.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c40cb6-c019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706692716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692716, "uuid": "3d41fb4d-5ef0-408f-a464-b771d65acb8d", "comment": "Malware payload (DBatLoader)", "value": "e4ab02dcf80e787ecd2d89f944a46302", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692716, "uuid": "efe85860-843d-4665-b481-58fc25f8e907", "comment": "Malware payload (DBatLoader)", "value": "247651952206bffc368b644214c80166d0e647192de7cd1001b524160ca6bcf8", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692716, "uuid": "f5aa364a-2e90-4148-9cf0-f17b010b0b22", "comment": "Malware payload (DBatLoader)", "value": "3d2b1956669bfd9e05696738987f585c8387cf88", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692716, "uuid": "0184a6ff-36a8-4c37-add6-f600518b9274", "comment": "Malware payload (DBatLoader)", "value": "220a325d3be97e4c9bd42eea30e65711e08c527339b3a566ce7bfae2f3417568b7b081b5d5783ce8005e0f832572126e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692716, "uuid": "8a7e4d45-8dbf-43fe-bb1d-702ef39c0950", "value": "T17AA5DF22A6D15832F122A5795A977BB4E92DBD202C367DD676D43C087F333007F246AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692716, "uuid": "eeb11873-888d-46ca-b726-85118c210930", "value": "49152:1qAodhXjnxf2hd7c7mvrq0gOPYaF5P0R:1qAo2hd7Ymu0gOpuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706692716, "uuid": "b6930c39-5fdd-43c0-9c92-4f6df199279a", "value": 2099200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706692716, "uuid": "6c60b28c-0587-4f70-9118-a9aaa212a289", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692716, "uuid": "9baae1eb-3537-4a88-ba8c-562800d84330", "value": "INVOICE.XLS..tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0269020-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697940, "uuid": "82eadbf7-680a-482c-828e-00f7e0fca9ac", "comment": "Malware payload (RemcosRAT)", "value": "e8d8e95f9cfb68e93f56d1b92edab475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697940, "uuid": "133eeb83-7eac-4be5-80b9-93d5773a2037", "comment": "Malware payload (RemcosRAT)", "value": "26aef2d6e3ee8e83977b783b991fe4a56a5c3196ca14fc9efbc66591b9746604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697940, "uuid": "fdb2f1f2-8053-4d81-909b-9317255c3c8e", "comment": "Malware payload (RemcosRAT)", "value": "5f2756cb46ef0a21ae870ec82a84ec030f5aeed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697940, "uuid": "5d09d5d4-64d0-453d-a384-defda62b9717", "comment": "Malware payload (RemcosRAT)", "value": "71c414d527ce67a8580857655bed7f589b80feb8203a6b56f924e13f9888bb9f9a5b146ce75b1e05a1c0e18a23b60de7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697940, "uuid": "f9772148-a924-4559-ab8b-128c4a51a8e8", "value": "T1A985BF2275E5442EF222B47917977B6DF81D6A3C98256DC666F0290DFF33200FF0866A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697940, "uuid": "21e3a44c-b2ca-4420-90eb-04ed9ba42444", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697940, "uuid": "15bc40ea-66f3-4700-9a37-82e0c405ad5c", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gO4:gcP7HHQU72UHk7c7mvrq0gOPvQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697940, "uuid": "5eab83b5-3560-405c-93eb-fc750d7aa7ef", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697940, "uuid": "1c345acd-56b4-4a17-8cb8-e6fc04d0f5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697940, "uuid": "6f0b951c-3b23-4081-9b32-c83b6ac41f38", "value": "Fukuan Fuben_ China Construction Bank.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758cd855-c01a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706693036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693036, "uuid": "dbef17e6-aada-4951-adff-8fe209ec38bb", "comment": "Malware payload", "value": "9461219a19d6b621e916a0dfe2a06d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693036, "uuid": "3e0e4d04-fbbe-46a1-b4b5-ec4b5f52432d", "comment": "Malware payload", "value": "287290177a4f6b2881b3b3a1e91cb253760dc459f6490aa0da5f747de5c1a38d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693036, "uuid": "c8cc90a5-fbd5-4217-9849-d42d2aba3da4", "comment": "Malware payload", "value": "d1e33ae472a4aca999ec32955d725f1945f3fa1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693036, "uuid": "c4b83b55-47b3-430d-ad37-2a6e3dedd4ed", "comment": "Malware payload", "value": "e029376896de610caffa1f1583876c15b4d2b648e8fad40c01a712c883c4ea36e7e1811a7f43de5a3dd81f9b4d915fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693036, "uuid": "e1b83659-8d4f-44b1-aca5-036abf6f3075", "value": "T1B7B63304D6D6241FC67E6F338D11CA0C514F4EAFE993611E34BC6844BBA0FBAAE82559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693036, "uuid": "900d6eae-22da-48b0-9542-44f8b0fa768d", "value": "1cf4252ebbb4f173d97a6ef4f79a60b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693036, "uuid": "3b759383-d994-41ba-8ae2-2365d6d6cc7a", "value": "196608:nLH/MTClBp+2shxpZ+KxsUiWf/ARwGrKzw2H0aq8BwWIPaOK/ETZBEgPD+v2qP:n7AClBp+2s7pZ+8Ffyb2Uaqewr/UEdBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706693036, "uuid": "74530d63-a3c6-4f57-9b82-682e76cbec9f", "value": 10510036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706693036, "uuid": "dfa10394-aa34-4498-920f-7fb5f8bef84b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693036, "uuid": "a8b654c1-7355-4630-9186-59a2d0d8e3eb", "value": "SecuriteInfo.com.W32.Swizzor.D.Generic.19789.28436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6af503-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706717608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717608, "uuid": "7c8c7b9a-7a75-4cbb-b8e3-c2029d687786", "comment": "Malware payload (Gafgyt)", "value": "fbc580015f94e30ee672576863e1e028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717608, "uuid": "736bb35c-88ca-47e8-b01b-4391a1ec8dfd", "comment": "Malware payload (Gafgyt)", "value": "29dc9fafd7f438d9c7acaed62f7a511f7a80ed298ef8995eb7cd517107d3ec3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717608, "uuid": "3b54801f-39ca-418f-84b3-b1203e622873", "comment": "Malware payload (Gafgyt)", "value": "4d6e31a2adeb74c6e97f2f98d25ee320738a8872", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717608, "uuid": "041c63d3-1c6d-4b0a-bb91-a03f16f37629", "comment": "Malware payload (Gafgyt)", "value": "09d24ac4e9e79ed0b6b584e07cb7a44506cf8d483edace3056e96a922a8c23013e7bf65b1c16062085a5bb089f20beb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717608, "uuid": "fb51761d-d99d-41f1-8747-e7040612530f", "value": "T111732913F20D8B13D19B5BB02AEB5FF14B75AAD1339B7180A129BED857736B02412F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717608, "uuid": "84903d74-23dc-4d87-bdd6-641d32d93a15", "value": "1536:e39lZWoXDQD+NlJx3C8+UUD45p9PlEqmni0hmPY/EvWn:et7TQDcH8U0Ojmni0hmw/EvWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717608, "uuid": "b48fe9ac-4b33-4a24-9233-eb72eda585cc", "value": 80576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717608, "uuid": "a98431a8-29c1-441e-9306-3d2dbed72e4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717608, "uuid": "a98cd76f-04b1-4a52-a7d0-42559eb7e8d8", "value": "fbc580015f94e30ee672576863e1e028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badee6c0-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706660511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660511, "uuid": "fb265cf2-10be-4c76-8c2d-bc6c613bf2e5", "comment": "Malware payload (Mirai)", "value": "b3304e4a48a4afec4636d7bd2a4c54cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660511, "uuid": "aaf4e207-0622-4488-a787-41b38356b5c4", "comment": "Malware payload (Mirai)", "value": "29e49199c8dbdb15d39c39e345dad9bd02e086d2e00527ae841f8f39d1ef2782", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660511, "uuid": "2db96eea-0abe-48b4-aa08-b8a275cf99ca", "comment": "Malware payload (Mirai)", "value": "69188f16a8653c68feb197cd18b6b722fd30cfad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660511, "uuid": "ebee75ea-d9a8-41ae-bfe5-01b1b262975f", "comment": "Malware payload (Mirai)", "value": "d228112565f22d7a4ccc9a1e67174472c17ff6d36fc83c5aaf201b40a54217be65bab79ce4fe8d8c5ab8619ce82b2da8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660511, "uuid": "16540b54-7004-4d43-bb46-dcc83527fb26", "value": "T166A35B217A7A1E1BC4D4A57E21F30325F2F26B4E25A8CA0F7E620E4EFF3550026576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660511, "uuid": "8d94b70b-f579-4d4e-903e-7dabf21af6da", "value": "1536:YqS678cZUK+R9T+mQ0X+iganntt/eXrsz285gET5HcRetiEtsKGPp:YsjrW9FNe7+VyENHChESKGPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660511, "uuid": "b0f3570b-edc4-4f06-adbf-9e4e390d952a", "value": 103596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660511, "uuid": "8ba46154-1718-4b2e-be82-f3c5e450e1c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660511, "uuid": "7aa6fe40-31b9-4d21-af09-89a654007ffc", "value": "b3304e4a48a4afec4636d7bd2a4c54cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238c0bfb-c045-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706711367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711367, "uuid": "89bb84c2-d391-4e33-8662-4339dce68def", "comment": "Malware payload", "value": "225151f6f2a2606a2ff51dd01f801a5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711367, "uuid": "6b9fb260-a817-4a3a-81f0-b936ef8e2d00", "comment": "Malware payload", "value": "2a6a4bc5d24be31b8a3c2487f083cc5d846f48d6aa2cb1a8850b0bd136d5d517", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711367, "uuid": "e1b33ca3-1ed6-4af3-928d-126109a60990", "comment": "Malware payload", "value": "34eff77a7387b5e3aed8f14b7fa915871c109099", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711367, "uuid": "20cfbffe-6fb5-4743-b79b-9d136cd77d6d", "comment": "Malware payload", "value": "699904f62e88862f5689d71b18ac45131f4008e5bf39199e902ae6b33a11f4a728468e44b9adaa1fba20ba1b85f62908", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711367, "uuid": "3f100421-9da6-4841-8a83-6a0b334c6177", "value": "T1E8358CC9B15A50E64C47578E2CFC17C74B700A7B8D3A04703AFAAA810B27ABFE16DD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711367, "uuid": "04e00446-7c74-4bc1-966e-7f269c7a4064", "value": "24576:44cX+4A3+W09xk9x2gr3mkalX06Qdl5jMN/lJcQn77v:44cX+4M+W09xk9xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711367, "uuid": "d508c5c9-9bc4-4e27-9b58-35e0df4eb2ef", "value": 1140098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711367, "uuid": "87f9e0f7-7e0b-4352-a6c0-72c2e1d9332e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711367, "uuid": "55f32f08-d4e1-4f45-8f9f-e4e99c687608", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed84afb-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687791, "uuid": "52562e87-b529-46d2-aeb4-0ace2aa5886e", "comment": "Malware payload (Mirai)", "value": "db62cbd314f9726116ced13964f8d53a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687791, "uuid": "c81423ed-aa66-40dc-8107-bce3c870c5be", "comment": "Malware payload (Mirai)", "value": "2b1e87d9d8d1e50c4a2751eefc8bc547f93122a58d68af6b5c22d047a3af10e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687791, "uuid": "2dce9f15-12a9-439d-b749-bd7d0988386c", "comment": "Malware payload (Mirai)", "value": "1cadb9192d3afb35e2a5101507eed6b0198d3e66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687791, "uuid": "6ebdcba5-1c93-49a0-9043-26b18ead9adf", "comment": "Malware payload (Mirai)", "value": "a0117983396326cbe3404fe1b36d50244ca57bb37d098bcf4a4c3215fa38507a9d89c13d7de494927b6e4d7b634f74c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687791, "uuid": "9777f592-f097-4d37-8de4-deb2c834e30f", "value": "T108937EC4F743E4F1EC5705B12177BB365B32D0B6211AEA43C379AA31ECA2542D61AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687791, "uuid": "cced4f3a-1f0a-480c-abfe-6d7b67437cd2", "value": "1536:Xrxbdr+dQKANujbbGkOTyO/f80UxokunQxboheA3U7SMtMIdzT:Xddr2QZNujHGHTyC0FKnCo1kWIdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687791, "uuid": "f76a47c3-eccf-4cb1-83b5-71c82ef2b7dd", "value": 93576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687791, "uuid": "7186caeb-e079-4add-8b18-b1b1f56a0c91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687791, "uuid": "55fbaf22-a3f4-4c89-82a1-26b4a7438f8d", "value": "bulu.x86-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b8b364-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706699132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699132, "uuid": "d58f514e-1dca-4440-af9b-7298987f7671", "comment": "Malware payload (AZORult)", "value": "91e8ae0f98abcb16814261421bfe1f6b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699132, "uuid": "9479da8a-4ad4-4622-93a7-840b782b3b0e", "comment": "Malware payload (AZORult)", "value": "2b29b24f2a311158a4900bddf41fe482c42e46941a42468b4990fd467fde5f72", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699132, "uuid": "757b888f-4719-4e89-9dce-9248da1bec67", "comment": "Malware payload (AZORult)", "value": "36c17d7e22c982d4991749f905f70941c5d36825", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699132, "uuid": "2bd8b65e-de80-4a39-9b8f-61e78b3760cc", "comment": "Malware payload (AZORult)", "value": "5f6d99db9a38a9980375d7dbfb761d201e3ef44a12573e5649957474590176b01548240f13a46d7cd57bc435abdc84d3", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699132, "uuid": "a193c508-0146-4ac8-a67c-9a1d2dd9f7e6", "value": "T133D46B31B79BACD9C4190CF2515E03EF04D0E7AF165497C3E391ADAB7E2A581862B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699132, "uuid": "fa1ee522-9b93-44b3-bbf3-59fa1b65cbea", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699132, "uuid": "aab51994-5218-4aed-9786-579ba4a409f3", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLwOz3v:AQy6ONsqLN7UHZVrTrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699132, "uuid": "16792d72-f443-4627-a408-cda882761f44", "value": 629510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699132, "uuid": "05401653-ab0c-4946-b6ba-4a03273463ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699132, "uuid": "85571cd0-574e-4d60-93ad-be1c067f2828", "value": "LPO_Eco_Environ(ARTWORK).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4624a0-c07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706736397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736397, "uuid": "d5e91974-73c1-43b1-b3b2-f4093ba78e0b", "comment": "Malware payload (LummaStealer)", "value": "75875ec9ca2b60b8c46b50634b9a3971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736397, "uuid": "2e5866fb-0ff5-4eb4-b66d-7ba27330e755", "comment": "Malware payload (LummaStealer)", "value": "2b4134e388b837fcd2392b99e7b4a9d12e97b0de8b70a8f3f572a3662cee5312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736397, "uuid": "b3731583-2557-4707-a53b-8b99fe3f156f", "comment": "Malware payload (LummaStealer)", "value": "6b3228e6d6f6858e4edfc095514134fbed0a2066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736397, "uuid": "21000752-393a-48e0-b17e-c763c657de1d", "comment": "Malware payload (LummaStealer)", "value": "5ae47b7bb0c40bbb46e385051728462da8a2c10354144ed33c61a5b19e646ab36fd1784ba6ee88003a05a147c444edc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736397, "uuid": "43362bf1-4884-4879-addb-bd07401418d6", "value": "T19AD4128777CA9321C1684579D0F7902057F6BA532373E3893A4195F51E82BA8CB6EBCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736397, "uuid": "e93629a0-fe61-4132-afa0-1a7614d348aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736397, "uuid": "12e88731-d138-48e6-bfdd-5a5d793246db", "value": "12288:nyO/ZTETYsQFWcHqZ3EVnW8HVVFksA0/ARxt64sgjR+J3OII:yQpsy5HoEFkI/Ax64dj5II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706736397, "uuid": "aa54e4e7-6bfd-4cfe-a983-65f1003533c0", "value": 647936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706736397, "uuid": "10c1a2b7-a080-49c3-9325-4c90ab7a1ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736397, "uuid": "b11764bf-697c-4490-8576-4a4b41c9717d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30634.12536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9c4adc-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706678549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678549, "uuid": "af1743cc-4da3-4b7f-9ad7-f3a6f7d4052f", "comment": "Malware payload (Formbook)", "value": "7652a95c64befc504577638e16d248a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678549, "uuid": "1dd945e1-c97c-4406-93cd-c71cc502c78b", "comment": "Malware payload (Formbook)", "value": "2cc48271c89fbe5dcd0af4aeb1302b9ecc3810cad890e5d2817d9b949449b026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678549, "uuid": "f9ae0b85-bed9-419b-924b-237aa766fdfd", "comment": "Malware payload (Formbook)", "value": "22ec04f8c59bd08cd7afd4739ffb069edf9abb7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678549, "uuid": "54c0556e-206b-46c1-96b8-cbc027fba172", "comment": "Malware payload (Formbook)", "value": "92eff16f06be9d4a439be8180b261f53cbbc2740e4182f2168cd51880ef363c93ad36b7c6eee03d887846f8b9e395d80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678549, "uuid": "e9f854d5-7c7f-4bb2-8923-7b9c72071dff", "value": "T1B4C5120773028966C7519735C5A793240B27EAB3A273E70766CAA6F525133BB3FA0707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678549, "uuid": "126e94d5-89a4-4287-8857-f0f7301344a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678549, "uuid": "2e67b93a-60cf-4876-8699-985509edfcc6", "value": "49152:1l7v7NDVLkzxw7kexEvi9XRS9mBYmDpdsebzwtBOof6oXGcanuee:vb7TLkzxw7keWyhaAYApdsmzwh13aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678549, "uuid": "cefa5841-948b-4db6-8cad-520fb7d03e2e", "value": 2707512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678549, "uuid": "1d21da7d-5759-457b-b513-9ff39ef70573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678549, "uuid": "44fda378-c0d6-40e2-a0d4-679050121715", "value": "7652a95c64befc504577638e16d248a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b072873b-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718046, "uuid": "50456f56-9fcb-45f1-8fc8-a7b297a544f2", "comment": "Malware payload (Mirai)", "value": "7358c5237ccae7640c788d205a320ddf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718046, "uuid": "e19ae7c9-08f2-4198-818c-d8f2bc37c3e0", "comment": "Malware payload (Mirai)", "value": "2ea3ad4210f20ad1472a6439a37327a948e69dd73a79950e6ada08eb82caa799", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718046, "uuid": "48551869-9e42-4d5e-87c4-7fef408b1473", "comment": "Malware payload (Mirai)", "value": "b1ff5e43788bf5a972666ed9ec3373d30a3a8d07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718046, "uuid": "75cded1d-1341-483a-81f4-a0cece00de83", "comment": "Malware payload (Mirai)", "value": "a14daaab2ef514e5f203bdb2948b44167845158dadd69d7d5bbb514b234f2779929c8cf3204daf370b46a02f066a54c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718046, "uuid": "b8d18033-f744-4953-a846-2ab7122c3ad0", "value": "T11404981E6E228FADF668873547F74A31A75D23D622E1D684D1ACC1106F2039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718046, "uuid": "219b3b97-9773-408a-9798-6d8f1b4c5cf3", "value": "3072:vKqYGLL8THS6f+++e3eLgEfjYFtsG50Pk:vKqYE6+6EfKtsy0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718046, "uuid": "64c6f9a1-2229-4381-a54c-5275f219cc41", "value": 173316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718046, "uuid": "c0146974-dc44-4a6a-b06f-4799fce113fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718046, "uuid": "2e621a03-6fdf-4bce-ab93-9d704d34a632", "value": "7358c5237ccae7640c788d205a320ddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb9853b-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706696996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696996, "uuid": "e6efdca4-b922-43fe-8eea-3f616451df0b", "comment": "Malware payload (RemcosRAT)", "value": "449cb8aa59bbe50d9933bb1807c0a10b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696996, "uuid": "10753f5c-d291-45c5-82a9-ef1795862a56", "comment": "Malware payload (RemcosRAT)", "value": "2f2c9f0c66724ad46dc0b415631f826c85c8184ca281f3432a307f83097d3884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696996, "uuid": "87ebb8b8-dbb5-4eab-bde2-680b1e7d17be", "comment": "Malware payload (RemcosRAT)", "value": "00852e352f55ae7a800251621d0bf48e41843f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696996, "uuid": "1fc60d29-feaa-490f-b3dc-1fad490330ae", "comment": "Malware payload (RemcosRAT)", "value": "4b7945c06fc28c61a01dc3b50235c2ef5faa96f93a392427be19df477edec6dc6f6be45208a0eaa25bfb5b0029472893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696996, "uuid": "0f89c2db-4f9f-4fb5-87d6-90eb382b3315", "value": "T13295F1BBE3041476D4264139DB0DF77A6864BD6E2F3920815BFD2CCCB2B5287F829496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696996, "uuid": "b9f1d00c-3a40-41ea-a8c8-839dab058a07", "value": "5f7fe181812d5942ca24024d00d9c41d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696996, "uuid": "f29d7c9f-5f96-42b7-9ea7-9380aaf77c92", "value": "49152:FIOAjnxf2hp4XLkrhKOekUvUeudcv6aF5P0R:FI92hp4XQrhhekUvfudYuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696996, "uuid": "efcac963-ee28-40a4-a4ea-eaa1aa91a6a4", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696996, "uuid": "abb29373-d044-45f0-b1d9-1fee02bae3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696996, "uuid": "05a27d73-0649-41f8-b453-30e594021d73", "value": "POT987654567000900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a520c95-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678468, "uuid": "097773f6-2f73-4ff3-8cb9-132a13a3b5b3", "comment": "Malware payload (Mirai)", "value": "135187a04034a2f7130ecb2382a98d13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678468, "uuid": "af9d3110-b659-4eb9-a92b-95bb5321cdf6", "comment": "Malware payload (Mirai)", "value": "30615a726339aecaf2beea36b9648a305f39833273fa921b566c0cc92b0367ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678468, "uuid": "1f06a973-2dd8-4c4a-8648-e180434df2a1", "comment": "Malware payload (Mirai)", "value": "2079bf0ba1aad6a3bbaf11b04c7e89bf93f89142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678468, "uuid": "5f215f81-c8ef-4f25-8277-9f70d0957658", "comment": "Malware payload (Mirai)", "value": "e38303879aa9bb7e52a626479c3e0fe596ccb322ed645e4cf494cd6f6d924a7e663d136a4ea0977f23fa7e83430de8b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678468, "uuid": "6f31483a-d46d-4f82-9e13-8c0e14b83a74", "value": "T13B03F10BA4BD8B68C0BD4230A12FFB4B1C84D4EDF450C6A993B97A6B7910F6A351C351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678468, "uuid": "73966ea7-4140-4a65-91a4-91c8382155a1", "value": "768:JGwUhnB1DjfMz+4iRTMwgYrXPExujtP6XOsdvHerWeaX4P9+/eznbcuyD7UHQRjU:foDWaT5g2ZGO2v1oP9+/eznouy8Hyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678468, "uuid": "edb44325-b3ef-455a-aff3-20a4a36db21e", "value": 40856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678468, "uuid": "77f11fba-bf59-4ae0-8794-04913aeeb208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678468, "uuid": "213b04d4-e5d5-4f3a-abc7-f0e2d3b8adf8", "value": "135187a04034a2f7130ecb2382a98d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c7578c-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706696963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696963, "uuid": "4708e86d-53e0-4558-8fcb-2a6728acc214", "comment": "Malware payload (RemcosRAT)", "value": "d3666a60392402ec968455fcb32ad50c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696963, "uuid": "7501cb0e-d76a-4253-904d-1fe4ac401d76", "comment": "Malware payload (RemcosRAT)", "value": "321f49f6fbc7d1e9199024cbcaf82d064f7e136ac3a24460d8ecb0552e6591a3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696963, "uuid": "c29c80b3-6628-43fb-907b-3f6cb5b2539c", "comment": "Malware payload (RemcosRAT)", "value": "ab8a65024abbe9df9e8a93c1e145e1d08c926d62", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696963, "uuid": "d98671de-6552-445a-90d4-c54cadb1c3c2", "comment": "Malware payload (RemcosRAT)", "value": "0e338a4e666e996d8c3d223d86cc39c2a3bf43764833945a5efd81c828a64b7b88254b418461fcd7ef3a412cf7712db7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696963, "uuid": "428f2bd4-a310-41b0-b618-febb943b2746", "value": "T116A5E022A2E50432F122A5795A977BA5ED2DBD242C367D9537E43D08BF333007F146AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696963, "uuid": "db60ff2e-1a02-4ee5-8835-88c10b2be8f1", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696963, "uuid": "9b703b47-bb5e-4ca9-a7e1-fa157427ad08", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOPcaF5P0R:pqAo2hd7Ymu0gONuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696963, "uuid": "bdf915df-d0ca-454d-bb65-660826fab5e2", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696963, "uuid": "bd48997e-f832-4c7a-a1ac-53b5593f326f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696963, "uuid": "ec67a722-81af-4351-9f4c-64a0c42568fb", "value": "Rimessa Swift _Copy_Jan.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46842cf-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706713355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713355, "uuid": "3ec1ae82-0900-464b-9069-14e611ece0ae", "comment": "Malware payload", "value": "8a10bef8547c837c442a585e36e2370d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713355, "uuid": "7cb0c5f0-4af7-4d16-bd12-412b8bf77f61", "comment": "Malware payload", "value": "32562e2a917d9827d3f24ac715a6af7468d627594c90126641349d25b735234f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713355, "uuid": "b9227120-e432-4011-b588-659b84307d1b", "comment": "Malware payload", "value": "726afc25dbac5004232d28a2b83deb7603e6b375", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713355, "uuid": "bfdf80e6-ddef-49c9-a7f3-55f3c7d496ec", "comment": "Malware payload", "value": "a18d0f5eca5197489f0db7f6e2289c0ec26796560a19121462761f36657d7c27a46f02172fd5e10539be7a804c50c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713355, "uuid": "b186e570-f065-4439-9c58-83871c18ceeb", "value": "T10DE2E0F3D5540D7ADB36453B61E73603D10EB837AA2A681CBF33E3288C620699D794D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713355, "uuid": "bfb2737c-c267-4625-b9a7-08be83ac8b13", "value": "768:DeYNmmuFze6j3omfsRYKiAMx9Xg0mpp98/gjx:XT+66sCYYek9XmFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713355, "uuid": "c40aa045-c7e6-40d9-a744-43e367811ccb", "value": 31374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713355, "uuid": "9e133a7c-156b-4f64-9e56-a60f1cef428a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713355, "uuid": "30807cb5-488b-4535-9b67-02e53982927b", "value": "New order list.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f636d7e2-bfd7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.DownloadAdmin)", "timestamp": 1706664476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664476, "uuid": "bc465cba-be61-4248-bd6f-5e440d3c9f6b", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "b2177577f5e2680bbad39ca875497551", "object_relation": "md5", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664476, "uuid": "8c9a355f-957b-44c9-a533-b965781a18ae", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "32cfc18db080b482188480de483e1cad54909f05d986460546c2c247f5cbdf84", "object_relation": "sha256", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664476, "uuid": "560059a4-a28c-4bf7-a98e-7d4631917d85", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "f85fbad0c74d76be8bfeb8501ae9908c265bc6c7", "object_relation": "sha1", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664476, "uuid": "be801acc-20ad-4552-b093-cf9b02fb211b", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "e00ea623204477599d9fb95b0ecc8214afc1726e9689827c32a471b24a6a206525d73c2ec65c6a9c5bc5a16da482be51", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664476, "uuid": "25e65c8c-e2f0-4423-ba0b-f77ca2b69d66", "value": "T15076223FB268A53ED8AA0B3106739710597BBA60A51B8C2E07F0484DCF765B11F3F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664476, "uuid": "ae8b2527-67da-42c1-a677-9c2ce2785ad6", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664476, "uuid": "4e978ec6-d668-4c5e-acc5-40794014d35f", "value": "196608:LI1shsQ/uSsoi3Hy1sz0TX20F88ZlWS49E14x0R8ztK:LRhsQUrz0TXr8XV9/6R+tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706664476, "uuid": "23ceea5b-c3a6-4d28-bdb7-b69b2fa35f30", "value": 7554304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706664476, "uuid": "cee0bf45-1bf8-4d85-ba68-3c3ef3c096fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664476, "uuid": "00b27bb5-a030-4b19-bef4-e929811ea2b7", "value": "SecuriteInfo.com.Trojan.DownLoader44.26037.32538.24290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2adb0-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706698164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698164, "uuid": "a3140f95-69dc-456d-8eea-f58f3a5a29aa", "comment": "Malware payload (SnakeKeylogger)", "value": "2b91c1d78d8e65a4a8a4c8bb89267e7f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698164, "uuid": "3efcfad9-b02b-4dd1-bb09-28ebeccc7c8b", "comment": "Malware payload (SnakeKeylogger)", "value": "335dbbec54330e455233417d1ce7dd7ccc0550c1c8bdf8eaf6d3e54f1c5f0b6a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698164, "uuid": "4d450b92-3be4-4ada-8498-c1424abfa318", "comment": "Malware payload (SnakeKeylogger)", "value": "37092cdcc30b44403638e19bb2b214e6fe9be2b2", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698164, "uuid": "438331fc-aab2-4952-8d22-1fde9d853344", "comment": "Malware payload (SnakeKeylogger)", "value": "b6e7e48faac924f0d4dbb7e333061946ec47b900e16decc62c39cc2cfac440e04df449476ad8101854efd80538ce343a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698164, "uuid": "6c38bdd0-d7b2-490a-98b9-83413a123586", "value": "T19151C2151EE522D8F37347366BF9F2B64661F451E96E4A7D024081C08B65B80FC63F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698164, "uuid": "91120dd1-bbc7-43ab-82ef-7e5210f51c25", "value": "24:8WeSJ2Yr9+EJOiAAte+/2oFTEdqs05qGohsycQ5ahYj6MbReQ5L3+fk4o0a4Yete:8WAIFHsqsmEQchj6DcL3AoiYetabc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698164, "uuid": "56974dac-25b1-4412-8680-0962d47a2fc7", "value": 2561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698164, "uuid": "5004121f-f22a-4bbb-a509-e377588d50d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698164, "uuid": "24a1e07a-56e5-40a7-add3-7021fe095041", "value": "Photo01.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c206d28-c050-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706716079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716079, "uuid": "18318069-97cc-4646-b8f6-9f7688ae7904", "comment": "Malware payload (AgentTesla)", "value": "c9426db8a06da7313d859307a87e6e4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716079, "uuid": "5d950f6b-ce1c-4b6b-bf30-d23bc2e711b7", "comment": "Malware payload (AgentTesla)", "value": "3442bf5cd309dbdf4cf0a75599a6d2ab6e7bb60ab2355114e33200269de4076d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716079, "uuid": "b018e4ad-a397-41bd-a419-bcb3418efb76", "comment": "Malware payload (AgentTesla)", "value": "f46b83a69cbdf5f3680d6651cdf3994c621be4aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716079, "uuid": "170f3eaf-8754-4018-9d70-1bb7dbcf22f2", "comment": "Malware payload (AgentTesla)", "value": "65158af09c690d804bbf8bdc5a36815a39500919d1f34932a6991c25d7d79f37b20a7ceca28802c869efe6fe4923f726", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706716079, "uuid": "30da9b34-f45a-43b5-9fdd-bc86b493f779", "value": "T19A05230126998BA6E77F87F1069364849FFBE50F2A94F72C5EC137E92693F404710A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706716079, "uuid": "1bf63b42-a6c6-44fc-b8d7-babf0f00c013", "value": "12288:hNVvkd635r1q99f6Of1edh8s+iK+e9hYGkeLtOHS8rrxZTPROU4EaEfoTD/qNWs:+I3MxQh8f9SGWHFxpp74MfoTTsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706716079, "uuid": "7429eab6-bc63-4a2d-87b2-702e19012252", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706716079, "uuid": "f1463b24-e728-4964-b857-5da80ec45cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706716079, "uuid": "cd2aced0-7775-4870-9cb5-f188bb3ff335", "value": "PR 2000052255.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e60865-c090-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706743775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743775, "uuid": "d518d98e-bf13-4ac7-bb4b-8e2838c46ba8", "comment": "Malware payload", "value": "e9b88e7e180667206ef48711b985f4b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743775, "uuid": "7946d26c-4e95-41ce-867a-7b36d48f5068", "comment": "Malware payload", "value": "3474f9a78cf4a443eeba53d136d0d36d860cecdf955c39075f99287fc759c69e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743775, "uuid": "8da547f1-fd45-44cd-ab81-d1d02ac41fc2", "comment": "Malware payload", "value": "b5add9f69e68863be9fc825be666338999f1cad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743775, "uuid": "074ecd98-6159-4fdb-b65e-6f1cda7555de", "comment": "Malware payload", "value": "cbeb475ebe6b7b9da3665c42e585872b9ecf889e80d4fb5fe9a81569100ce1fbc823f7e171a352c81d525fcebbfe1bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743775, "uuid": "2c369277-4689-4189-ab6a-06aab86dcc3b", "value": "T1AB15233697A86131E090C9B06E25D2568FA3BB351C39241D3ADDDF0C2F17E86A11EFD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743775, "uuid": "c834cb8d-8fd6-43dc-abf8-2293cfde374e", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743775, "uuid": "448a5ff3-e181-4966-ba04-ed384b5140c7", "value": "24576:z7blTb9gzCjHexBss+XIRTFJGcgOwg7fVA32XWu67aRq8Imj4Y3:z75uzC7usRItGcKP2XWt+sm8Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706743775, "uuid": "73cf7c53-6872-43f6-be0b-46657e9381f0", "value": 917340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706743775, "uuid": "1131fa93-6797-481f-9350-0800296c563c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743775, "uuid": "c9563f47-4174-47fd-99ad-0c8ce9c752fb", "value": "SecuriteInfo.com.Riskware.NeatDM.13552.20169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4f485e-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697291, "uuid": "aa829f08-6a1b-448e-b119-b37ab307ac2a", "comment": "Malware payload (RemcosRAT)", "value": "883c30e95d45ecdd152bd88b3155c3f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697291, "uuid": "8c716f86-6bd3-4254-b2b8-35a806f8311e", "comment": "Malware payload (RemcosRAT)", "value": "35bc90c418f4deb940f49dd93e871c543e58b9d2d2bcecbfea0b5a429cb41099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697291, "uuid": "89e42422-0470-4647-9738-f35fe014d3ff", "comment": "Malware payload (RemcosRAT)", "value": "aada24f8d384781960df8ce47375c29a74ed8c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697291, "uuid": "69ec4764-c00d-42ed-8f7e-d91a21df915f", "comment": "Malware payload (RemcosRAT)", "value": "ffe10a6de116e3bce68a514fc3a9c495d15406a2af4780ffe0bfab96e61c4c5d479cb0907eeef48b9067b81c4363bc8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697291, "uuid": "404b32d3-3d0d-4a01-9e56-038f019895fd", "value": "T1AC2502A1356082CBD5EF39B36CDF602838F1289CD5E5524DB8EA331993D27A045DF6AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697291, "uuid": "d1b2f906-92b9-41b5-abc8-1c3a7e04da78", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697291, "uuid": "b52f26ef-a296-48c9-9ac2-32a5d0921b29", "value": "24576:mBXu9HGaVHhu6iaCrpeF42YJsPS3/ULrO5XD:mw9VH0JLeFyPue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697291, "uuid": "b00f9bfc-6b1f-429f-9a94-86c9bb4138ad", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697291, "uuid": "8e6ceab9-415f-4b00-82b3-5b5a864b8799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697291, "uuid": "31280f44-107a-4594-8ee7-8f95ed23fce8", "value": "TMSO-12259-12260 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26491451-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706682166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682166, "uuid": "1ae2e701-a8ed-4580-9e08-552d7ca9e294", "comment": "Malware payload (AgentTesla)", "value": "9f692a38251e2ba879d4ae1385e534c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682166, "uuid": "be7240d6-25c1-4463-aea4-876c28db4cc6", "comment": "Malware payload (AgentTesla)", "value": "364f032a6775884d59161e568908ff20a2e87e0278c0063232bbfd90a7833c7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682166, "uuid": "fe0e6042-22b3-4747-a529-553f44aa04b1", "comment": "Malware payload (AgentTesla)", "value": "8c19870a97f1d3c963f3a5815bcf39d76cb4bd3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682166, "uuid": "edd42132-4809-48c2-981c-d01de39f875b", "comment": "Malware payload (AgentTesla)", "value": "6c97507539bea1b3bc0a4c88cd9e8269a1e8d6d78e973959ca8da114e9338d0bc84eb97a4be5f94f0b4a6ea58f208ec7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682166, "uuid": "19a6c200-c758-4324-8e2a-79bb19edb9db", "value": "T1D6E423240B6C6AB3C26D45B90D91964DB7F9C3027245E74EAEC4B4FAFA737C0A1452E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682166, "uuid": "2804c67b-b16c-492e-92f5-a52b2d6cc6aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682166, "uuid": "ed7a8e2d-d8d2-4acf-accf-94c6dec3d97b", "value": "12288:9juD/qNliCg/VnMVvYFCUafUrTuFRbZ0Krq5ywzCANF7urpe:ZuTsR5Y0STKdZ0KrEzCsF78pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682166, "uuid": "8dc79e63-8fad-46d6-8d45-ed970cce4193", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682166, "uuid": "5f7f10c7-7227-4eda-937f-e09702ccc117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682166, "uuid": "b6ed484e-c597-43d3-9f72-4fb53af1beca", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.11084.32586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1a54ed-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698173, "uuid": "e8a4678a-7631-4bcb-afe4-e2a383bc1118", "comment": "Malware payload (AgentTesla)", "value": "c43a08e6cd0fd5f4794b114af11a1118", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698173, "uuid": "c6fc958c-563d-43bc-b371-c39f1dfa4e98", "comment": "Malware payload (AgentTesla)", "value": "36ae48d1d7ad2078be4544bf86f2a5ee3512c7ce131ec0a06602ebe9e95d5e7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698173, "uuid": "d6ecb88b-b7d8-4afd-90ad-1d18ad20fc08", "comment": "Malware payload (AgentTesla)", "value": "5457df629e25925f1df1eed80df6ba8087130272", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698173, "uuid": "554dde2d-84d7-435c-82dd-2d41370ab595", "comment": "Malware payload (AgentTesla)", "value": "8bab0b6d513a658f1cb3cb266f720e9899ed72bd7daa1b33457fec56d99762c6bb7e174d6d3927eb665dbc6c7881fbe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698173, "uuid": "2d120b83-f7c7-4f44-b1a7-fa09dfd0169b", "value": "T162E30106B3B2D44AD8425CB88CD5C5C35526BCB26F2AA85B7148770F1CF9E82D71B6B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698173, "uuid": "4431c4d3-9f41-4ea6-b3ac-e9ae70e53994", "value": "3072:eckJAg15hICoqk+PufZ9ofLevWvPrxcwycfD55ztfA:ecunhnVkwYYeOWwnf7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698173, "uuid": "6a16f474-737b-470e-a67a-11ed5e9ac170", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698173, "uuid": "664abfa4-6beb-484a-ac7d-bc70c99110e6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698173, "uuid": "f3202a3b-0806-40f4-a169-3d40b46b4ff4", "value": "PO3150_Petronas.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e441b301-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697947, "uuid": "47c02c8b-b842-4cae-96b0-55ee7c3cc103", "comment": "Malware payload (RemcosRAT)", "value": "91fb69af719d6979571057a5ef96e3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697947, "uuid": "9bb40c97-0088-4aef-a51f-af9d6ffdaacf", "comment": "Malware payload (RemcosRAT)", "value": "371f543a58bcb2c9fcaa6f57866aa37e8607c69773bddf3cf81b4af0b6ff1530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697947, "uuid": "951408e9-4263-410f-9503-8db7ce5d5359", "comment": "Malware payload (RemcosRAT)", "value": "dbe2e080be919f5d5b5c1793c28119d25565b408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697947, "uuid": "8ddae5b2-be2a-4412-bed4-22c8d8340219", "comment": "Malware payload (RemcosRAT)", "value": "926a2e2f231f0bb795ff25e6de5f077adf989947c0781659145900f4d3a1e742f6390fe7f63d000ba762fb6724462ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697947, "uuid": "9b47f024-1fc1-4491-9f9c-482883549688", "value": "T18585CE2276D5043EF262B47917967B6DF96D6D3CA8226CD566F4280CFB33200FB08667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697947, "uuid": "a8aa7bdf-60ff-4f51-9104-fdae3ec0b8b9", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697947, "uuid": "c821e7d0-f2e2-4f57-8213-ff444c70d7d5", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOp:gcP7HHQU72UHk7c7mvrq0gOPUQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697947, "uuid": "de8c5f14-de61-45d3-84cd-1499dd32cf43", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697947, "uuid": "fda5d625-5fac-48fe-8717-ab75d7878394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697947, "uuid": "cfa6fa63-ed0f-4dd2-b91b-1ec178a087c4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1bfd72-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699379, "uuid": "e6629953-78c4-4456-9639-19f1a977b4d7", "comment": "Malware payload (AgentTesla)", "value": "1d60063801a0ee44d90392ac62d645c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699379, "uuid": "2997c752-c9ab-4367-9d34-8309b54d766e", "comment": "Malware payload (AgentTesla)", "value": "39266f36d22aee10dbbeeba147e5fbe1448933c2a256b6097f7fec380e5893fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699379, "uuid": "d2060b77-a9ab-47d8-ae35-03b9d9baf918", "comment": "Malware payload (AgentTesla)", "value": "a7b62ed0685548c4beaf91718480f12fb8d4e416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699379, "uuid": "b58b4c9b-acd0-49db-ab30-e7fce6a076f1", "comment": "Malware payload (AgentTesla)", "value": "5893e0a5e047e8d192c4fc4a45cea6dcc8927b1a21209179b5c4535efa056112f9b949e595efdbe4f8f6809ce54d3065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699379, "uuid": "e49953fd-5b3d-448b-836a-8683434aae4c", "value": "T118159D9C725075DFC817C972CE981DECAA607C675F0B9213A01732AC9A2DA9BCF151F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699379, "uuid": "a1c0c9a9-a925-4749-a942-982429e5b305", "value": "24576:Ja8xUFc0rLc0TxwoVVz5iPig7dPHFeiGSDAZTII4fRbYZ6:KRnc0TZVVzM17MSk8Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699379, "uuid": "b4e97ca2-beef-41db-b1b1-c0668c15442e", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699379, "uuid": "bd3672bc-8401-4957-a0e8-6c2a3f1e2f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699379, "uuid": "e2652c68-7c68-4b29-bced-3ff1ea78ebc2", "value": "New Order_1302024_pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea69678-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666369, "uuid": "6c6f7a64-9b9a-4066-a7e0-ad48ffb348de", "comment": "Malware payload (Mirai)", "value": "00af6194a0c046ba9333440fbe76da00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666369, "uuid": "af1344f6-e8ca-41c9-b0e1-49ee63bd94c2", "comment": "Malware payload (Mirai)", "value": "3935a08db4c1094be661b0dd1e01e2052bb75e5475e292a84e87cc6bf8864c60", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666369, "uuid": "54a15db0-856b-492a-8425-67b46910c29b", "comment": "Malware payload (Mirai)", "value": "4c0986564b74508c4f30a828cbf68f205eaa06ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666369, "uuid": "5ed57e7b-3679-4e93-845d-c3c0d6db1ca0", "comment": "Malware payload (Mirai)", "value": "ac0c1dc66bcecc0eec2b87e2815a57e9dfd9d94dad57894f538fff01d476e751eba2129a172561be95001cf43af33942", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666369, "uuid": "f24531ca-4564-4b59-be73-87c1de20d43a", "value": "T1B6043A46EA414B13C0D72BB9FADF42453333A75497EB33069528AFB43F8679E4E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666369, "uuid": "dbe5f23a-ff00-4f02-9649-7a987649e02e", "value": "3072:CTmriTM/k8tkxah9OyCMk4vP3RDTBz8Tw/ujcoLM/RQm3s:vuM/R+xah9OybkQdB4Tw/KhLM/RHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666369, "uuid": "c6b0d3e4-7c64-4745-94d6-2996513c88a3", "value": 184486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666369, "uuid": "f8a2a46f-314a-4024-9bc1-5dbf9ebe75f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666369, "uuid": "42252eb1-f0d6-4ebb-968e-760caa0b75a5", "value": "bulu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2883a3c-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717620, "uuid": "4f497058-8c71-426f-a769-c86178330455", "comment": "Malware payload (Mirai)", "value": "2c3e543ccc073b274a98386ec3a53401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717620, "uuid": "06132deb-deb6-4347-a179-550526e7d974", "comment": "Malware payload (Mirai)", "value": "39952b8bbd44ae0a0e25721b1e450d93cfee28e85559c54023793f332fa7b941", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717620, "uuid": "81383be2-25eb-45a4-8ed9-d6a6da4c3b39", "comment": "Malware payload (Mirai)", "value": "d3f6b33c1ebecf8aae9a1e2b0680b2efde2a170a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717620, "uuid": "f5d251c0-ba2e-481f-9884-52243641dcae", "comment": "Malware payload (Mirai)", "value": "eddc57fcb8d1aff9094f59480e95c8ae1f90458a7423df6d7eb134e9a4746a21f7df23e18d78b62358347b740244c4e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717620, "uuid": "9993c460-0355-4350-9936-20e9a3726684", "value": "T15ED3F856F9819B11D5C111BAFE1E128E37231B7CE2DE72029D246F747B8A8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717620, "uuid": "df0ad895-c102-4dca-bf58-56e2c486ab24", "value": "3072:xOHscUfW4ybXRwfdruWaH9BaXrRGDxPCthESml:xOBI+bXSfVhaz2RGhYhESml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717620, "uuid": "9e76941b-1f16-47a2-a06f-ae88de0cfcc2", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717620, "uuid": "a22bb6bc-4fc5-4062-b021-b447765e4f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717620, "uuid": "8358c33d-50ea-46dc-972e-1dbb98d0363d", "value": "2c3e543ccc073b274a98386ec3a53401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5c2073-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706699247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699247, "uuid": "f11c4463-251a-4e09-9b02-66eb0cf01756", "comment": "Malware payload (SnakeKeylogger)", "value": "e3a7d92bc5aa1dd6e8df345b8c76d3f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699247, "uuid": "c3b2d192-dc46-4468-b239-b502b1c03430", "comment": "Malware payload (SnakeKeylogger)", "value": "39e9d1f49472cc651a053aed4ede3e60f79998f7559e2eca4fc423daf22358a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699247, "uuid": "e500915c-98e0-48e8-a354-60d01f3cb142", "comment": "Malware payload (SnakeKeylogger)", "value": "e9c27eeabf6d2184759997b209ff051c3b01d1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699247, "uuid": "e46eb467-7513-403e-8c25-d62fd1f18598", "comment": "Malware payload (SnakeKeylogger)", "value": "0be8e448a67571a228c25548dc11a250d6cf286e7c9c5f598f3a1729acbf5b56f1726141edd01fbe2b059b312db41924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699247, "uuid": "6c22ef60-2009-48d5-bb36-ce8629665c6d", "value": "T168D41202B7A88927C25C47BACC3251CC0BB2ED127D66E3EB1D8A309D69F37994742753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699247, "uuid": "29cac1b1-22c0-4c7f-9a68-1f9bec41c552", "value": "12288:QHd6rxUDrMMc0YsTwph9QYhjL2qmQ3M3mR5Ro3uzRPlakpJ:u6rxUFc0E9QMLWQwmm3yPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699247, "uuid": "ae0eefe6-5054-41bd-80fd-3c7f44ea346f", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699247, "uuid": "fe4568db-11f3-4d38-9e1d-837cf0e71792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699247, "uuid": "22d55ed2-5d06-462c-8442-c83cccb8dda0", "value": "Swift_0203usd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e4a858-c019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706692824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692824, "uuid": "9879c9d7-0fa8-4f05-832c-f0d84e62bcb9", "comment": "Malware payload (DBatLoader)", "value": "abec8ea35faa4baf6fbbf56b6c08b722", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692824, "uuid": "011038af-9533-4e4d-8f5d-47162167ae69", "comment": "Malware payload (DBatLoader)", "value": "3a1ce035dee055e61bbeade32417231f71440917e5c6c6257981f944e0893095", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692824, "uuid": "a1581ffa-a5f1-41ba-90eb-f95d088208d1", "comment": "Malware payload (DBatLoader)", "value": "19127ef44fff1fa666d234936423958d880dbaa3", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692824, "uuid": "949f39e0-6de4-45a8-bb58-b2e012140dd6", "comment": "Malware payload (DBatLoader)", "value": "4262fd16ead93303476964017f2365ee5891601072d1a66a675eef315fc539d955281f5ff30166dc7dc6f232bac9ef93", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692824, "uuid": "e2838c29-e665-41c2-9ca7-059ba1a7f859", "value": "T10485BF2276D4453AF222B47517967BADF81D6E3C98266DD566F0290CFB33200FF0866B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692824, "uuid": "4e7fe125-b94f-439f-93ad-b656f15dfd2e", "value": "24576:d7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOv:dcP7HHQU72UHk7c7mvrq0gOPGQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706692824, "uuid": "6da2de0d-e5a6-490f-90b2-3e60974ae560", "value": 1873920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706692824, "uuid": "0dedb275-3c38-47c1-ba61-6a48bcae7cdf", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692824, "uuid": "92908dfc-d85b-486a-acd1-8c612bb701a1", "value": "INVOICE #202331056.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d26815-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706688020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706688020, "uuid": "f6f0663e-22ee-4a85-a843-63174535d08c", "comment": "Malware payload (DCRat)", "value": "19d45a066992c9e3b7d96f8c1be45c73", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706688020, "uuid": "05e2fae1-48a6-46a7-96c9-6d3bbd911e75", "comment": "Malware payload (DCRat)", "value": "3a2cb733e35cee28affd90425ebc2f8cea111a34182d4858cf7ff91d0bc552d6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706688020, "uuid": "21197f9f-f4fc-4573-89a7-cb12885ef33c", "comment": "Malware payload (DCRat)", "value": "accb88710457f237f0c4140d5afe25fd9d5b1f54", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706688020, "uuid": "607d7dcd-ef84-4d91-915d-145551bcfff1", "comment": "Malware payload (DCRat)", "value": "baedc33d4a83b7269d718ea2558c03afbd38994a52525b96e7299b60576dfc3f8818144ad7da23e7aa03b1d5d143ad62", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706688020, "uuid": "fbb619a1-867c-4d9c-9789-c1037063c82e", "value": "T16877332375D5CA31E22329325B13BB90673D7E0567194CD387C93AADEB727A0C6B9234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706688020, "uuid": "41b26518-fa8e-47ac-bde2-c68604902e55", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706688020, "uuid": "8df2dcd0-6f2e-4f52-9644-4667395f0ebf", "value": "786432:stYvi3dHsyO6DyASYRLj5eoJ6AOfbc44jtTyT2GwwRdh:sikdJOwyov5eovx+T2BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706688020, "uuid": "8354cf5e-8de9-475e-a099-66169e736d73", "value": 34911703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706688020, "uuid": "47b66f5b-d94a-4c12-bb1b-d4a41344fd21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706688020, "uuid": "6f5b2293-747c-4107-b3cf-f28153cb2bd5", "value": "19d45a066992c9e3b7d96f8c1be45c73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1d043f-c088-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706740235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740235, "uuid": "32c1c095-3119-46d1-83e4-eff2978caa3a", "comment": "Malware payload", "value": "d6a339754292a9feebfd3660fbac3a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740235, "uuid": "47458369-9561-4c0f-aa4c-d29d05d6d386", "comment": "Malware payload", "value": "3a649fa91a13523a86b7bd178fb4ccf28970d1627bfb4ece042a42f020262697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740235, "uuid": "a9ea2f3f-8e92-4efd-b3e4-3cb3e34530b3", "comment": "Malware payload", "value": "5021f26c951626d2e3e4473c221886b0eb9b5fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740235, "uuid": "7d6b69c7-e840-4903-8dcf-c3e4e19313a5", "comment": "Malware payload", "value": "6e3b062d4d9bb1097701f7297f1ffb0016fe9bbc2888dd5fe9f12259edf7819a1da4de7bd7c85c931cbc8380616d48d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740235, "uuid": "3c91370d-e665-418b-83ad-e0bf14ee8805", "value": "T128B533F073F68840E0AB0775852BAAA364A7FC8B471284F47906F339277D7369716E61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740235, "uuid": "ed285468-9a04-4aca-bcdc-aeb24dbce6d4", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740235, "uuid": "32235709-b00f-44c5-a2e4-6cfc939d2ec9", "value": "49152:vOEiPsx7rouKqmsX0Zf89lOOmCvS0+NgIynZ7KDNMrDuExSzWf6:vOEUsxNKqmsX+k7P+NzyKDirDh0Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706740235, "uuid": "093e2681-74e9-4812-a327-9cf3f82739f0", "value": 2302464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706740235, "uuid": "3a30e3d5-1bce-4265-afb5-567e1f2817f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740235, "uuid": "eb362e85-d273-4fdd-a0ce-4750e76ad5f9", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27020.26387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42979ef0-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687797, "uuid": "629e1f14-832d-43c8-8f2d-6011c2e1c07b", "comment": "Malware payload (Mirai)", "value": "7960d6d7f86e13faf2ad15213cd2267b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687797, "uuid": "7e7b0916-d728-48e6-930b-2fda421259c8", "comment": "Malware payload (Mirai)", "value": "3bb5a4c655af026208374ebb3cbad20c4956a4333f389a9f07dbb1fce9fb9199", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687797, "uuid": "2f23062c-3621-401a-b0b8-51a3693cbbfd", "comment": "Malware payload (Mirai)", "value": "d291f7f1bca6b9bf1ea4335889a77384fc62c51b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687797, "uuid": "da19598e-166e-40d8-abad-a878f10815c0", "comment": "Malware payload (Mirai)", "value": "8619660e139341997a8c7bc9a2c03ceec0db84451b77f8ab86c16a4f0ea310727a9a8a2a26b0e6535995031801504044", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687797, "uuid": "11a2e9dc-6453-4da8-8671-73324002fa33", "value": "T115E30A56F8818B12D5D111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687797, "uuid": "39e5b2c8-e226-4a30-80e4-fb294972095c", "value": "3072:QD7YUgDUtTX5tgDgRaY2fOk/bfPC22I5mRzd:OYTOTXPgDUaH2mv2I5mRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687797, "uuid": "5251d1e9-1a80-4172-8286-fc4f5d0fa377", "value": 147548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687797, "uuid": "026bb38c-ba5b-4949-a1e0-0986ba1caeef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687797, "uuid": "1102a2da-6493-40eb-9aa7-295c07d6c707", "value": "bulu.arm6-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8802ca9-c069-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Babadeda)", "timestamp": 1706727052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706727052, "uuid": "1cb3ec42-b3b8-49ec-91da-e83107efae06", "comment": "Malware payload (Babadeda)", "value": "b82ada91e8742234257d9cad38deebfe", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706727052, "uuid": "5d4c7ec8-1440-4e5f-8e0c-4101896e732b", "comment": "Malware payload (Babadeda)", "value": "3c8a05c5e2b599db85700ff9334a778efd2a99f6b4a1852aa0c129ba6039f834", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706727052, "uuid": "6b08348b-de78-4615-8ada-a2b4f8c803fc", "comment": "Malware payload (Babadeda)", "value": "d1278efa9729f955de1dbfcfe53550e67212ff9b", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706727052, "uuid": "c2c87292-bd2b-4422-981a-41941a105630", "comment": "Malware payload (Babadeda)", "value": "feeb9ea2e6e64d742a5f0a73cbc0b1270c44369b74a65d323de0da88a7ffd78e33f0d522cf4e333fc5ad198fdc0ac4b6", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706727052, "uuid": "2b171738-2f20-4986-a13c-0c3bd23146a1", "value": "T10D07334AFF82DEC2E96B51778D908669F57B3D0149850D092B91BB382CB33D8327F586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706727052, "uuid": "b7b6ddeb-7f75-4af0-8a3f-7c6e1beeb1fd", "value": "393216:bnEbwdw5PBbXDqPiHNTS3ByWhGhz3iQw0FHufQMfh1GD6QGhNgqx9OPNQNI62vhp:wbwdwnBtcFhG1w0MVZ1GD6QGhNpwsIn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706727052, "uuid": "4bec5b70-822d-4dbe-81f2-62baa5b6a310", "value": 17960960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706727052, "uuid": "efe4aa95-8e1f-42ee-858a-6143c3191645", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706727052, "uuid": "a5c2af74-dd64-437a-b2a9-a6c3522b1d4d", "value": "ClipPlusCommunitySetup_ns.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c05000-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706699367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699367, "uuid": "e88da335-6208-4ed8-9ac4-2af28d9e5603", "comment": "Malware payload (RemcosRAT)", "value": "0b11702e494a188e4293c7d9e162041e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699367, "uuid": "152f1f68-1c61-4602-a7ff-3f5e8e4067a6", "comment": "Malware payload (RemcosRAT)", "value": "3d5540b672f011d3c7711627691ced66c23e2d3d5e69898f2324fd8a1d90a22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699367, "uuid": "f8ff1cd3-254d-4230-a458-b6a73c0b212f", "comment": "Malware payload (RemcosRAT)", "value": "a5ac18125f1429937cfd43cbb69700e08b8689f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699367, "uuid": "92441842-cb32-4413-a1b7-68e500575d86", "comment": "Malware payload (RemcosRAT)", "value": "dd57d7b2dee303274a0c8d80b90140325d4f19b15920bf8d14e8116424f3678e5488246d513a64b7e9ec05b49e1560a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699367, "uuid": "19cacaca-c9e7-4cf4-b4e6-c87c19ef728a", "value": "T17E2523A4B358A847D96A1BB8DD7102ED0373ED012D6AE3BF6CC4348C54F678A47A164B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699367, "uuid": "80e25f12-8e7c-4d2e-a84b-36f2ead87600", "value": "24576:VHYxUFc0o4jL2zp6pUjx60CZir3Vd0/tWoo8UchvlTHF0bD4V6P:VRRo4yWg6fM3Y/tWovhtTHFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699367, "uuid": "54808e5b-1f5b-473d-8a8a-d04228ce8226", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699367, "uuid": "6c12d6d7-599b-424f-b08a-6823ecb9af24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699367, "uuid": "136fe06a-d04c-4d2b-b011-53a701788a66", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c04de91-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699382, "uuid": "8d95249c-577a-49ef-a944-13b367e7f16e", "comment": "Malware payload (AgentTesla)", "value": "409a7a3df54885fb653d9dc00ac1567d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699382, "uuid": "06f83b1f-0cd9-4513-aece-925f3363c506", "comment": "Malware payload (AgentTesla)", "value": "3d5dae6a24c09eef8fe2b61ba3baba6a652caf17689519b3adea73684ada223a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699382, "uuid": "c200f625-39d4-43c3-bb80-feb61f7ed761", "comment": "Malware payload (AgentTesla)", "value": "a965cee7e7c53b77b8cee08b3867a6b40f9af0a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699382, "uuid": "0dc1529f-60a2-4d12-ac7f-9f5cd059d369", "comment": "Malware payload (AgentTesla)", "value": "e61b60c7e2325c82382c4226b2b38a891b2f72a2097ccb7236a4f3d6bd62b91ad085a5c01424ae9e65c79288c5563658", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699382, "uuid": "5a3016ab-8d34-49bd-adec-344c60bec67f", "value": "T13215AD9D3650719FC95BC872CEA81CECAA206C765F0B9203A017369C9E6DA97CF154F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699382, "uuid": "b85c5ed7-a4f5-461d-9792-7b7c1533ff95", "value": "24576:6JsFxUFc0KAqV9zMDeJWM3aPGd2z3ORW:ARKAG8enK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699382, "uuid": "1b40c045-7bc5-4553-98c4-870069676603", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699382, "uuid": "698d5d6e-05b2-4624-a48d-8e73e1ff4352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699382, "uuid": "0d695457-22e3-4320-a955-edcd53042fc0", "value": "Payment-Advice-Copy00djNeHTgHx0vlPtq.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603e3752-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666372, "uuid": "9b911ee8-4085-48d7-9d35-a9a299427769", "comment": "Malware payload (Mirai)", "value": "f679b1be980ae5518e735647e8a54167", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666372, "uuid": "908f5098-46f4-4356-a383-afb4b93e96b9", "comment": "Malware payload (Mirai)", "value": "3e80504179dcc3eccdaf14d2c496193d216b556f98b568722c557f419ce909ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666372, "uuid": "d172ca6e-eaca-4c9e-9d05-ebe22ff32313", "comment": "Malware payload (Mirai)", "value": "35caa71b58be01d615decb8cc8c280b134bfac18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666372, "uuid": "34cd0d41-8742-47d8-93f8-0dbe6b5502c1", "comment": "Malware payload (Mirai)", "value": "475e484d0033507783d438f528c293348c190fb303477af205929f56ee85871cd27d6d1aed9f5d84d68a4332c906aff6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666372, "uuid": "2195595b-d7b3-44d0-8bb1-b026a7ace5ea", "value": "T12CD3F845FC415F13C6C612BBFB5E428D3B2A17A8D3EE72039D256F60378A95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666372, "uuid": "483da408-2cfc-4699-80ba-2c7aa7d8e758", "value": "3072:tMUnIBelir7714zl4ttqJQ39k46QyH6B+:tMUoJf7254t4JQ3cQyH6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666372, "uuid": "0f313073-7800-4621-a608-e2ffca1e8031", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666372, "uuid": "0569d140-bb5d-4f49-a528-f4447a50fcd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666372, "uuid": "16c31f78-f3e8-4516-ba21-4e256cfa7d5d", "value": "bulu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8268514-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706697926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "ca4eacab-057b-4e81-aa00-a2f4283a6f58", "comment": "Malware payload (RedLineStealer)", "value": "a10af507a6dd8555e18a58382d45816b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "c771f63c-d208-4ef5-aee6-8e9390479bee", "comment": "Malware payload (RedLineStealer)", "value": "3f05afe0e96391d4718c7e689e8c673b92b16bc1491b89f0d11b9d4326bd5e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "ecf0b2de-415d-47aa-b818-6d6f8c50a5f0", "comment": "Malware payload (RedLineStealer)", "value": "1a6733484dee9a80cfe5e7ac39fe1e374074e112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "3d11c0aa-bd95-4c95-9503-ea8b7eb43d4f", "comment": "Malware payload (RedLineStealer)", "value": "836288b1a5cdab68a8b4faf6705aac587c6656742a091b689e6fbca10923e2164fead866593bd8eb01009c3cd9c19ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "b5068d29-979d-4b63-bc1f-d67a802fa928", "value": "T1B036C412FAC18973D865027D5AB90F396B35FEA716252B8363EBB75E9E1F7C06D12000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "4f8dbd45-93db-4128-87c4-3e9d8e2a5723", "value": "8b71eafefbbe45680cbcee365fed653b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "a098fb3b-eedf-4396-b615-ee953258f802", "value": "49152:laWMO9n04n+Tb4GvOC36xM2I/TdGkfTdlELaZ:lXMERPCOy6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697926, "uuid": "fc581f93-efa2-43d8-9283-a79aa88b823b", "value": 5097984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697926, "uuid": "079849d4-b245-43b6-95af-f5b0e11f0b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "a8232919-f1ad-466a-8d48-a13aedd0cda3", "value": "a10af507a6dd8555e18a58382d45816b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e7e53d-c05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706720422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720422, "uuid": "7e96b947-3c2d-4a5b-94f2-6e409f04f84a", "comment": "Malware payload (njrat)", "value": "1d641a341df0631bf135f5767440df01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720422, "uuid": "7f87d108-bedf-489b-b0e9-4c263db697a0", "comment": "Malware payload (njrat)", "value": "3fa1b0d5ab8cc2b3435718e8b625e63e651a6d3df4d7657dc8c3859caeb5b4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720422, "uuid": "4012034f-9e75-45ba-9ff4-66ce5268e4f9", "comment": "Malware payload (njrat)", "value": "2e76be5d5a7f0bae3657a649eb60f47c4fbde3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720422, "uuid": "373fa3b6-a327-4cdd-876b-d9ab9e87ef53", "comment": "Malware payload (njrat)", "value": "c24023950c096c92d665039b8cb7a8c10aa47c6e757d83da19986a23077cf5df6a47ad42846ecca5e46f4823507f2332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720422, "uuid": "7108dbe8-6d63-471f-ad10-22782e98128d", "value": "T13D032A4D7FE18168C5FD467B05B2D41207BBE04B6E23D90ECEE564AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720422, "uuid": "523a14ac-5135-48a1-add6-8595e7d01015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720422, "uuid": "1628f59f-ca63-4861-9222-c22407929eda", "value": "384:KstKUiDtblmJEpRGyEf7JfJuQCY6iX1rAF+rMRTyN/0L+EcoinblneHQM3epzXk/:dtiHpR9Ef7JsQCFilrM+rMRa8Nuelt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706720422, "uuid": "d84a767f-da44-4adb-89b6-e62fd9e75249", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706720422, "uuid": "c276bf72-892c-4139-94c0-3cb74b23e28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720422, "uuid": "f5aa5ad1-9bdc-4b27-b9f5-78713ffff3a4", "value": "1D641A341DF0631BF135F5767440DF01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732d9f45-c016-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1706691314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691314, "uuid": "450d66a6-ae78-4c8d-896c-1bb2e1fa3a40", "comment": "Malware payload (AsyncRAT)", "value": "6b2b82774ca1bc161170a2a803638387", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691314, "uuid": "0d4b4738-fc0c-4ab2-8511-db8f31e921b0", "comment": "Malware payload (AsyncRAT)", "value": "40b2c8937a96f8c487a16197cbdd1394d12fba0141571f8b529f94c87f5e56c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691314, "uuid": "d5a3aa21-c1f3-41e0-8675-5610a26caad6", "comment": "Malware payload (AsyncRAT)", "value": "90ed4f5d751c48ce094813b9971af6b42ccd83ad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691314, "uuid": "1bb8a7be-df46-45ed-9186-536cef8b883e", "comment": "Malware payload (AsyncRAT)", "value": "2b35e7aa214d51b7d66fdb2a0ef519cf90710443addcf834137824598dae3901b43aa3080188243ff162e014eb223fc6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691314, "uuid": "4172665a-c73c-4b57-ac23-7f4305145fed", "value": "T1E1A5BF907A884ABCF07CF33D99C8524E53F979DB6311E205FFCBF98845B25468AA0D15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691314, "uuid": "ca060875-8148-4b71-86e5-e9c0d55c98e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691314, "uuid": "271edf1e-7867-4e96-a2ad-b71084438795", "value": "49152:o3TAXbGranK0EOOY+2sduESYKgmSvReju+txoZAmAc:o3UXbGra+OodXNmSpeq0xUdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706691314, "uuid": "fe67ae92-cda6-4a71-b1dc-057c6dae9134", "value": 2146304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706691314, "uuid": "ac333ecc-d80c-4c30-99c7-0a0e6bbe3c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691314, "uuid": "92b5d086-c2c4-470a-beea-7368b23a15ed", "value": "Noviembre Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80447ec2-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706699067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699067, "uuid": "f20f92c5-7310-4660-b8b0-fd169958d2cd", "comment": "Malware payload (AZORult)", "value": "7b197b04dd19f7f18076d041d15ed7ba", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699067, "uuid": "c6ccaa4b-f03a-4948-b410-fc2ee25d793a", "comment": "Malware payload (AZORult)", "value": "412060ef12b49d0e5f5b2b63f4f396236ce606484d16283718d3478db8899e38", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699067, "uuid": "ae96fc30-87fb-41f7-aff8-4cb5208d33ea", "comment": "Malware payload (AZORult)", "value": "01e5a7771040ab842d9331ee873434090995f2bb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699067, "uuid": "e6d5015b-e12e-42f7-b49b-c7ad5f6901df", "comment": "Malware payload (AZORult)", "value": "2bea3f0ad6b1770327ef0f004c25d492ac9f3c0c2806463e192f1a8c1924c51bb19e4afc1236d69d439e9f0a41fa8b5d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699067, "uuid": "a0a0c64a-e1c8-4567-adb1-add2e5ea235b", "value": "T138D46B31B78BACA6C4190CF2515E03EF08D0E7AF165457C3E395ADAB7F2A581861B8D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699067, "uuid": "6346b557-0667-43c2-b993-05da3e4749b8", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699067, "uuid": "770d064f-c718-4688-84e6-8b236b8713b8", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLwXHer:AQy6ONsqLwX+uBD8Trv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699067, "uuid": "e02da5a9-445e-430f-857d-39de91352204", "value": 635814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699067, "uuid": "01913cdc-0b54-417f-8e72-056283577959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699067, "uuid": "cbedd3c6-520d-48c4-af12-faf1bdcc45ab", "value": "Ziraat Bankasi Swift.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c009c0d5-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706718072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718072, "uuid": "6880c60f-d7d6-47f2-8b91-3500a39e27ba", "comment": "Malware payload (Gafgyt)", "value": "b6a7d4e46e50d7802fa06fd2cfcd682b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718072, "uuid": "e554cba8-ba73-45d4-a349-fc0d5d7a6f34", "comment": "Malware payload (Gafgyt)", "value": "41c8613a1bfed9de53e3f51b001bb101f48a43fb3ec7578e168e15074b63bcec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718072, "uuid": "8dd6d81c-90d3-495f-b93d-74740db5c4b6", "comment": "Malware payload (Gafgyt)", "value": "401923dad02f94628a87e11026a9cc6a98157000", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718072, "uuid": "0de63761-73d7-4ca1-a859-199defa8e0c8", "comment": "Malware payload (Gafgyt)", "value": "796f4bd0402d924302d175592587c067e977259665848d502b9f96455aa75507dc85c2a6dc972a40e8cd1356b81cd248", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718072, "uuid": "03aba049-9fff-46c3-9549-22eeb9331dc0", "value": "T15683F741F801C713C2D327B6B78F8E293E3567D477DB331666347AB82B837891A26A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718072, "uuid": "88dadac7-34ee-4e45-8070-be62446a607b", "value": "1536:u3NInWzesoCjU/OMI0qNXRDMCYKMN3n+ztJVSshZm47DQzaLyKsR3n:6JqCj908RNYKMN3n+ztnSsHm47DQzaWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718072, "uuid": "fd06073a-045f-42be-a037-471666331112", "value": 87711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718072, "uuid": "306a3f3e-8303-4b9b-9508-dbdb6be5df6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718072, "uuid": "0b8221c5-7400-46f3-a898-489e2e68f8de", "value": "b6a7d4e46e50d7802fa06fd2cfcd682b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b4d945-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706698677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698677, "uuid": "64d53cdd-cf6e-43a3-a54f-6beae8a2a68e", "comment": "Malware payload (GuLoader)", "value": "54a46bc4871a21cc6f021a37fde810b5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698677, "uuid": "cd133a1e-6b0d-452e-830b-0dbdeebb11df", "comment": "Malware payload (GuLoader)", "value": "41f58f5f7802492e7b64c9bbe35b9a096bb10ff269f797ce68bc5393fb8d24d9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698677, "uuid": "b2a8367a-306f-4a5f-91b7-462439a7fea0", "comment": "Malware payload (GuLoader)", "value": "3fca14217a9de68c51987e8013d4d581b4791e24", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698677, "uuid": "7fda0a14-38f1-40b7-b800-67ee0cd59319", "comment": "Malware payload (GuLoader)", "value": "e5359c5185f07db2c02b4ba6770b4efc79fd990321e2cecdde857d041e62f0872f8aaf22363f5063cc1c2221540c1562", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698677, "uuid": "4c902277-d966-4a15-91c1-c49d190b4274", "value": "T1A692396181C31FBA5E472FF8C84BF5C88528C5219D3E1053EAA6439D70129D8BFE9DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698677, "uuid": "34c8da85-4e1a-4f61-86f8-a82e2cd0beb4", "value": "384:wSsCFI+IyHZFS5/R44wmWEiSuVybFu6aMIiZ73k:w4F1JF6ui4yb9MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698677, "uuid": "55a55480-5460-4d28-83b8-e0ef3e89532b", "value": 20328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698677, "uuid": "b2a26f75-f2ec-4437-9ac1-d949fba76366", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698677, "uuid": "361f747b-0a70-4552-be42-9e2d52ec73b0", "value": "Swift confirmation Advice_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295aca3e-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706682171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682171, "uuid": "ea59bc1e-9735-4126-b842-447752cbc660", "comment": "Malware payload", "value": "0fb9f599e28c96bd74cd19f70cbd0920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682171, "uuid": "8f8565e6-4d1b-47aa-95f8-bc66daa97e0f", "comment": "Malware payload", "value": "43a2c6d9ec59cabe2e4ba0a6f6b35db8abcd9ba772c112b178f6d869e3c376f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682171, "uuid": "0def933c-b7f5-4a0c-9b4b-2d9c19adb903", "comment": "Malware payload", "value": "8dbd2dc193e3d3205378451694ee14e5754893e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682171, "uuid": "4d3ae8c7-a313-402a-bd0c-f71ab5195192", "comment": "Malware payload", "value": "bdd37ed1a82b2d9eb98e641bf5a8c2e654e8909dd904bceac4fef0d6d45fc4fed6184bb14f6afb62967902f5fc57e427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682171, "uuid": "2b9e3978-f58e-4aa4-8bc6-90adffbb5199", "value": "T101968E26FB4AC437D0721A788C0B92D85529BE103E34A89777EC3F4CEB35791792529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682171, "uuid": "1e9e16ed-ff42-418f-8e92-4869764ad4fd", "value": "ae982a901e853f4a6c8de6b8b51a0ece", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682171, "uuid": "cbd087d3-407f-431b-b941-a0412ce55b40", "value": "196608:bgELAuy/PXQi7Yuvv/nWz29n3+la/8i1CwLv:8yAv/PgyvvfWWOa/S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682171, "uuid": "188b84ff-f401-4203-a815-0bb23894f3cd", "value": 9062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682171, "uuid": "93e3e7f1-e498-4eb7-8750-165446f7579b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682171, "uuid": "24dc95ef-481b-4e7e-b13e-07c62dcb18fa", "value": "SecuriteInfo.com.Win32.BackdoorX-gen.11500.22380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e615c9a-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706698044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698044, "uuid": "9498e203-58f3-463c-81ff-f6f34d5d6b77", "comment": "Malware payload (Formbook)", "value": "3ed6d3a7d0e595416a2d61d3955bb50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698044, "uuid": "37681081-d5d4-4745-a8d4-1788a580934e", "comment": "Malware payload (Formbook)", "value": "43ac733f64df5f18a72d1f36a3c5ae365f5cd791d855d72a9f887015bb71adb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698044, "uuid": "0cceead7-9dbd-4590-89ba-f36246224447", "comment": "Malware payload (Formbook)", "value": "4bf78ccbcc0816bfd71757ce93d701f3e0a2a286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698044, "uuid": "dcdb3c5b-ac40-48d4-af59-45195ad8d00a", "comment": "Malware payload (Formbook)", "value": "f18c93cf36196673f49711e28be798e417d2da91d4d38bc43b94bd4c27037dd32f77d901efb26abf790592f92ee75813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698044, "uuid": "4e937079-3437-4309-b6fe-6151ad653ac2", "value": "T115E423017536EBA4C17E67F86D589E1103B6FF46D00AE709BDE968D9ABF33010B41A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698044, "uuid": "83289a5b-0e6b-4daa-9f5a-fcbfc8d6c95a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698044, "uuid": "4f6ba3a6-2387-46f7-ba42-ba7244c93703", "value": "12288:plhlfu8liC5ut1Jvr8j8qshDTA26rNu+mg6hSP2Xa36KbR+2k73NgmEpyY6PNfg6:A1Jvr8bshXDLg/33x+rTNgUPNowRaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698044, "uuid": "3c1efae5-eedc-4f06-97e3-f731c78b333b", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698044, "uuid": "d942eac6-5530-4230-9a9b-6ee3cf3ab262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698044, "uuid": "cee6a238-d68b-4689-8668-15cb9535a9a7", "value": "RFQ-SP2351521-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942c27f2-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678485, "uuid": "5b567510-46e1-4f71-b57c-e55bf21b4efc", "comment": "Malware payload (Mirai)", "value": "e1f8a03e757ae38b057f88f39d741cc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678485, "uuid": "4823e94b-0ca4-4fa4-b54c-b852645c0a6b", "comment": "Malware payload (Mirai)", "value": "43d1ed456bd6c6b1f255f875c43f1aff35bb2f42b9c6b207aa1b1ff31c3d6849", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678485, "uuid": "2389865a-16ee-4467-81a0-aafdc24f9043", "comment": "Malware payload (Mirai)", "value": "1c2b4b85c6360c7b0fe0f35e7a65711386a5dd54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678485, "uuid": "6f6feeec-74ac-47ad-b755-7cd628db0742", "comment": "Malware payload (Mirai)", "value": "72f826bbe589b28fe3706c9d78602f813ed2fe6b04176b1d01ff6e1682e4cb370c3a5dd69aa818c2acad9a47dcf889e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678485, "uuid": "ace53064-986e-474a-b18f-9fcb3435f68b", "value": "T1BA13F1E90743FB90DEE20431A5B695C96EE71218C0EFA3C05DDC5D4CA348807D0BAA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678485, "uuid": "acf2e9a9-0381-40a8-b85c-715fd6b804e8", "value": "768:oqdKdNHrIKxJBcblYlG9T0Zm3QJWvPSMt2XiSzaUEAcDCmxT3mDbsYs3Uoz7:KdeKx/2lYIT0ZHWHMaUmxDGbQz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678485, "uuid": "6110ee67-d990-4c40-b120-ad3fd80debf6", "value": 45284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678485, "uuid": "8546a0d3-0476-46ed-805f-3f47eb025c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678485, "uuid": "c1897e80-6c8c-4902-a847-79c642509595", "value": "e1f8a03e757ae38b057f88f39d741cc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5b6bcc-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718011, "uuid": "a41654c5-bbcb-49de-947e-991e01ab3d6a", "comment": "Malware payload (Mirai)", "value": "fe589f485a34a4c15d5976d7813e0f14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718011, "uuid": "a40ba97f-3262-4171-a3b8-ada424376cb6", "comment": "Malware payload (Mirai)", "value": "444e57855e6706b78880cbed4453229350f2f458db2bea2479733d9e409e2c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718011, "uuid": "24280229-1364-4279-b6de-8194696183dd", "comment": "Malware payload (Mirai)", "value": "f1a1ddfe332eec7dc30f38f8db7db82a04dd8d2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718011, "uuid": "fe877afd-5728-4ab9-8815-2c5256c30bd5", "comment": "Malware payload (Mirai)", "value": "9d5d395a276165b591595b863bfd61c2191f96a3ae93939a824ab37b4758eebcdfd99484b9ee82c6690f48dbb14c13ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718011, "uuid": "9ce33aae-d1c6-467e-999b-29f312f59198", "value": "T13A634925B97A2F17C0D1A47A21FB5B54B2F25ACE22E4C60A7DB20E5EFF116006903DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718011, "uuid": "b4cacbe4-cdde-42d3-98c0-cde7a2943d01", "value": "1536:7FhvePu5YiwQD3HIixg+AkzW+kyCV+cTiZqQO6fL69:5th5W+W5mZo6Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718011, "uuid": "793d7c9b-d975-4e28-86a4-cf309cf6bb46", "value": 67232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718011, "uuid": "9afe0813-95dc-49f8-a56e-d76847665996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718011, "uuid": "f58322d7-14ce-4476-a888-cdb1b8d2bac1", "value": "fe589f485a34a4c15d5976d7813e0f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8097bd-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686315, "uuid": "d2f33166-ca1f-49b7-ab45-8cf680870ca8", "comment": "Malware payload (Gafgyt)", "value": "9d262a31c19e8636e67b477da5c2c2e3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686315, "uuid": "409b85ff-41e5-40ed-859a-e24d3aceefc1", "comment": "Malware payload (Gafgyt)", "value": "45b9070cd889b234c7e962d94606916f68b2846a214a6d1629a83667692db649", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686315, "uuid": "2d51b41c-426e-410e-be01-8e8435cfdc5a", "comment": "Malware payload (Gafgyt)", "value": "2f5ae32e0d23bebd111d38ec1aba516794607a45", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686315, "uuid": "e6eab90a-8989-48b8-a7a0-fbdb8a026bc0", "comment": "Malware payload (Gafgyt)", "value": "dfd160eda77a9738343c2e46e21505665bdbab35db4597f9a83a4504035f325ca7e5f5a366c7299ab97d0038bd347c01", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686315, "uuid": "e0cf15a2-81ca-4c61-9bd0-6241b004e210", "value": "T18BA32903DA60847EC48B93761BDFC6225623F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686315, "uuid": "9d0ec11b-6624-46ab-9052-83e1a1ea6ce9", "value": "1536:Q9fT9WiC3txvWtfEo5vXJM9wypej++3h3EgL7nLGPTms5TDUMHYr/:Q9jC9wtsOnuejjh3EgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686315, "uuid": "425c33d0-58c0-478b-9a68-7d24da777e71", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686315, "uuid": "71152856-e802-4640-94ce-58086acea31e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686315, "uuid": "c557aaf7-2294-4aa5-878d-1950d598b3d6", "value": "9d262a31c19e8636e67b477da5c2c2e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfaf255e-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699227, "uuid": "16a9d342-0510-4fcf-a9fb-7172e48462b0", "comment": "Malware payload (AgentTesla)", "value": "9642e27071717ab3ddc215d95ac10c47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699227, "uuid": "4949748c-0249-4591-8a73-8f4a5dac69d5", "comment": "Malware payload (AgentTesla)", "value": "468447c650e0f04c8332529e6a6d51782f6d4c217da6ed105be0c4500afa929b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699227, "uuid": "d2d065f2-f62f-4228-9690-df96d1da57c9", "comment": "Malware payload (AgentTesla)", "value": "1408224b55b3b1a3aa5a895747f9febe3b8f5ad9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699227, "uuid": "87a51913-5267-45bb-81ab-7342800661dc", "comment": "Malware payload (AgentTesla)", "value": "9e09db6f1e7a3ea126bd1e34411fdf4627fed59c2e6b64809fa280c0e5b07414431b464ee9df65da995e62b8e7f0ebe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699227, "uuid": "13769baf-f908-4913-97f3-368ff3531b25", "value": "T1FAF4127376184C23D32E55F9CD5811CE03B98E3A2E83F3C72C89715D66F2BA66A49247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699227, "uuid": "19265dc3-a09f-4dea-8834-f53d2a05b274", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699227, "uuid": "6c34fd88-31a3-4387-866e-401d5fd288f3", "value": "12288:0Ha9SCF1OkZ/exdGJ5OXflnS6gPCt1UKq19MXEL4gd63rH4VJ+:ya9ZXteqadngavUKq1qhl3c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699227, "uuid": "cafaebd9-e889-4e48-968f-c66fa09c6ae4", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699227, "uuid": "bd7991fd-c440-40ee-8b16-7260cfe8c59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699227, "uuid": "b1a17467-4e3a-4914-8a7e-e2557abbee6f", "value": "Swift_01302024-pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d59b9c-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706699244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699244, "uuid": "d7f6948c-ab84-48fc-a9f9-af99f1db79c2", "comment": "Malware payload (SnakeKeylogger)", "value": "2c188078210967907fc2d5f64997e05e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699244, "uuid": "8c30889d-7b6f-40b6-9ed1-28221d66dc80", "comment": "Malware payload (SnakeKeylogger)", "value": "479464eb3f4adf0b74ade4aa491fef4eab206c0ddf5489a80d823779b4a4d69b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699244, "uuid": "d52d3bce-16ab-49f6-ab15-f0bd86a7c1c8", "comment": "Malware payload (SnakeKeylogger)", "value": "2a1a6fb369376cf74800cc40063a9ca99df4779b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699244, "uuid": "a4e9500e-4f37-47ca-a263-98afe4fd47e5", "comment": "Malware payload (SnakeKeylogger)", "value": "5949bc8bb038c8102aa4ae35b48671273e94954cff6f131678a990eeccfa20c593c29332e5a8429840cb20b3f8050e43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699244, "uuid": "98ae017a-7e5d-4f07-94f3-a83fcdff0ac5", "value": "T13AF49D9C365071DFC967C872CE981CECAA216C765F0BD207A01332AD9A2DA97DF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699244, "uuid": "c43352bb-c1da-4c97-abe4-6acfc7862f85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699244, "uuid": "0dd251e0-4677-4016-9e2f-796f2afd8226", "value": "12288:d/byR39SCF1OFsbuulCzXNMfGHJk4KouTpD+XQAzbZC1FUooRv0QWAuj8X03E:p039ZblCzNMfGHJJOaVvZC2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699244, "uuid": "78c21a56-e08a-4980-9ad0-9eacad9224d6", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699244, "uuid": "c4c28a99-a7d2-4a6f-8752-d41691145b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699244, "uuid": "237b7f15-a8ad-4088-90b9-8d1b5ab3176d", "value": "scan_meteak_2024-01-30-14-12-11.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936b1f00-c00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686644, "uuid": "b2ef8b0d-3799-41a8-b2fd-15c320205730", "comment": "Malware payload (Gafgyt)", "value": "9d3acb81b8ddd74680fefc244f0f5d2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686644, "uuid": "65554f4d-f6dd-4c93-8395-e1387733b84f", "comment": "Malware payload (Gafgyt)", "value": "48751bb793f022faca0a392d76dc74ab3f94e07329faf2a91a39f886f0a12ce6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686644, "uuid": "2b10beed-63b8-4c1e-82b9-fea59c607890", "comment": "Malware payload (Gafgyt)", "value": "1613020bf5f6b878023ce6c31e973a9876c2d9ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686644, "uuid": "b08ae54d-85fc-4cd9-9b40-e955130516eb", "comment": "Malware payload (Gafgyt)", "value": "85c84895ca14a03ac1b391d6994d7d953ab0a242aec31f93b76b817cf6c45a62d97211f48aa7894766ee5e818ab43c86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686644, "uuid": "23253ea4-9549-4fe1-948b-221734e9758b", "value": "T1AFE34905DB408B17C1E2277AEADB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686644, "uuid": "7fcef485-482b-46ef-a04f-dbea6127a4c8", "value": "3072:ut8iFDKEfFN+Fa+1sW5h7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNwh7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686644, "uuid": "de220334-8efa-4646-9563-763be6124932", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686644, "uuid": "f39dd3f7-3de9-463a-b0dc-854db62f5653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686644, "uuid": "b25b7672-0274-4e4b-8141-3df47f92c66e", "value": "9d3acb81b8ddd74680fefc244f0f5d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7acb4d6-c044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706711186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711186, "uuid": "21443aaf-297d-4789-98e1-252067615df8", "comment": "Malware payload (RemcosRAT)", "value": "7e24025c6e30002439eefbff4209bc27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711186, "uuid": "3fc71426-4944-4829-b470-b6a27dd330af", "comment": "Malware payload (RemcosRAT)", "value": "48864de26230a966a7b91425ec7f388726e8ddc5fea72f686d551dc49654cbc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711186, "uuid": "4f798607-370b-4ef9-aee0-c943195fc62c", "comment": "Malware payload (RemcosRAT)", "value": "af6396b22bd9f2473b228bff01b7cb41782f8b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711186, "uuid": "6b2a06de-9fa4-42ba-b0dc-46f8d90ef69c", "comment": "Malware payload (RemcosRAT)", "value": "1c658151c075fb683f119d71cab8ab30eee3beb514adb06767baa5391106fbaeabe76d7c27d27b10a098379fd0fdb86d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711186, "uuid": "703517e2-aad9-439b-86c3-0e135b0bdf87", "value": "T114252301F5789F5AF87647F52B62949113B67CAA6870E35DBC8D30CA29BBB014612F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711186, "uuid": "a77f6d0f-4072-4658-af79-70c9d73352bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711186, "uuid": "30ce8cbd-4528-4d41-915e-85b635466ef0", "value": "24576:u8bshPs/eQdOEVw9OM8hdnPveDnLkZOjkVJd:ZbYsjOpzi5O7oU8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711186, "uuid": "5582331b-c3dc-4572-809d-103eb8f585b2", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711186, "uuid": "89d3df5d-237a-4a8f-987c-124776c9d2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711186, "uuid": "707500e7-92e8-471b-87bc-2338c3db2e11", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.710.19709.25330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c803e918-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718086, "uuid": "2b2d3397-dd21-437d-a5b3-be31fbc55d28", "comment": "Malware payload (Mirai)", "value": "7c2e77cb23dab7ee73758c1d745c5160", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718086, "uuid": "b41b0ec1-8103-401e-a6b6-18b80823d6a9", "comment": "Malware payload (Mirai)", "value": "48e218ae68d67028b19b2261286563cda48a9086c01cea5245026d464ca955e9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718086, "uuid": "aacc9445-747b-43c0-9c52-68adb30e1975", "comment": "Malware payload (Mirai)", "value": "5bbc6562f8ca516f9a4e1c946038b567083ad0c0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718086, "uuid": "1d546049-d82f-45b7-88a7-f0bdd2826781", "comment": "Malware payload (Mirai)", "value": "e09ff10406bb2e9293125d77f2d8967b2bfa5596a2d4e52308f04dec1c849146c3b2143b8fae4a7428c502ea30ee5edc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718086, "uuid": "dce6bb3f-bcc1-436e-846e-088eacfc4f29", "value": "T132D33A17B6D1D0FDC8D9C1B44FAEE13ADA32B52D1134B25F2BC4AA232E59E205F6D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718086, "uuid": "a2204573-f508-4af3-a527-3c1f4532c7ef", "value": "3072:Qny+b8Y3H7A3hgCVcveRwt4i9H+34G90yNTWDc:Qny+4Y3Qmt+nNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718086, "uuid": "316ce1df-30b0-4d32-ad83-dd247688e994", "value": 138920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718086, "uuid": "3b7fd8a1-09ff-4b39-b9c2-e7607b68871d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718086, "uuid": "3fbbe04e-2755-403b-bcec-1fee4e5e067f", "value": "7c2e77cb23dab7ee73758c1d745c5160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca06df4-c00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686633, "uuid": "5b6eb615-3133-41c4-a71a-dd551abc3946", "comment": "Malware payload (Gafgyt)", "value": "0092f7c1330caa2f58c3cf7a36be10b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686633, "uuid": "833e02a8-382a-4e5f-b26c-ccabd15cf3fd", "comment": "Malware payload (Gafgyt)", "value": "49136f1a02f8a271d42663d934732f3672568bfb521d080d95eb349bbe48da8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686633, "uuid": "6e213ce3-d29d-440f-bab2-d527b8dfa580", "comment": "Malware payload (Gafgyt)", "value": "922a8aabbb69dade2b6f6d7741ebd08af4069be2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686633, "uuid": "bf77cf97-a567-4f83-b3e5-fe204270d2df", "comment": "Malware payload (Gafgyt)", "value": "4f24f81fbbe9474fdff5c751b837c234d3bcd9fa85c5831a26f2154aec7b356639d650e2a47a57b7bfdfba540f3fb5e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686633, "uuid": "0e2a0759-f46c-43a3-b627-8711062b9f5f", "value": "T191C32A2327670B23C4E9503441E75337B7B5CB843878934BAAD0AE9C2F1AAD435973E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686633, "uuid": "52ebfbd5-194e-4e04-a910-71455596a304", "value": "1536:lIR8jc0YyVNM2ZwoL0QImVv6Fuo+uU1t6TQM9KGmuwA/KiyYIW:ZcVyVNXZPVvaFZpX4GmuwACXYIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686633, "uuid": "1b1b9d1d-f445-45c3-8559-9b497158214d", "value": 119963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686633, "uuid": "52abc88b-945e-4a7a-bb78-53b3941c4a86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686633, "uuid": "f5ec4801-e267-4edd-8866-e094ccd57d3a", "value": "0092f7c1330caa2f58c3cf7a36be10b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5206561a-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706698990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698990, "uuid": "4a643601-759f-447b-8f23-fe36f228d2f2", "comment": "Malware payload (Formbook)", "value": "5aedda64bb9578a2b66123d0896e9bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698990, "uuid": "6e425536-5ac5-496b-8716-addcee360723", "comment": "Malware payload (Formbook)", "value": "4a4073a087fc83e0d07be057dc3ad709284608f700c16ccfee186a35bfac01a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698990, "uuid": "93178bb0-433b-4448-87c9-92a1c2c0e712", "comment": "Malware payload (Formbook)", "value": "b57788d7fc512c532bdaf8ffb1de09c8001d337e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698990, "uuid": "a704e9e9-9f47-461d-aa45-72727dfc7510", "comment": "Malware payload (Formbook)", "value": "219dfa0aa7952490c4b4f7acb42583ade762cd64bb7e3be70d7a0d409bf7858054b0ff4c362a96ba1115d04efe18c6b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698990, "uuid": "54b4bfb9-88a6-45e6-96ee-7eb7c31ad5a9", "value": "T136C402289A349F12F93C0FF221B4B951E3F222972516D7B95CD920C52BB3F650B05EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698990, "uuid": "bb6af240-8f2c-47a1-8c7c-3208dfbb5c8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698990, "uuid": "14a23ea8-16ed-4445-abba-bf3ca6cf1c8e", "value": "12288:p++aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:pZa6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698990, "uuid": "be4d6788-0694-46f0-942c-d3a774897f9b", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698990, "uuid": "407f17fd-9401-4a13-881d-8a6b86c38aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698990, "uuid": "20dd208c-83d0-45b6-8a3a-82e86d5d6471", "value": "NEW ORDER LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dc6ddd-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706696934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696934, "uuid": "8cef469e-7a97-4439-85b1-4653a0b15ba9", "comment": "Malware payload (DBatLoader)", "value": "cc270b54e563b04fa4499272ae312478", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696934, "uuid": "16afe8c6-7d5f-4e65-841c-497bd0ccc94c", "comment": "Malware payload (DBatLoader)", "value": "4b81650f9fb5cec8ebf10bff5ba7fda8575fb8f531cd0d823a25d95979e50cbc", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696934, "uuid": "4d2c327f-ee66-4e19-9bb5-b556ffa68094", "comment": "Malware payload (DBatLoader)", "value": "53fee45f0f6300df3728687d0dd1e7e1bfc4bce0", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696934, "uuid": "f3f396b3-5f43-49e6-8089-5c1a1784afe6", "comment": "Malware payload (DBatLoader)", "value": "49c3a27216a0a605b85460cb53444d8529c8f15fb0f3df0a2f841dbee230bcd01e2043ed8e85bc181f25e2a0502f51aa", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696934, "uuid": "a1cc6e68-590b-4897-af3c-99f1731a4d92", "value": "T106A5D023A2D14833F126A57959977BA4E92DBD202C357D863AE53D08BF333407F186A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696934, "uuid": "0058e890-6d6b-4412-9ed6-e9587f740284", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696934, "uuid": "1f8b2c93-231a-4f60-a38c-4ace9a334c50", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOPIaF5P0R:pqAo2hd7Ymu0gOZuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696934, "uuid": "aeb3a144-60a1-48b3-b8a7-a0c706f13186", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696934, "uuid": "6ec7c062-aeb2-41d5-889d-a37a5aaa77ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696934, "uuid": "279d9cc5-a894-42c8-86e6-3f3410bcf8ae", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646bc46f-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699450, "uuid": "35d70878-0416-4c0f-8e7e-8f27bca5d5b6", "comment": "Malware payload (AgentTesla)", "value": "ea51d9e4f9e147e18f25ab84e7749397", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699450, "uuid": "363c36a7-314c-475c-9a78-38b4399128e3", "comment": "Malware payload (AgentTesla)", "value": "4bcbede0164a58dccab4388e3d4711e0b5b7f3e49ee55e426814ffb9b1851a4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699450, "uuid": "8a82d22a-7580-4278-9a59-2c1b03910031", "comment": "Malware payload (AgentTesla)", "value": "cba66b1b096594b657c485cd5b4b10ac3e20351e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699450, "uuid": "58bacc56-7691-4c23-8f05-03c8a5934385", "comment": "Malware payload (AgentTesla)", "value": "d782605db0274e0e699ec8c7f0f5e5716ec78eed5aae439eb29b47f1c98bdcf79476076a0ac950e60b267662c8d2912a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699450, "uuid": "73390117-ff86-4e9e-b47d-a2b1a74d0785", "value": "T112F412103AE019A3DB5C4BB5DD6456DD03B56E313D61E7EF3CC830A999B3B924A82347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699450, "uuid": "59fdd93c-385a-492a-a101-82647cde9dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699450, "uuid": "84f97a79-d956-4b4f-91db-fd36f6787108", "value": "12288:dZw39z9SCF1OGgTMqqgsSQI31x/P0H5YoV3+MqO+E/ptV+6PMhRDTkYq/UD:dZez9ZngTxiSQEx6YwbJHByRpqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699450, "uuid": "281c9b06-abcb-4c71-b343-2bc4b4c02f8d", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699450, "uuid": "d93e37d7-e8d2-486f-a5ee-e89caf6a085b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699450, "uuid": "33d8e81e-fcca-4bfc-82d7-64af2a180847", "value": "YEN\u0130 S\u0130PAR\u0130\u015e 020111300124 METEK RFQ 2701203.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902662d8-c00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686639, "uuid": "b18988bd-f47e-4afe-81ba-85dcaa66459e", "comment": "Malware payload (Gafgyt)", "value": "530dc5b93e4168c61e1b1d2fe33de3e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686639, "uuid": "6b70718a-c683-409d-ab61-9a91625314a6", "comment": "Malware payload (Gafgyt)", "value": "4c478975492e64f6d9a127a0b664a9dddce16ebd334b1dd2cb0dca5e87de8d19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686639, "uuid": "877213d4-d72e-4860-870a-6ac5a5c6c10c", "comment": "Malware payload (Gafgyt)", "value": "b3db116f2d21e461670aaa93ddbdd4139be282d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686639, "uuid": "a904d489-6bb1-4a72-a607-9636ac7591ea", "comment": "Malware payload (Gafgyt)", "value": "9dc457463e3f879f3facd05d6427dda2afd18cf33fb5082db20c33365e73bff2274a47cca3e68f1ed0ccb7279f79bf4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686639, "uuid": "52e5998a-26e0-4bac-ad4c-eda0281cf68c", "value": "T176831A46D3A2C5B3C4831BB605E7D72B0231F9164B2A9F0AE36DAEF47B12584719A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686639, "uuid": "d3580935-b899-4988-8d86-dc23a3c888ce", "value": "1536:L3oLQ5TCzSVYERb1aGy8gwi5viMbBZzp6+m5CsNFPVYLf0:D8Q5Tv+U5aH8VkqMfp7mwsN1VYLf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686639, "uuid": "82d653f6-c5a2-4ef1-85aa-a3aebb81eed1", "value": 87461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686639, "uuid": "e4cb83f6-ae71-4526-b229-3eed0b6f4f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686639, "uuid": "8c689d12-c289-4fb1-a7c1-0240270e0d1e", "value": "530dc5b93e4168c61e1b1d2fe33de3e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6739f66a-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706698166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698166, "uuid": "1809ad74-c185-43f7-9b26-b0414836d1ab", "comment": "Malware payload (SnakeKeylogger)", "value": "395be4940bf35809d5bcfe58646b278c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698166, "uuid": "022dce89-fb69-4cf3-aafd-435d6b240075", "comment": "Malware payload (SnakeKeylogger)", "value": "4c5fe2c863349aa4f43dd9f9f932dac11576832a12bc5e84b840c09c1308f540", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698166, "uuid": "6fcf6b11-1a7d-4aa5-ad2f-c6e486598901", "comment": "Malware payload (SnakeKeylogger)", "value": "02b01088e3bb584641281c36118c930f3c9b963d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698166, "uuid": "2087fb6a-ed6b-4eaa-811b-70927864176b", "comment": "Malware payload (SnakeKeylogger)", "value": "0c9b87b4e2b4b114576e71dda30543bd82297381617a185ed2939a59512af6799ae911c049e83eb23d2cc61a86530043", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698166, "uuid": "d606dfb6-5116-4a58-b286-536b953bc27a", "value": "T1D9511E112AD612D8D2B7873567F9F7B78666F4A4E92E9E79014082848B71500F822F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698166, "uuid": "df273659-cb17-4580-b5df-42649d026792", "value": "48:8WpIFxPRj6GufOMcLjFdkvYAoiYetabc:8eIfMcdmgAYet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698166, "uuid": "2afe0eb3-540d-463f-8613-41c5a5ffbf13", "value": 2573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698166, "uuid": "7364ac44-b5ca-43cf-a50e-e396300f53dd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698166, "uuid": "4dff750d-b453-42c7-ac74-69b7de0eb97e", "value": "Image012.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac044a7f-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699141, "uuid": "b98a0dcc-2729-4008-a74b-02a7f7458585", "comment": "Malware payload (AgentTesla)", "value": "22faa6717a1849b2638dadbafc09cb1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699141, "uuid": "8e861045-364f-4874-ba52-7eb9ddd45c16", "comment": "Malware payload (AgentTesla)", "value": "4d290f4b37dbfff6a41b0fbe03f1f8af96ac78b86f40b726090f48e86c854834", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699141, "uuid": "b6766a2e-0407-4e39-866f-80faa03d26df", "comment": "Malware payload (AgentTesla)", "value": "52ad42dca0c5d5dbe22cea7d761cdbe9e159d29c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699141, "uuid": "028563d3-b955-486a-8da5-37e704f16c61", "comment": "Malware payload (AgentTesla)", "value": "65310b3a265ffa898ed08c2be824de69da79cf77ffecefda16f4648e351d8ee5d23d240a8be9a5d940acc6f5eb9311af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699141, "uuid": "5e4434bc-8d78-439f-a8e2-d3861a7091b4", "value": "T1C9F4123537849E13D8BC82B0DD1412ED8776AE61BE55D3EF2EC4305D9AF2B428266713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699141, "uuid": "b3851776-b410-48fb-9874-446a5ded6847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699141, "uuid": "502f097c-716a-4ca7-87a4-a51e43c1daa8", "value": "12288:SZRhS9SCF1OcOl0sZaRGXQggQlnnlxJ02a7VgWj2mepg8whqBg4HGOpdtHCkRrvi:SZRhS9ZPUaRaDP/C2SVgvpJwhqBgNOpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699141, "uuid": "995c3571-1dc2-425c-8140-727f487d146d", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699141, "uuid": "cb0fc1c5-531b-487e-8e12-fe9dfae66ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699141, "uuid": "ee642fb3-a8a0-4a05-aaed-26f061298c6f", "value": "FedEx_23241747012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed1de82-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706718070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718070, "uuid": "f0367f70-5c69-4eb8-9253-a3ff7d6b6686", "comment": "Malware payload", "value": "546c9f28d625b72d7e9407a8984f8bb5", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718070, "uuid": "a0b64a30-1560-4fbd-88ce-7dfad2271c24", "comment": "Malware payload", "value": "4e70dec2c1926d006867e9fda265e40be028c2d3adf5612019ee22529c8b06b6", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718070, "uuid": "021133d0-a788-4ce1-ac20-c95b20a0e6bf", "comment": "Malware payload", "value": "67a3d13e6483c37c9fed992d6dc52d38068bb248", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718070, "uuid": "4d545713-31d1-4ace-80aa-8ad5a20099bc", "comment": "Malware payload", "value": "74ceeed20cc99400bfffda17494f0b3bbd1e684be4249f2fcddd24d85717805c4b6fa7b75584665e7f3d8c49b036f02c", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718070, "uuid": "64f1c7a2-b89d-4c5c-8d4e-f1f5b21eab18", "value": "T19C23B59A3BF48FA3C1AAAB78A46207452732C16A7A57F7075C64023D9D933FE3D11513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718070, "uuid": "318be645-5d1a-4a3f-8754-733eba98c9dd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718070, "uuid": "02833b83-592b-48e0-b2c5-7cf35a5a9900", "value": "768:OIQCwg4OD+ZLC/Onqgzx22D2/f6hsOuFgHK8baHh8L:OLbg4I+lC2ps6hs4HnbaBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718070, "uuid": "2d944907-c2f9-4e29-8245-195ce9b56565", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718070, "uuid": "fdb5abaf-a3d4-40d3-933d-5a10fc262595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718070, "uuid": "560f89d4-d32f-4959-8fa7-afd4ff442ada", "value": "1706718069eb943eb4ddff2e12ee26b2f3850e2a60c350f01b52a5d8832946a03ba0fca07b148.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda6181-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687818, "uuid": "235172e6-1524-4b83-8334-d4628639d71a", "comment": "Malware payload (Mirai)", "value": "a5ae59ed76135db6ae7853650ab555ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687818, "uuid": "c63374f4-6962-46af-a59a-043972f90b6b", "comment": "Malware payload (Mirai)", "value": "4f13fe5ba32e1c42a76bdbf63f50b23535819df888f88dfac810bae518044a81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687818, "uuid": "3ea1519c-ad11-42a4-be31-8203796123be", "comment": "Malware payload (Mirai)", "value": "28482141314c19333dd41d15f40f200cf8cb267a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687818, "uuid": "15e3cafe-fc3b-45ed-a947-71420947b6f2", "comment": "Malware payload (Mirai)", "value": "e6b94a1821cf219e1f0f11010a2ad20e4e9b50882f59bdea8fc8ef9287c88ad5adafddea22d18ee027f54bcf554becb7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687818, "uuid": "49ade0a5-3cfe-4cc1-b14e-3cef55930aa6", "value": "T11F04A81E6E228F7DF668873147B78E259B6C23D627E1D684D1ACC1101E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687818, "uuid": "522f3131-25da-4a39-a841-b5aead323361", "value": "3072:C+u2H6rkbL7K5lo2AeSg/1T+jDpAhTR0kRTtBsu/:C+u2arkv7K5lo2Ae5Ouhuk1te4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687818, "uuid": "9c7daecc-b57f-40b0-8109-f752ca9894b0", "value": 181968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687818, "uuid": "9af13add-d08d-412d-bf27-3b781a37d7c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687818, "uuid": "09755e3c-cd98-4978-97db-600889ca7ce8", "value": "bulu.mips-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994f6b67-c090-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706743777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743777, "uuid": "606e6468-11de-4e1d-adef-3732c46c2043", "comment": "Malware payload", "value": "7593160becfbd5ae09f5669317f989d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743777, "uuid": "3b216441-302b-4af6-8a57-ed43bc3ba3e3", "comment": "Malware payload", "value": "4fa8dd5b8845dca5c4b6cfb7605771eb64a89ba3955ea871db9340d65c63e93e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743777, "uuid": "a79b04fa-c49b-4bc0-b21b-60ab06fd049e", "comment": "Malware payload", "value": "39e6d81725dfb0c9f0fb44fbce967704258b38a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706743777, "uuid": "c5b5eaee-e920-4b6d-a246-84213f3d67cc", "comment": "Malware payload", "value": "4b1c9238ca8f45bf3a0d22b9b7e6b09b9cb2760e29dba98a218e5d73aec314114eb721a57f50bbf75e3580c5e9f5ced4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743777, "uuid": "e6f310b5-a7b8-4c8c-a363-3cc83cb6d140", "value": "T19636235BE56B68E1D4BBC0749443312FF92230698334FBD767964A938B227E4B63D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743777, "uuid": "75e936c2-3eae-4027-a2c4-500596593477", "value": "3222696f645a8dfcc584ece0da196d37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743777, "uuid": "55a0bd67-83c0-4a47-a384-84e561f4d289", "value": "98304:iKcqfYYTQEx+yDuqS7GLW+niP8U+Kg4Y7KkNMGZhhWvenqjbrjK4fei:zHfYYT6yD/TNiPTY7Ke8vvbrG4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706743777, "uuid": "64e5beb3-8141-4493-b9d1-94f51cb38de4", "value": 4949008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706743777, "uuid": "057403d7-a954-4d75-857f-39042318709a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706743777, "uuid": "2e86efb8-2e9c-42d7-906d-9efda75b8adb", "value": "SecuriteInfo.com.Win64.Evo-gen.20834.11238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7acda0d-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699241, "uuid": "90f855b8-c900-4632-8e9d-961fd429cd9b", "comment": "Malware payload (AgentTesla)", "value": "3cf9d4c582d4e6c778232b20ef0a2f2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699241, "uuid": "b635a18c-8b99-4907-9b32-5f240c40c2cb", "comment": "Malware payload (AgentTesla)", "value": "514c70bb8b43632b4e1683efed893aa22b3032bb3d28696dace6bab49798eff5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699241, "uuid": "13531239-f0da-482b-9f60-df8baf4ddb66", "comment": "Malware payload (AgentTesla)", "value": "da1dc2c47a696ff29d34c61489b200ddebdd3b59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699241, "uuid": "4349ea29-4a43-47bb-8ff2-218a173cf27c", "comment": "Malware payload (AgentTesla)", "value": "f5c29a2138f3bb24caf65e046f2309b86a92a07122cac00220f5ea95cfe46df4679d3b11285fdbf1898ed554cf5cb823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699241, "uuid": "c3be6286-d754-404f-a30b-626d831685a3", "value": "T1DDE4121877A90A2BC65D4671CCA052CC473AAE267E5AE3EF1EC831DC6CF37954A42713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699241, "uuid": "93686bbc-3171-42f6-a1ff-51734eb2bd14", "value": "12288:DV+xUDrMMc0YqVuBQEnWZF/Bj3Z2JSi8WIuFGvtmzr260HkPS6y/:B+xUFc0FVuBj6/Bj3Z9i8WIPcP260EqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699241, "uuid": "67715c54-8866-4b2b-89c3-5625ac42020b", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699241, "uuid": "5efa85fe-3337-4b86-880b-59d87d5a2cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699241, "uuid": "966afbab-3d93-4994-aeb7-e30fa2cffa01", "value": "DOPIS (08).docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99ad334-c045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706711699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711699, "uuid": "65bf7e30-3ec8-4d18-b1c8-66e69d904d7e", "comment": "Malware payload (RiseProStealer)", "value": "ba5653f9288f178c15ddf6606929aab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711699, "uuid": "53bab3dc-ca70-47af-bf63-9a70ffe34acf", "comment": "Malware payload (RiseProStealer)", "value": "5239eb589ac4d96a633db9d7031f4e04b3d07268aa42822a228a0eaa6d94c1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711699, "uuid": "c7ed8988-da0f-4863-be78-a460a7bbd610", "comment": "Malware payload (RiseProStealer)", "value": "10be19e180fbbf689339514dc397b248b6fcac13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711699, "uuid": "641215d5-6605-4260-b58b-97d908b35005", "comment": "Malware payload (RiseProStealer)", "value": "ebe8c73c3a1d60c1463ac0ec5fddf82a357a5ccbcf3c57e574046335f26c7dc81f8edefc606717e5ce17b8a3f4161aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711699, "uuid": "103ed608-a4bb-46ca-8136-2925563de5d3", "value": "T11EB533F48C32D2A1C58B177A64666710F2D7BE0B6C64D46E38D2F2865B3C67D2EB8C44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711699, "uuid": "38fe4e38-c5db-4442-83a5-d993194e1b47", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711699, "uuid": "ffc24b92-29e3-4adc-ab5a-ac417092f055", "value": "49152:d8N18KqwRiv+6VGTBkGdnX+3mvf6GeueJ5NeekViOMEsbv:C18+Riv+uJGFX+mvfPenJ5SViOME6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711699, "uuid": "e6f6500d-145c-446b-8a77-490bbb21b974", "value": 2348032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711699, "uuid": "49dc0721-4754-46ef-9b86-d65030e2a067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711699, "uuid": "dc09f2f5-5938-4761-a398-047583bedff1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5d9bbe-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698762, "uuid": "d9ab97b9-ea19-4dfb-83e0-54d7e5fb79fa", "comment": "Malware payload (AgentTesla)", "value": "e2eee12401195261a5411c7eedd31335", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698762, "uuid": "0c6effdf-abec-4bcc-ae4f-c422423803cc", "comment": "Malware payload (AgentTesla)", "value": "523c77ece5e69c7396c3f5447ba41644166d4dea35a10d759dcab2a82f3e2519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698762, "uuid": "94fe08e3-241d-4c3d-bb9e-f4eeec573777", "comment": "Malware payload (AgentTesla)", "value": "d7b25ce1af4708460e4c05996102642f6e2743e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698762, "uuid": "bf72e642-1895-403e-8a3f-d1a47fdff18f", "comment": "Malware payload (AgentTesla)", "value": "3ed7d40b6b96e936fbcd8f839fdbb34fe0fd22a1565af19edef2a7870f223a09769f6d76a3838fad382ec4383dca7362", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698762, "uuid": "fe5776a4-aeaa-4972-bcbc-74c8798e38e3", "value": "T187C402289A349F12F93D0FF611B4B911E3F212972606D7B95CD920C62AB3F250B54FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698762, "uuid": "57082dd3-9aa4-466a-b78a-c73f2ee1fd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698762, "uuid": "35861aeb-618d-4045-8bcc-7b5419f4a6a4", "value": "12288:apR+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:aya6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698762, "uuid": "6e3316c3-9821-476f-8b2e-bc696363edb3", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698762, "uuid": "51036287-34f7-408e-8ad1-4a57a710dd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698762, "uuid": "73c0cc16-c24e-4bb2-a915-5301fdf61768", "value": "SOA 699052217869XXXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ddcf52-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699454, "uuid": "1b9ebf72-714a-47db-b418-96756bc0d935", "comment": "Malware payload (AgentTesla)", "value": "e2c350e80fa9792ff4757b2336dccdb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699454, "uuid": "bc16dc3e-0065-4514-a892-bf3fa96e7da8", "comment": "Malware payload (AgentTesla)", "value": "538fae7a39b9c84de1c936e9328b213401f60f05bb0e3fa40da213c9a2aff8db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699454, "uuid": "fbd62872-8b17-4566-9272-d8763c973631", "comment": "Malware payload (AgentTesla)", "value": "e3355dd0369bfaa9eb66607c1e10c5679b1048da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699454, "uuid": "0a21e2e6-59c9-4c0e-a9f7-085ca527f397", "comment": "Malware payload (AgentTesla)", "value": "53819050ee9833385d097c4b5b06d84f84348dc52eaf25705d4568f18ad5ce9f81a61f312a43be6341e2c9d9ef187de3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699454, "uuid": "8b266373-3aec-44f2-9db9-9c7cae31306d", "value": "T12205CF46B7124AA2C7956735C5BB5701C750EABAA2A3E30763CA66F624033FF1F80753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699454, "uuid": "baf9e03d-d2d1-4f58-b13b-338db4f63ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699454, "uuid": "c994b117-f686-4a5a-a863-95fa14f03738", "value": "24576:5gEUBUjzNSG9NgUmTR8OUsFnlahMcYkDsDkIqB:5gE7jz1gUQR8UuDsDkIqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699454, "uuid": "600ea401-305e-4f90-9cc0-ac8bf411c368", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699454, "uuid": "e4c0086e-22ed-4e47-8d74-8c6cd4c15ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699454, "uuid": "b76d7c2a-f792-4993-a830-4d913cb5f36d", "value": "sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9676150-bfe7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706671300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706671300, "uuid": "db5210c6-ca91-497a-87b2-f44a21afbcd1", "comment": "Malware payload", "value": "a509a84dccd2ada0de1d5e17f61ef726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706671300, "uuid": "b71dbed2-a521-45ee-ae44-926e71886afc", "comment": "Malware payload", "value": "5433d3c39c58c59bd662f8d780d6661cc15c51de3274c68f5c9371375c66c858", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706671300, "uuid": "0ab8d887-67ff-4f8d-b6c4-0f5428425b84", "comment": "Malware payload", "value": "b0202654a8fc308bb91931f87bf282f9b219f2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706671300, "uuid": "9b4df341-ee5a-4637-91a4-40532a2bacde", "comment": "Malware payload", "value": "f0e8a2a8f67a860672738c1a48d879bb7d448fa7d75f68e2d964b852b53e0830b295633299e51ee8fa75004c1d1901dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706671300, "uuid": "88fa359c-5bc7-4afa-937f-0f7f79ea8160", "value": "T1C9D4C4D3F1516391C8CC277427F22C1A032BAF692838A2CD794AB557A77B9CFC761246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706671300, "uuid": "8599956f-43e5-43fa-99ac-af224e3949fc", "value": "2db1029e0957197e6f954d9e8534c06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706671300, "uuid": "50151d14-c999-433c-949d-96bc50c133ca", "value": "6144:CptU1XPkgiqL7DU+C8cwHuU1iL7DU+C8cwHuUoL7DU+C8cwH:M8XPQqoYczHoYczroYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706671300, "uuid": "54805b7b-0979-4614-afab-736031449a19", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706671300, "uuid": "1f294f84-6841-4c6d-8338-00bb65212724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706671300, "uuid": "3d11b5ed-7bb3-4edd-88d8-1ebaae7044c1", "value": "SecuriteInfo.com.Win64.TrojanX-gen.3032.17016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e87d9a-c01a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706693039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693039, "uuid": "d661702f-5adf-4e02-ba20-722dc7617418", "comment": "Malware payload", "value": "4be61f001feb6c4292e326f4d05741a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693039, "uuid": "9b29c2a6-ea51-4c62-b7f5-7461ea8c57d5", "comment": "Malware payload", "value": "554b274669ed1472d6eaadb80a1472038ec520f059f2055bd4b6b48bd5c8ce1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693039, "uuid": "f5ca6518-bd94-40f7-9436-e84371b5875f", "comment": "Malware payload", "value": "20adafbd90e232985bf95a90dfd47b9c5dd36a2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693039, "uuid": "4e109cac-b15e-4553-aa3f-83318f7f8e47", "comment": "Malware payload", "value": "67bdbb1158563c67d78a346e52ba8c38fdd18549617a47f35660dca9602b8049a9aa93601e61b089d5786e4bdf575e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693039, "uuid": "94e6d254-d5bf-44b6-b1f0-7a93842e4969", "value": "T115663364B29009E5E5B7923DC850D639F6F2B8274786E6C753F88E923F137A06D3A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693039, "uuid": "2da9ae7a-79a6-4ba2-9e53-d813204d0e85", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693039, "uuid": "b505ef14-b079-42ba-be5e-8e2224f0d819", "value": "98304:H+85kCIf878azMD/x/0feyGgatVQ940BDlgwdnpka9R/k9t+2MGt+XrpQ/9l1OMi:H+SFuDfyGgMwBdnpkYRM67C/9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706693039, "uuid": "63933cef-fbff-4fa6-bd46-a1401bccdfbe", "value": 6620696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706693039, "uuid": "f51a784c-937a-48e5-ba62-11f72cbf5712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693039, "uuid": "cf5c84ee-63ed-4125-8364-330215c100db", "value": "SecuriteInfo.com.W64.S-8cfa6ebc.Eldorado.16653.18215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed9d78d-c048-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706712728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712728, "uuid": "3a61b3de-96ed-4065-9856-7dfba5175a12", "comment": "Malware payload (RemcosRAT)", "value": "73afe5be0d15b6dcd520f9655d7b03e3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712728, "uuid": "2c256776-16b5-42ef-83aa-f14751a38e2c", "comment": "Malware payload (RemcosRAT)", "value": "5572ffd080ba92dc24bd703be1d53d5b4bcad05ae87bf74c175f9cb03ac7c09a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712728, "uuid": "7b343375-09a3-4c9d-9cc4-ac0bab54ae56", "comment": "Malware payload (RemcosRAT)", "value": "aed52a2c473bbe5272636d738b2e214c601b3079", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712728, "uuid": "b437443d-5eb2-4c77-9820-74ba20ae8aa6", "comment": "Malware payload (RemcosRAT)", "value": "6e80df2e5d186680d2652cab0336ccf539fd57fe391e7460e90ffcd6ceeda2242db7ce2fe1ec1496e5d6a901fbcf8f60", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712728, "uuid": "b1ae91a5-6de7-4bda-bc13-d4fbb32a3f65", "value": "T14AE2E1A3D9401CBAE72D413371DA2F07D14DB9579A7628489F32BB288CE209D9D65CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712728, "uuid": "77cc5210-c791-470e-8289-919dfba02d43", "value": "768:uGJKwmuFze6jsomfsRYKiAMx9Xg0mpWCk4muo:Wl+663CYYek9XmN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706712728, "uuid": "76787455-a580-4963-826c-77ab5de7f1f4", "value": 31378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706712728, "uuid": "1ef27e9e-3d84-41e1-b0ae-6d50b1f4f8b4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712728, "uuid": "65748854-fcb7-415e-b080-ff2fbb009dce", "value": "Shipment Documents AWB2595859744.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082b9b56-c04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1706713898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713898, "uuid": "782a25a5-6d8e-4d16-9233-efd6c854bea3", "comment": "Malware payload (DarkGate)", "value": "3085f6b9a1b032da3e69427923bfe8e4", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713898, "uuid": "f89dedf3-7325-41dc-a0c6-8afac800c085", "comment": "Malware payload (DarkGate)", "value": "55ceb913cdd2514c28c7fb4e5c26967aa9a9d71fdc81d408ad333c5dde7a8c6e", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713898, "uuid": "5ae84f99-8e34-4aaf-81d8-32da53a74d97", "comment": "Malware payload (DarkGate)", "value": "e4de1f5c948208ded70810238bb79607545f7e97", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713898, "uuid": "4228a5fb-c7bc-476a-875b-ee78707eb1ad", "comment": "Malware payload (DarkGate)", "value": "78385a4cc30146ff968e2dece8bf9c72044d65c8fd467a4ccca6738a3f7606b735cc0522722d1e94fdda0d867eb49bbc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713898, "uuid": "95d5e2fd-99ba-4071-ade4-0eaa6136c3d5", "value": "T1E59533D0E583CC8C04D280E59A6294C1646957F7BF1346EC07EB7321B18ADB8BB7E879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713898, "uuid": "2aac152b-5f65-44f2-ba27-ad488523699e", "value": "24576:+EFOYbx2W3cSqK5rsDfWt5ir5dtR9AXrF15dRDz4z7H4spzlQOXMYLfh7hkZmkAD:2sZMs5WfWYj38F1l4vnlLlhWYIHsCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713898, "uuid": "f07c18ba-847c-4088-8ed5-040b3b17e3c6", "value": 1939738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713898, "uuid": "43ef0e17-f64a-41bc-9aa2-b31e06b9f932", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713898, "uuid": "4538722c-9069-472a-b849-ff802b14a6ae", "value": "doomday.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcebb1f1-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706699223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699223, "uuid": "559f8b48-ecc4-464c-ab05-40dc081f2db1", "comment": "Malware payload (Formbook)", "value": "30c4d04bd8dc96fb1dbe629ccb4aaec1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699223, "uuid": "38aeb489-074f-476d-843f-1c92ceb3d637", "comment": "Malware payload (Formbook)", "value": "55f9139909a989086c9b4b4610cfa5787cf12b5edaea8ac2cb6de7763300bfa4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699223, "uuid": "30de32f8-8334-4a39-9567-e4ab1e4205c7", "comment": "Malware payload (Formbook)", "value": "9f1ee2805ba6aa4cc126c3d7bd2538df39e2101a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699223, "uuid": "971ba60d-f895-4def-9564-e48657eccc87", "comment": "Malware payload (Formbook)", "value": "9ea09a20a15e1192d88a3269a5dde9f4c005a2de99ceab5023922e14f7d777462f64fb44514df5170372207face50aa4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699223, "uuid": "dcee70df-b0a7-4740-bd65-209e0a5819c0", "value": "T1A0F412043BA40663EA6D4A74CD7141DC5BB6FE1A3E81D78B2DC4709D16F3BEA9295303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699223, "uuid": "ff7976b3-60cd-4c81-9eb6-f21deb646697", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699223, "uuid": "404db2b3-eb68-4475-81c9-37cc0f97633e", "value": "12288:dO69sh9SCF1OkuHGpg7wybo04fjIIxMoy0V/BpDt4MB2WEFwG07mF9:86sh9ZZqGiaEnlmH+MgWljG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699223, "uuid": "f82740da-b04f-474a-bb21-a461f1c041b0", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699223, "uuid": "db17c883-a167-4e82-8595-22882404dcfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699223, "uuid": "649c2861-c6a1-47cd-a588-18e23e0519af", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87929b1-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698786, "uuid": "500d72ec-6bdd-4a7d-8499-2ec19ed2ae7a", "comment": "Malware payload (AgentTesla)", "value": "6289c26cc1b8d5b2257c4d78f2496585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698786, "uuid": "255bf98b-2034-4a07-903f-a9f12d7d5616", "comment": "Malware payload (AgentTesla)", "value": "56a176b4dc69e29b9f170b9385c1cb0b1faf144fd62aa13bded12babaa52e123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698786, "uuid": "a2017a1c-fa71-49d9-9996-7e564f0f392c", "comment": "Malware payload (AgentTesla)", "value": "02ebe0bafca91fa475b2bd47c368c4ca330898b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698786, "uuid": "8f59c090-d2e3-4f53-b18d-e17bece86ccd", "comment": "Malware payload (AgentTesla)", "value": "4da9ae91b1a800a0fe5f46f56e67a6dfcddd974da9e3b4949eeaa26b2dd2691f5c359701c2d74879258a568101fb7f8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698786, "uuid": "5eb30d96-d0de-4e0a-91ee-9df5bd5204df", "value": "T15105BD84D9545AA0ED2C9BB12636CD3193333EAEA834D56C2CDE3DA73BFB7921111853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698786, "uuid": "aeb9f2e8-d48b-4767-ae78-e86e29fd9aae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698786, "uuid": "d21f4a07-10d3-4fd5-ab57-bbea88e1d7ff", "value": "12288:bL+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8lUP7r9r/+pppppppppppp9:bSa6u/ZKCcmdqw6S2dRU1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698786, "uuid": "64e9a0aa-6f0b-480b-ac9e-f157a41567fd", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698786, "uuid": "e022e6c4-32b1-4e78-94e9-0c90d79fe592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698786, "uuid": "e9b0576c-090d-4327-b9a6-85fbedfd986c", "value": "polyester -Nylon xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71dabee-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697549, "uuid": "4177e0af-d735-464b-8ee7-354d42c8907b", "comment": "Malware payload (RemcosRAT)", "value": "9902fd26a00440e31f3f32ed3a07e552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697549, "uuid": "60793d84-1d10-477a-980b-3326f5e60ad8", "comment": "Malware payload (RemcosRAT)", "value": "56d99633ed941aebdaf59b2bb4ecb029175cd1110563e74e80a500510082579a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697549, "uuid": "56b376bb-8128-4a2c-860c-9d3100a8005c", "comment": "Malware payload (RemcosRAT)", "value": "ae2cb09e4823fc01dfa976d4a528880ee28666be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697549, "uuid": "a2d40079-00a0-4c3b-b805-dc499cf87379", "comment": "Malware payload (RemcosRAT)", "value": "64ba3747183881dcdd8567eab863d3a8287445575564a9f01fd65754abef0e3ea40526e1aacbb49bf6d2c232f194614b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697549, "uuid": "9599ff09-fab2-41b5-9e53-ae080b909b6f", "value": "T1C8251203B19DC72CCE684A743138867483A1EF1F9051EA96BDD6FCBF157628D031A6E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697549, "uuid": "c8ab35fe-5ac3-4bac-bc9d-de32a97f7e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697549, "uuid": "3e1edb34-36ba-4660-abab-da0c43d1244b", "value": "24576:Kkr8bshNB1t1B48CfybAXD8EO7E1TUCJKbGqjcApoiJq:bwbyTK8CEAXHOAfkeiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697549, "uuid": "7c151471-bd66-47d8-a417-c4e925d43568", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697549, "uuid": "1e30cf73-538a-40f5-90c0-1a266a39501d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697549, "uuid": "41e27f9e-a680-4bd5-b392-91f226825762", "value": "PO-22385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00caf121-c01e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706694558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706694558, "uuid": "d412ef81-4243-430f-9d56-2e4aca3e165e", "comment": "Malware payload (PureLogStealer)", "value": "af958228714e5e879791e3980ac3e3c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706694558, "uuid": "c526a273-526e-40f9-baf2-1ed4a2789a0e", "comment": "Malware payload (PureLogStealer)", "value": "5838dd3bcc54d23db8e6d3431d0870a3036015e2b4ef5434284cba9429bdd63b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706694558, "uuid": "c5e48a3c-ecca-4134-977a-1accd4099f83", "comment": "Malware payload (PureLogStealer)", "value": "3267d0d80125ec0d7f14458ee4e386d596bb16e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706694558, "uuid": "e2fbcfbd-3dfc-495f-9312-9a14378990d5", "comment": "Malware payload (PureLogStealer)", "value": "88907ef77c680ef5294793bd4e20109f9c269da988ce565358bd02e99fc311e5cb686a4958dc8d69d390bcb357d46d00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706694558, "uuid": "e5f9eac6-343d-4bda-ae74-f8663e61130c", "value": "T16325A503BA9E9BF2C2B95736C5A70C0C87B5E9A16723DE0E758A235608C37B7DC45613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706694558, "uuid": "910fa081-8a43-4219-a939-e995e5773bf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706694558, "uuid": "7420bff7-4c5e-484a-8d19-81bcac78438d", "value": "12288:9Nf1Girrahj9KxRgDnBI2EVm6hmrE5DUzZL9cTc8sBUZP2NnTtY99d9dAnBkXbjm:9tk9KRgDnBI2EV5+E5DUlac+OBmuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706694558, "uuid": "9b77deea-20b3-4b51-8bcf-59e95f3eebad", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706694558, "uuid": "c8c1a814-e831-4478-9a49-e0d54b2efa48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706694558, "uuid": "00b806dc-e0ba-4828-bb06-8368ba7ac29e", "value": "af958228714e5e879791e3980ac3e3c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ab2070-c094-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706745480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706745480, "uuid": "288e8ab0-70c9-4f8c-9230-8fb01d1b55e1", "comment": "Malware payload", "value": "1850ff637de86020fe977b676b5c81ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706745480, "uuid": "b34dc6b4-6f36-4503-906c-1e5d6b653254", "comment": "Malware payload", "value": "58ace8404d8fbfca96c562f3415948073f713c799eb466627dbd9988cabd1c56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706745480, "uuid": "de40d311-0c8b-4820-b121-70408720cc62", "comment": "Malware payload", "value": "3e4774068a1412a979644427ed505c9a1ae72f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706745480, "uuid": "1636d580-8c63-4c9e-9168-aa801ddfd85d", "comment": "Malware payload", "value": "bacf46704ff959ce358a04aa82d0417d74eecc4ce71e998c0380a732edb35b3c04e0b7bf1f2f02e79cce839372a9caa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706745480, "uuid": "5e8d8737-939e-4c52-96eb-bfe1b74b6ca1", "value": "T124D412837A8A1B21C6045974E0FB98A517F6A9C327B3E7823E4482E61E413D9DF4D7CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706745480, "uuid": "71242771-ff72-40df-966f-4a61df36690b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706745480, "uuid": "10e13979-b211-4aab-8bac-fbc758341c5a", "value": "12288:xSVqEbPdYx17gyJZEFy3a55a+xwdcq8N8NRyaPxJTTIrCoiycyN:xS4Eb1Yx17JmyK7jUcqrXLPxJ0Ckc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706745480, "uuid": "ae4b4dc1-f384-420e-a04c-79860a18febe", "value": 646912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706745480, "uuid": "c2ccfc43-4284-4b6a-9f4c-fa3a15dfff56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706745480, "uuid": "682c4284-8d11-4007-a280-14d573af3254", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2b9ccd-c060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1706723082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723082, "uuid": "743f439b-5dc1-4c39-bec2-799d5d2b938e", "comment": "Malware payload (DarkGate)", "value": "4f238c2093606fc296f1f819c2f0fc67", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723082, "uuid": "f2339446-721c-42b4-b6b1-612370dd7182", "comment": "Malware payload (DarkGate)", "value": "58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723082, "uuid": "09dff030-64d7-4274-a44b-9327cb18d1e5", "comment": "Malware payload (DarkGate)", "value": "f8535858fcee6b96e0f49e6156fa110fc0698880", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723082, "uuid": "23451f60-f539-4804-9ed8-a24e7f87987d", "comment": "Malware payload (DarkGate)", "value": "5e5e5ebad0f1eea6a097a890e2d0596d91ae410b911030df2ad9278dd9aeba73d370869d06fe9226cbd45ef87d27bd80", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723082, "uuid": "85f80249-8a2b-4da5-941b-db82db2b376c", "value": "T170265A2BE253815DC11BC03483928AB09433786597F299D743DEDE695AA1CD27EFEE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723082, "uuid": "5d88bc43-7504-493b-afd5-befc911cb47d", "value": "49152:jpUPN9qhCxzT+WKjSXcmNt6+XzP4BYIeBfCXqyfdo1DDDDDDDDDDPuDgO9hTnxA5:jpqCQbm+jg12f3yaiga6yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706723082, "uuid": "6012faf9-fb2c-4652-a0dc-eb7ec6610e66", "value": 4493312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706723082, "uuid": "ed5c6fa2-e669-4f3e-95bc-9c9df0b5abfc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723082, "uuid": "b1cffda7-23e1-4165-9ac6-cf9c13e87e3d", "value": "mkreafr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5b61c0-c076-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706732778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732778, "uuid": "811c49ff-6c60-42f1-b3ce-9797226bc822", "comment": "Malware payload", "value": "29fe6aa998480e266d668cdbb15c81af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732778, "uuid": "7e91f4ab-c3dd-412e-9904-583accc970c6", "comment": "Malware payload", "value": "5972524960c4db1f5b4f50ddbfe450b20db03f01b4b5fd5f2a17c1d563513f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732778, "uuid": "29ea6967-3f6b-42a1-8c36-fd116b73e5fc", "comment": "Malware payload", "value": "774bf0ffcfcf982b1ce8085a68badca719e1a93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706732778, "uuid": "8269b3bd-3c7f-457f-bad3-b3b688f98b4a", "comment": "Malware payload", "value": "2bfb96e1776233e5d4881363a1d13514047aa5c011afb7b27e788060ab1fccd1c8562e36d8d24b6ced678c0a391b2146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732778, "uuid": "4aa6b50f-7845-4bc7-bc28-4b1f5bf7bb0c", "value": "T15D242333E532A086CCDA5DBB4F392CD47A17DC1D76004F18A4C22E9ABCE6B5C59C65A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732778, "uuid": "3ac1d3f6-a45d-4023-9ffd-c15f14adb614", "value": "d97478089471b95afdd89547cc8a0f96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732778, "uuid": "2efaa024-9759-4119-b449-1cf7e2df78f1", "value": "3072:BXhbVVcXreQqEMjvLnIGAFVcGt5Lm/t6K0gY3DIcZrLQ47PLVmkZWGcsNH8Y6sn:VhsXreXEMjTYvMlTqkor84XVmkFcSd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706732778, "uuid": "ae951a53-2075-45e4-8d36-5be2cdf67a48", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706732778, "uuid": "dae2ebd1-cba5-4ce8-9544-f5d26f49b165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706732778, "uuid": "61337eee-25af-4dae-8f3f-323f7165f18a", "value": "SecuriteInfo.com.FileRepPup.28089.4639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e714fa12-c060-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706723292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723292, "uuid": "adb030e4-32ce-42fb-9afb-2508f1f3cd28", "comment": "Malware payload", "value": "a4b9eb5287f8f462c3462f03b756db14", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723292, "uuid": "38caf423-57a2-4d2b-b0a2-70d4c88350d8", "comment": "Malware payload", "value": "598f856e16b47539be32473da5efaf5430f224af4256a128f0f82fc6d5c40418", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723292, "uuid": "b1991742-fbb5-4ee4-b168-f97d4d583cf0", "comment": "Malware payload", "value": "bca7d7f49d4f4dad27c69f80920ff3a6a9c3db2a", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723292, "uuid": "abedf3e9-00f0-49ef-8696-8b34f233ea16", "comment": "Malware payload", "value": "54f9faf03c756b0a8e31cfd3cc7acc6c1c9c92ecce029d744ef70d960115af12956eb00ecc775ab630bc83f9e1d9605b", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723292, "uuid": "7c3ca3e7-2c81-40a2-957f-5b4d475bee4e", "value": "T15185337F1E78369872970F11B21DEE5AE2265EB28D14442F0E3E72CE21ED005D56BF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723292, "uuid": "54d6577b-4133-4084-8257-556261bd76e0", "value": "49152:QuVQogzbwhM8HQDm+lo/adQeFWogoy5d5TU+0UrGFATGO+3tp:QuVhttH7aeeMI+ymX7+dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706723292, "uuid": "080169e1-87ca-4e98-a02f-cdc9c4c5c4af", "value": 1821860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706723292, "uuid": "16ee085b-3989-48f4-a1da-cbac30d2cca9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723292, "uuid": "a1019a63-8f1b-46df-8b22-0ca035278809", "value": "598f856e16b47539be32473da5efaf5430f224af4256a128f0f82fc6d5c40418.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffd6cec-bfd5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706663365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706663365, "uuid": "c3e91650-f0b6-4e52-8cee-226dc6cc4d43", "comment": "Malware payload", "value": "ef7d2e3b5ea80c68101e6c8888aabe4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706663365, "uuid": "96618258-0656-4da1-8b89-d3e0f73cbe90", "comment": "Malware payload", "value": "59abcb4729e29a5b9c03df4babb77341f79f72ac337d82656f81502211521438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706663365, "uuid": "e7e13f52-e5b4-49f5-be0e-8d6ae55ca3d0", "comment": "Malware payload", "value": "ef929cea3466fd7589bac9facba0fd52cf7dac6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706663365, "uuid": "60e11fe1-0a7e-4cb7-a563-21f4fc9aabff", "comment": "Malware payload", "value": "3d2095be3cc20c59fc5ac27c7aaf5a01c60646ac229f94e81afb9eeab9d2f22d7ef96348dbbbaa2cdbaac88c422a66fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706663365, "uuid": "936c9399-b3b2-4c6c-b216-ccee27780720", "value": "T174267D1B66A541FCC167C23885974657EBB27C051B309FEB01A576A91F33AE29F3F220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706663365, "uuid": "6fbe351e-c249-4e60-990e-6fcadb7a7c70", "value": "a86d8b476a37d16a44cff0e3cffbc752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706663365, "uuid": "cc354807-d754-4d26-b14d-f2942e67c956", "value": "98304:4dep3TxYaGdfipLinT4DqIAKj23a4RwAJL2myS:PlYaGdIL5XJpENbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706663365, "uuid": "f3cda97e-f2ca-4ded-9644-f02ac643ba99", "value": 4811000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706663365, "uuid": "4cd47e04-238f-46ce-b090-b392f531fe1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706663365, "uuid": "05c6cd1a-59c3-48ae-9728-2f20fa762e2e", "value": "SecuriteInfo.com.Win64.Application.Agent.UWS6VN.16671.27348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b008f245-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699147, "uuid": "967a8d23-f986-4085-9bf2-3b67039a1e77", "comment": "Malware payload (AgentTesla)", "value": "199b1673c4e64619e47b348c20ce61bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699147, "uuid": "7e60e77a-266c-4d0f-8478-ad1add140ecc", "comment": "Malware payload (AgentTesla)", "value": "5c26905b4f4630bd686c44b0622e4937d7f41ab7c33a6d2a9182c23d70d8e104", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699147, "uuid": "60335abd-933b-47d1-9a9c-6090dc797a61", "comment": "Malware payload (AgentTesla)", "value": "f47e5c703dfbd627b8dea14fafd61d1897698b6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699147, "uuid": "3247c067-bf61-4d52-852b-e222454279bf", "comment": "Malware payload (AgentTesla)", "value": "2d3bea5f96320d3ecd581dc2a4e43b539a30b70eb17c0fa8acc78d3712cabc98c1c6c0bbcc4603eeed30f15ee4258f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699147, "uuid": "9d925080-1569-4a32-95f8-7ed6ca21a255", "value": "T1E9E42319357FC770C5BE6EBA2D255AC10336FA2E9015D203BDCA34E9B8F53001BA9762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699147, "uuid": "a2ba31b4-9b61-4d57-b2d5-ed190d99ccc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699147, "uuid": "7fbe361b-9af6-449a-a07f-9da693219599", "value": "12288:tlhlfu8liC5utar8j8qshD4vUhJfqZ+p9VLFazh7HPmP6tVZ+aducbbsD5dn:sar8bshkvmfx9VM5uP6t3ducbbsVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699147, "uuid": "6af2865d-9073-4c5b-9d1b-e447b41d9dfc", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699147, "uuid": "c10869cc-c6be-4e3d-ab18-ca32fc22d23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699147, "uuid": "4da58c83-a638-4a56-a7e9-0083f63327df", "value": "DHL_AWB#20247791029.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a12c756-c02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706701527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701527, "uuid": "38626ac6-a187-4c02-b67c-ee47ad2fc43b", "comment": "Malware payload (njrat)", "value": "a3826b6c05674ce99890e7919c6daeb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701527, "uuid": "7ebcbb36-a2fb-4129-8b52-8138f6b69d38", "comment": "Malware payload (njrat)", "value": "5c4661e1393f0927e1c5b123db7dc1ecbf5fbf6169d46ee691d392dd85a7578c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701527, "uuid": "08e3d59c-57a1-487f-8fe1-de0ff58d4c0d", "comment": "Malware payload (njrat)", "value": "256f7be76b479fa8ad83a08e61fadbc679261417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701527, "uuid": "b969b778-0bbf-4d14-b52f-3aa667b7c655", "comment": "Malware payload (njrat)", "value": "14615fd1782694b8ef0ff56d04354ff239f755885e5bf602d284058ecee2ecd7d77d2e9bdcb4e98e10fc2c1daeb02165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701527, "uuid": "1288577e-08ac-4c70-bacf-18c7755139bb", "value": "T197F20A8DBFE24194C2FD5E734671D2220276F01B1A23EA5D8EE845F65BA37848E4CED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701527, "uuid": "d643df09-fc9a-4493-9345-f5680173b9cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701527, "uuid": "3c746d67-9b8a-4476-b73e-c10927595ce4", "value": "768:m9SCeJmqDEhB2y6nkU1GQ8/dEhq5lxOBcmZPtCwjC:m9SCoNAB2y6kUoQy5lxOWmq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706701527, "uuid": "67e28217-9300-41f4-8a52-dc00011566db", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706701527, "uuid": "3e87bac2-1628-441f-a096-8042542c96f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701527, "uuid": "d52271d9-ba5f-4521-a962-29f2cad84330", "value": "a3826b6c05674ce99890e7919c6daeb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28075402-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706682169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682169, "uuid": "3b46e55e-7381-4ad2-8a95-73549fd106ea", "comment": "Malware payload", "value": "0f83ade783f6f13a687de7e6819385eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682169, "uuid": "0a62d555-d297-4448-92f9-177b8184c27a", "comment": "Malware payload", "value": "5cf9f8b94a395f9cba3658502e40b014d67026a16da2aa91a3f7bb64931ae8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682169, "uuid": "6b558ef6-1638-4b09-a6e4-78b63d5462c4", "comment": "Malware payload", "value": "990145a21812860ed7c851dd224b95fa80387269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682169, "uuid": "720a4cf9-7347-4893-b02c-779d4bd0289e", "comment": "Malware payload", "value": "a45b11ef21dba90e50871a5b9ce40a52b171a6543ff24b471e2603f714f4b1061c985b5e83733b0e4634475f80502102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682169, "uuid": "247096ff-01f5-4684-bfc3-d354ec6f2ad9", "value": "T160C6334373818162FFAB96734F46F62157FC68260127EA1F13D81E76B9B02B1163E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682169, "uuid": "873a9090-bc08-427b-ada9-47636e460627", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682169, "uuid": "f0d3565a-f6d9-4fd5-b5c4-df91b16d1ebf", "value": "196608:Wcb2toYI0ZcamNfMlZVYxcAMDyBCneUJQDVNiP9DyUXEh98LoQ3VGMVhsXUr:WcitoYHcamwYxc7DE/U+Vk9Z0Kk8hso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682169, "uuid": "5830b8b0-7fcb-49fe-b6c1-13d59daa57f7", "value": 11691288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682169, "uuid": "5ecd4275-fd87-437a-ba45-d043ad44fd52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682169, "uuid": "adea8904-e81b-4cdb-a49a-a62c7a6d3bd1", "value": "SecuriteInfo.com.Trojan.Agent.25137.19166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae97fa98-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706660490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660490, "uuid": "87e96936-409a-412d-b069-6b4024ce6434", "comment": "Malware payload (Mirai)", "value": "6d7bb2ad6943034369c68bcc80e3ba6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660490, "uuid": "8a448f61-df87-4414-b791-3ce06f50ed8e", "comment": "Malware payload (Mirai)", "value": "5daa08275a479799c268ddc230868a87c4709c745fffa791a99dc306a20782bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660490, "uuid": "fb782514-2fb2-40c5-a579-3d2896e7a33b", "comment": "Malware payload (Mirai)", "value": "24123f08d7385b5b83decc5efc5c3b554d28ba74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660490, "uuid": "6a2a431a-5278-4fe8-9134-d989be4a8be5", "comment": "Malware payload (Mirai)", "value": "e6089732a13c718a230db2a88a2652487183bc4c98b7d012a1d2877ec35d947c1646891a712f9d1ae1f23969f1b3b76c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660490, "uuid": "b06e192f-d3dc-4073-a1c1-d81b2ff16fc2", "value": "T18B334B4AA8001A2DEAD259FD14354F0E9D565321A1E30B0FE7AEFEC63D732296F157C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660490, "uuid": "2f4e514a-f0c9-46d3-bcf8-859aad8a1fc6", "value": "768:tEWiC7uIe+cy63bCgcuvVL1Lb+9eTBSZgFea385+e3qWF0DAyqJEmTDGIg:tEZC7uIzob7cuva9etFlPvVP6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660490, "uuid": "0162e2ab-82d6-4fe7-917a-714e305cf746", "value": 55132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660490, "uuid": "3f13814f-65db-4abd-9d76-98e559e8b0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660490, "uuid": "a0bd49a8-906d-40e9-960e-dd4ffd32ace2", "value": "6d7bb2ad6943034369c68bcc80e3ba6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14c0b5a-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686345, "uuid": "0378826f-6fb4-4b4e-a7a7-be4af827d068", "comment": "Malware payload (Gafgyt)", "value": "b5799f21b29d1b0e21ff39ad47ef44b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686345, "uuid": "df5d8c2d-eb7c-488e-994f-25ed7d0c1681", "comment": "Malware payload (Gafgyt)", "value": "5dc71045e35623d889aa87c2cee18a0f7b1d94ea4b2b70ba3e731d4284504537", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686345, "uuid": "62b80bdd-3824-44cf-8b40-f157a5865e52", "comment": "Malware payload (Gafgyt)", "value": "829cae4a0fcf5b4f47cd0c6afd09a3ce65404397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686345, "uuid": "81f1dc72-fd52-487b-b92c-0306d59a2379", "comment": "Malware payload (Gafgyt)", "value": "16f85176c5e5b49224aa5d3572bb3027a92a5be59e9bddbb6598378377c1a065e00d3f284da35384dbe1c11fb13ceffa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686345, "uuid": "dc9313ad-53bd-4577-99aa-abdbeb0b7b77", "value": "T12DE34905D7408B57C1E2277AFADB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686345, "uuid": "a01e4ac5-a3fb-4546-b94f-e4dbfccf7747", "value": "3072:it8iFDKEfFN+Fa+1sW5h7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNwh7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686345, "uuid": "1ec3efd7-a507-482a-978b-9cc6a78dea80", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686345, "uuid": "7fc1cde3-9d4a-42a7-a120-2174ca2230d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686345, "uuid": "3882c9a8-bf58-4d5c-b464-736a803f396d", "value": "b5799f21b29d1b0e21ff39ad47ef44b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af92671a-bffc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706680249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706680249, "uuid": "fa2c94d7-0fd1-41f4-a1c3-f6c0f4ea625b", "comment": "Malware payload (AgentTesla)", "value": "8d0cc0fbfe9cd0c53783a055032612cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706680249, "uuid": "1f3692fa-7278-4c73-b76a-ad04564e747a", "comment": "Malware payload (AgentTesla)", "value": "5e8d12059f4c637214627365c418e1afcd84d995ce9e72295b0f39e1a731f24d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706680249, "uuid": "420e937b-ad88-4bea-8830-ec92baf697cd", "comment": "Malware payload (AgentTesla)", "value": "45d388021f1076f1c0adae31336966995385d564", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706680249, "uuid": "a4c173f4-426c-4f54-abff-8fc5129a1b02", "comment": "Malware payload (AgentTesla)", "value": "fb22490b7f07d37b61a0090d782659b27932335a9b22cdce03ee1ae53b65fd09f7e9822e3efb6ed0be9954378ff1d32f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706680249, "uuid": "6f1fdefd-ee44-4ed5-adb5-1520efedb091", "value": "T192C3D16DD34B01698F620377AB5B1E5042BDBA6EF38552B1306C437933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706680249, "uuid": "97c5bc6c-1c30-4dd2-a10e-c5de4f3e2444", "value": "768:QwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjR1YDUifl8zj/rYRL+9E:QwAlRkwAlRkwAlRcNid8zj/rYx+9yCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706680249, "uuid": "195f87aa-c0b5-4a49-83f3-fdfc7f3a3502", "value": 120305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706680249, "uuid": "be537e43-f77c-4f3e-978e-e83d8d4c6793", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706680249, "uuid": "2586cbdd-9a3a-47d1-ac37-98fe49838e80", "value": "Scanned Doc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb330dc-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698684, "uuid": "1c06b32b-a93b-42cf-b307-8c7cb666040d", "comment": "Malware payload (AgentTesla)", "value": "3844c6b34d166404766220148aa49f37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698684, "uuid": "6de020ec-3507-4b98-83fb-6b6ff95e36a6", "comment": "Malware payload (AgentTesla)", "value": "5e958b5d3bd73a619671779162e95685c47b42260546efd8b6a35b79fa2e27c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698684, "uuid": "e4beb6bc-09bd-43d8-ab2a-048d986ccee1", "comment": "Malware payload (AgentTesla)", "value": "eacb7cff538195418e807c8c23a0558cbb160ec5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698684, "uuid": "72d8c53a-17cf-4a01-bedf-4e19239c088c", "comment": "Malware payload (AgentTesla)", "value": "f8dc61735d18dd65136e817a39fb51012d8cf7ea9a23d058e5acc279b6569f79fedba706fc8381f9e49a6aacb1a7f69a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698684, "uuid": "ffe066de-a64a-4dc3-b31d-f3464cda6787", "value": "T1B9B5334A2DADC589FBD55874B4AB951C63A730F9EC7F4D404C08E3FEA1F839960248B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698684, "uuid": "9ce93df1-0053-466c-8be9-c82d2e592f89", "value": "49152:pt3RYa2dU4MJH5Gy78I7QU4n+qI6FUE17QqekF0sb7g7qQ:XRYddah5f78Tnh1d+7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698684, "uuid": "75bd7de2-fa4f-4720-bb49-62667560852f", "value": 2321135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698684, "uuid": "befed323-fc5f-4db6-97b2-d02aeddd4246", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698684, "uuid": "6386d283-bd87-4671-92f2-42bb14865e01", "value": "PO-#2024129.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feeb3f3-c02a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699872, "uuid": "16b904e8-acc4-4321-a2e2-838f5ee1e071", "comment": "Malware payload (AgentTesla)", "value": "dacdfbe0dfd407a42f651dd78dd0a058", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699872, "uuid": "aa900f4a-4b7c-4f57-9ccc-1797171db20c", "comment": "Malware payload (AgentTesla)", "value": "5e9f9643c2762af1e70c675baa1a0bdc8569ba66c29343783506aeb43e6cf5e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699872, "uuid": "5663f407-10a8-4483-9668-5e1e8c99a573", "comment": "Malware payload (AgentTesla)", "value": "cebfa7ace02c2775bb5582cbaa2d855caf7f629e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699872, "uuid": "cc25591e-8cf2-48ee-953a-272f8b319a76", "comment": "Malware payload (AgentTesla)", "value": "f4e53e9479f32de687be9b140ff7a58d59a25463af90157f6deb248d8874c508087284cc38553a94472f423468595ebc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699872, "uuid": "dae3f595-31fa-4d3f-b928-a4c19c6a0e9e", "value": "T195E4125662BC8F56C2FE5FF548A490090BF238779566E7580ED128CB2A27F424E70B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699872, "uuid": "72dfe9cc-ef29-4946-9b15-ad4bdd7e716f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699872, "uuid": "5dbd8087-3909-4eb6-9910-069943031cfb", "value": "12288:aGoOIAYQ4TkY4prAPYIzBmO/vYkoXbF/12TLKFYenxMWVY:H3IAmkYVQIzrHqNK2Ky7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699872, "uuid": "0190de21-d008-4512-9bf1-2e9f5cd1ec49", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699872, "uuid": "891edf49-9f80-45dc-bde4-161c9d3099a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699872, "uuid": "575658ac-a57d-4db9-ba4b-b3afa277c837", "value": "\u00dcniversitesi teklifi Project 30.01.24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e175d142-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699230, "uuid": "243da592-f320-420c-8081-f3e9e82fc1e4", "comment": "Malware payload (AgentTesla)", "value": "b623026cc2392136fc1cc28852de6a45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699230, "uuid": "a7e46e6b-dda5-43ad-b811-ab58398d0452", "comment": "Malware payload (AgentTesla)", "value": "5fc0ddf06be51411f3313214362edf6f65990d9320a66df1248f6548b923ca35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699230, "uuid": "1b454cd3-6c8b-48a1-9925-03a1f336ec7a", "comment": "Malware payload (AgentTesla)", "value": "70b2d786cccef1e3c7336277df042ee17f32f0f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699230, "uuid": "fda47eb8-51fb-4e81-8384-170489fb137a", "comment": "Malware payload (AgentTesla)", "value": "77763de4e09b5f934c564404ffe0ae1c02e0cbcc83ec3a2ca19e514a48bb4166c05c65f29254ad0ae35f60dcd90d8d29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699230, "uuid": "6e1b8133-d317-463e-9dd2-a5f250b1bb00", "value": "T15DE4121477E81857D6AD86B9EC6091DC0BB4AF113E82E3EF2CC9309C59F3B869795243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699230, "uuid": "cd603143-1974-457c-ba93-a22b0503718b", "value": "12288:oAMAxUDrMMc0YyliU3OWl/yPDeoQjLHFhhDE4yFbH7vXsRr:HMAxUFc05iWX/xHFhevFbHLs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699230, "uuid": "15db6fc4-bbf2-4bec-bf7d-819a1af7dda4", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699230, "uuid": "2cd8ccf5-1f08-4990-be12-0f3cc626b587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699230, "uuid": "3e92d8af-9f18-4d77-997e-7fe294d0c3cf", "value": "\u041f\u0418\u0421\u041c\u041e (08).docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f3cb89-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718032, "uuid": "c20bbd31-6f54-4ba8-a515-442a09977981", "comment": "Malware payload (Mirai)", "value": "1d3be156b80a06f2e264a6b5639699ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718032, "uuid": "eccd8480-aacb-400a-bf72-6e2fa87b3dab", "comment": "Malware payload (Mirai)", "value": "603600ccff994bbb2775a3a14456cab5fe0d5b125ad96f48d2235210341ca394", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718032, "uuid": "cdb9dc13-5c1e-4611-855a-1e56710c9ad5", "comment": "Malware payload (Mirai)", "value": "1fad679245e015118b66808da34f96cd73af774a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718032, "uuid": "aa712fdc-feb9-4893-a680-670537e6ab24", "comment": "Malware payload (Mirai)", "value": "a7d03cdd50c6c537b578b3df8da55e4c581bf0ba28b0090c3a790f20bddd123532e19e5ee88057cdc0d6bb03e38ad2d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718032, "uuid": "3f2e7d27-ada7-43f7-8a8c-4c1ee7c7ec96", "value": "T1B5E308C7F800DDFAF80AE33748530906B130BBA249925B376257756FED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718032, "uuid": "49464d68-6643-4b55-9fc4-ea6c21b812ba", "value": "3072:FccuZC5bxHhUkz8klnua3x171VEjbi6Lv50ip+GyDC/X:s8OkgkRh174Lv5FyDEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718032, "uuid": "f0543bc2-6894-40d2-848f-60de5d5c36f9", "value": 150892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718032, "uuid": "668033d3-641e-4f67-a0c7-5b682ad5e8e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718032, "uuid": "ee083ff0-3663-4bb0-8a18-de2b51a714a2", "value": "1d3be156b80a06f2e264a6b5639699ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fb245d-c044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706710912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710912, "uuid": "f95c3ae9-dabb-4d15-b1b7-7e36c96b9e32", "comment": "Malware payload (LummaStealer)", "value": "baa69251a459c635621edc91ae9815bf", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710912, "uuid": "45f7bdd1-965f-4d40-a9da-d5e681c4f30f", "comment": "Malware payload (LummaStealer)", "value": "6115d0dc0349f7cbab3fe4b4b769b389a60aab336519d4b42952bb0f0501428f", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710912, "uuid": "091e78a8-e3d3-4019-8f4d-b305ac8b1e5c", "comment": "Malware payload (LummaStealer)", "value": "c1d1ae92ecad11aee0984d19c344f28ee357ae09", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710912, "uuid": "972c1492-76b7-4093-8f5d-882e2544cf93", "comment": "Malware payload (LummaStealer)", "value": "eb30f9771e6adb6c8dd8867e67611ebf39a2ea88d4be4b7b30b6a5ad69864bad6dce79481f1afe3d7d34b4880b22c44a", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "Lumma Stealer", "colour": "#B4571F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710912, "uuid": "03cf06fd-d9dc-4d40-a6ae-8b823fe18f7a", "value": "T1FC4523316BE881B7D4A7667549E8B7326A3AF607036044C74B901E769F523C16B3C3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710912, "uuid": "50764f6e-04c1-48b4-8cd7-9a1dfad7082f", "value": "0b0553a06c78f8215079747ab2aea681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710912, "uuid": "55d53fdf-0776-4809-bffc-b15d43b78648", "value": "24576:tjL8T/lCQaPzq0tRfICIlVRUYJespoj/wBcJelV9OzHPLDZpIVjlkGA3m:tsT/s3PVsLUke/McJs2HzqZkF3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706710912, "uuid": "d99e8c99-ef1e-438d-b7a2-5d2193ca1915", "value": 1184924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706710912, "uuid": "0c1a50b6-4f3a-45ed-9528-d40b5a31b92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710912, "uuid": "8317989f-83cc-48f9-9d60-7da6af2909a7", "value": "3_\u0417\u0432\u0456\u0440\u043a\u0430 \u0432\u0437\u0430\u0454\u043c\u043e\u0440\u043e\u0437\u0440\u0430\u0445\u0443\u043d\u043a\u0456\u0432 Medoc.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe04bd64-c011-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706689400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689400, "uuid": "afde1749-4b83-4e22-b4bf-1a7b4ae9b1cc", "comment": "Malware payload", "value": "d09d688ba52314b9ae870d1013de9dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689400, "uuid": "f3ae6225-513f-4c4e-a183-f280126ed820", "comment": "Malware payload", "value": "612a1156a16e174cb3f2d69f6ebee02301bb4810ef68a5e07001b3e18f201c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689400, "uuid": "c095b325-e2c8-4a41-9717-3aed8f967aa6", "comment": "Malware payload", "value": "96e8719a6a486235133f143a5ca5d02a1c08bf5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689400, "uuid": "1297fbde-a677-49f9-9180-a08b21ef8a5d", "comment": "Malware payload", "value": "e4cc6370dbd32e9878eb8053d2f7e001cb389e13a2173908be7df864ddfdb1d9c96b0e32f47d6779ec2a4f7592d1cbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689400, "uuid": "775fcb0e-8139-4a94-8a13-34df46d81b02", "value": "T10725AE98367071EFCA57C872DEA81C74AA113C7A473B451394233EADBA8D947CF245B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689400, "uuid": "3907520d-9379-40d1-8df3-8cf6e5e5e424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689400, "uuid": "927c274b-0a75-4b82-af4d-be25ac391900", "value": "24576:e2pTR+HIyS+LDqxxxMu7C9WU6qUu88jJZf5zSK4gLvn:HRpx+LmpPCz6qKUjxzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689400, "uuid": "8de1fba6-2a06-42ec-9a39-18490d5ad57a", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689400, "uuid": "1e4d0f5b-6c2b-470d-9b73-8254b752d3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689400, "uuid": "8d6341ef-8b9d-4cf1-8b98-cba14bc1e712", "value": "SecuriteInfo.com.Trojan.MulDrop21.51235.20307.20161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f79880-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666358, "uuid": "6bb53d79-4fc3-41f0-bb0c-d9c3af74f7e7", "comment": "Malware payload (Mirai)", "value": "38afc97c8f8c15e844ebb07798ac98b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666358, "uuid": "842aff28-5ab5-4197-9d6f-b7ae4fe34c6e", "comment": "Malware payload (Mirai)", "value": "618871232af48b866535822d5fc89bc68b1c1bef4a3b2de2988c545b97bc500e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666358, "uuid": "236b2de2-64ec-4f46-a446-32051655a759", "comment": "Malware payload (Mirai)", "value": "32b996e911f67672ab2b28542ddbe558a1bf72d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666358, "uuid": "ae18cdd3-22b4-4030-a527-2d2055332023", "comment": "Malware payload (Mirai)", "value": "bf53ae85b9f87d93009ef2b9c66df843d17e78e215ba69151ec5d1e13cd84bdd21ee7a12e524e6b5782e077d236fd489", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666358, "uuid": "a6f9ee85-4d7b-4f3b-adc5-0b521df962eb", "value": "T1AD937EC4F743E4F1EC5705B12177BB365B32D0B6211AEA43C379AA31ECA2542D61AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666358, "uuid": "b427b7d9-9520-4f28-ae7d-4bc58e130cc8", "value": "1536:Xrxbdr+dQKANujbKGkOTyO/f80UxokunQxboheA3U7SMtMIdzT:Xddr2QZNujeGHTyC0FKnCo1kWIdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666358, "uuid": "28d25255-e78d-4e1a-9a8e-b331209fcabf", "value": 93576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666358, "uuid": "6f75c0ba-c9b3-45e2-8272-6b1e256b4ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666358, "uuid": "eabf10ae-5d40-47a2-b36a-81b5a767cf0d", "value": "bulu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c6ac35-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687804, "uuid": "1b63ac27-6e65-42b8-a823-e62a588e583c", "comment": "Malware payload (Mirai)", "value": "0906e2c956e4fb70caecceb3ea3a1494", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687804, "uuid": "ddfec9a6-aeec-49b0-816e-4ef29fc1c2d6", "comment": "Malware payload (Mirai)", "value": "61b638f3a2224bfb3a79b2b76676860fe18f3d8b1654b97fca78545b01086031", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687804, "uuid": "d3471c06-b45a-4b6f-be6a-2d05ad40ea9d", "comment": "Malware payload (Mirai)", "value": "b4644d713bd1e653b8ba654bb574618877173f62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687804, "uuid": "34deb566-5f72-4402-99e0-a9df50cf91a8", "comment": "Malware payload (Mirai)", "value": "dc0ed022e36491dbc85a3a4bcf3155d5464e8056935756ee5b9ceba55012f0bcdac7591a0b097d2b7bd2134ed0dd4fb0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687804, "uuid": "c557a1bd-360d-4a2b-a686-34091a1286fd", "value": "T19ED3F845FC415F13C6C612BBFB5E428D3B2A17A8D3EE72039D256F60378A95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687804, "uuid": "ed9ef905-3c8c-4229-8ac4-ce6338952b30", "value": "3072:tMUnIBelrr7714zl4ttqJQ39k46QyH6B+:tMUocf7254t4JQ3cQyH6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687804, "uuid": "0ea00a19-8207-4a6d-962d-981ff55c024f", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687804, "uuid": "033136fc-74c3-42d8-b3c6-6565deb63871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687804, "uuid": "35127b54-674e-4976-8044-793d16c08487", "value": "bulu.arm5-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0270065-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meduza)", "timestamp": 1706717589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717589, "uuid": "8ac12444-369f-4794-9c22-9f0846ec7c62", "comment": "Malware payload (Meduza)", "value": "167545d30ed35a8f29cec0a0ca1cfadf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717589, "uuid": "9428e375-e80d-40da-9a9d-0f7a058bac44", "comment": "Malware payload (Meduza)", "value": "62f3ab01f7fa27a82b402520204ce76091725364d42a58a6b9fcd8b123dee313", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717589, "uuid": "d33b2f3d-7f15-41a3-bef6-f3980d76e137", "comment": "Malware payload (Meduza)", "value": "e56cfc605e11cde1083afee42205bb70c24c3df7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717589, "uuid": "7d7c43db-c71f-4c55-b597-18f4cfca3d79", "comment": "Malware payload (Meduza)", "value": "71ea98eed32d96fbf6140ca424d96d76c931e972ddd4c7a2746e7b7d5673b1ae170999e9ef75e5af8c7ade2d0d8545d9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717589, "uuid": "5a1e472e-6833-4a9c-9a0f-de270edfb973", "value": "T1B4D571085A3E0295E5D18C7163730663AD79BD1CC01C6AB5CAC09B4D6F9FB23A5E73AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717589, "uuid": "71d45bdd-cf50-4ea9-9fda-95b2e1f483e6", "value": "43b39c9b04924c8349e2841f885cfb0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717589, "uuid": "ba822eda-fd7e-491d-95d9-5771916c1501", "value": "49152:5fsvw7B1HpFZoqLElQqGwddwFh0cvPrpoGHflOhIIPhHMMNl:sdjF3ctz289Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717589, "uuid": "26c8d914-eed6-4a03-bf95-6bee20c468c5", "value": 2756096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717589, "uuid": "d87ae20b-109d-4ec3-86de-1eb6aa0f744a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717589, "uuid": "1fd10d40-bd55-40c8-89f6-ca2e39de7912", "value": "167545d30ed35a8f29cec0a0ca1cfadf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b3fb0a-c060-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706723309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723309, "uuid": "108456d4-2589-4fe8-a69d-4bd3030441e5", "comment": "Malware payload", "value": "560b531b7ddf374aff95eff83cfa44b1", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723309, "uuid": "31acb82f-2843-4ea3-94b8-ff8c02577932", "comment": "Malware payload", "value": "64a3fd9012ac55e486dd983bb1e030c5de9de8b6414e35c2dbac5f7c98b5d497", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723309, "uuid": "76f743a9-f53d-4b1e-a12f-644ac305dee0", "comment": "Malware payload", "value": "07a6c55f4abf5c637fc36e6a8ab88384eb346740", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723309, "uuid": "0bddc79e-78a1-4b88-8cb2-10e19de289b1", "comment": "Malware payload", "value": "1025f81f1afc2d502c3bc7d7972eb44797f4e5e11e1a89667bac57d4df1968787165a8052e2cf5632d3a26f28feac602", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723309, "uuid": "d89c6bf2-5166-4c02-9baf-152ddb2be46f", "value": "T1F985337F1E78369872970F11B21DEE5AE2265EB28D14442F0E3E72CE21ED005D56BF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723309, "uuid": "9ca9dab8-c2d0-4de4-8fe1-b68f5ed5aee3", "value": "49152:7uVQogzbwhM8HQDm+lo/adQeFWogoy5d5TU+0UrGFATGO+3tm:7uVhttH7aeeMI+ymX7+dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706723309, "uuid": "b2822ac0-44b4-432f-8b51-86f4970c66fb", "value": 1821832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706723309, "uuid": "8fb242c7-4248-4e07-8dad-3f8a3195d762", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723309, "uuid": "2592fc55-3610-45f4-82a8-d080e7dba956", "value": "64a3fd9012ac55e486dd983bb1e030c5de9de8b6414e35c2dbac5f7c98b5d497.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69305ccf-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698170, "uuid": "4461d03e-a683-442b-aaf9-2f4e8a072921", "comment": "Malware payload (AgentTesla)", "value": "8926f6c445437f3f903989d2577dd29c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698170, "uuid": "7f7e5516-2fc0-4343-8ea0-54738b0d4713", "comment": "Malware payload (AgentTesla)", "value": "65046e4e985fab7242de310d63b00070e2117bb6f5e064fae277d9db45ce9b46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698170, "uuid": "5c314ad9-ba92-42cf-93bb-6e6ec7894be5", "comment": "Malware payload (AgentTesla)", "value": "df0f2f395e7af9250a92315d70f785c47b1377eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698170, "uuid": "96f85384-d251-4ce6-9e03-ec5c1400b535", "comment": "Malware payload (AgentTesla)", "value": "e2a08e6fff1945231e2a5ca314c791249f5cfa627e845d3aa0cd045d562067197e8b5842129161ebc50598c63bc40d75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698170, "uuid": "21d6d9cd-fd2f-4e96-83d6-10a85498a782", "value": "T101E3BD6DD34B02598F620377AB271E5042BDBA7EF38152B5346C437933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698170, "uuid": "90d16fbb-fcc9-4f9d-92d6-376e7c3ad6d4", "value": "1536:OwAlRkwAlRkwAlRWxN+MQ80onlKrFcQ/UPDvN:OwAlawAlawAlMf+MQ80on0rmQ/UPDvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698170, "uuid": "7222fabc-4f73-44a8-a0b2-3e7b3ea89d2a", "value": 147167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698170, "uuid": "6a0ebadf-55e6-488a-bfbe-9c371f348e68", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698170, "uuid": "1844ed83-f5f8-4b67-b281-54e9d363c128", "value": "Enquiry 220062.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ecc08a-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699131, "uuid": "fec09dd7-83d5-495d-b3ab-dbfca6394a49", "comment": "Malware payload (AgentTesla)", "value": "d674d602369baf93a0eabc830ca806fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699131, "uuid": "713b513e-8ea1-4a26-95e6-4fb592986530", "comment": "Malware payload (AgentTesla)", "value": "654f5bbab8f033ee0145ab0061a66d7e1913bcb73d2d48cbf73f3c22d40f2f9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699131, "uuid": "fa76af37-656e-4321-a5a1-75659876a7a3", "comment": "Malware payload (AgentTesla)", "value": "23e0a9f045c3f74ba0efa557a5bfc658b5ef7b89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699131, "uuid": "69676444-2f44-47d1-bb51-a9a0a29ebe45", "comment": "Malware payload (AgentTesla)", "value": "d8b569d7a79ebb57a23ea81be08869a59e4aff13afc437575a130685814638eb454781a2964c60b2af5c50907e22e305", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699131, "uuid": "1f2548f2-b703-46fd-a30b-a72cbdff01d9", "value": "T179E4129227B95F26E7A95BF680A1500987F331779923E7084D8714CE192BB494FB0F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699131, "uuid": "aedfc31d-438c-4ccf-a736-83bdacf55d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699131, "uuid": "6a2d2efb-c47d-484d-b5f1-e498c36abe69", "value": "12288:JCk5IAYQ4RzgLsWwqt7c6e944tkTDT6ofZCs6oS9bV5:M8IAM8L9wYjQtIDj6Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699131, "uuid": "ac653991-a3e3-4cf1-b446-39384e1b220f", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699131, "uuid": "9839b139-3e7d-42af-be22-943121df867a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699131, "uuid": "54ddb624-d38f-4c0a-9307-fd32ca374e33", "value": "Order list_02-2024 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbcccf3-c011-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706689396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689396, "uuid": "d2f631e4-3719-436d-b1bd-8efaa52ff136", "comment": "Malware payload", "value": "f389c724bbd899ef771d6603da1d9a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689396, "uuid": "f526f957-91fb-4de0-826c-ace5a08861e2", "comment": "Malware payload", "value": "65e729d7ec5f84a55decfebe05fafb602f7bc70dba58968dc91775de496e3462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689396, "uuid": "3bfc12a3-c90d-4993-8652-080cad3f9ead", "comment": "Malware payload", "value": "d22ad1cf649ba090d6da7d3fa8af863f8a1853f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689396, "uuid": "877e5f56-e95f-4c13-afa3-ee3b2caceedf", "comment": "Malware payload", "value": "22f9a201e502d2305b2696020f2bda56a2c181881cbe3824424ce1eebf98ebe5e17c56dd6c3b252f1e79b96c86969f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689396, "uuid": "407c8c18-889b-43b1-a800-f3ba9a3aeb5a", "value": "T12EF4AE5667A803E9D27B913C8583C603E776B09A131197DB07B0C6BA1F23BD16E3B752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689396, "uuid": "d1b3c587-717a-453b-9592-ea08679d24c0", "value": "695efe538699c99003f8700eadc26ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689396, "uuid": "15a6ef94-a3d8-4561-a5ae-03787a9ffe53", "value": "12288:Wh/tM3YgHTqcuUTfhMZTBhJl0KWGZYXdL1kTXaKIEUQSSFG:WJtWY+iUTfhMxTJ0GZYXIXZUQSSFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689396, "uuid": "8c67069d-1461-42e8-8bfe-669c6494ed07", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689396, "uuid": "6c9bbf2d-911a-4533-a34c-0a4b0a369971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689396, "uuid": "5da25d0f-6468-48c8-b4bd-1434cede3282", "value": "SecuriteInfo.com.Win64.CrypterX-gen.18373.25192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f007ec0-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706660437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660437, "uuid": "5aac5529-65d1-4fc6-ab05-895d8aaaa557", "comment": "Malware payload", "value": "4006ddc47f10e41fba671a86b44956c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660437, "uuid": "c177cec1-d1e0-4c39-81ec-7d15f3081862", "comment": "Malware payload", "value": "66fdcbb59fba03632cb0288ce18978994630c3120bcfc948b41297bc6c61ae7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660437, "uuid": "421e2d68-6a23-44e4-8113-60f6fdbd3833", "comment": "Malware payload", "value": "02c6673784d8f983295ce940e14a89fde26474f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660437, "uuid": "c9dfeeb5-af6a-427c-8943-2463e710a704", "comment": "Malware payload", "value": "b9b3efc3c10bebf301f153b9bd2167ff629059570146038a19411e12cb77e5972a4d038196137d0cc9c951430f65b864", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660437, "uuid": "6bc6d466-1c7a-429a-b0db-5996c402fade", "value": "T16A13D0AF0A119EBBCB35D37220F414866B508A761C55A1197F012C3EC5B9BE462BF70B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660437, "uuid": "b5c0e4eb-3a23-44b6-b232-a31c750a1424", "value": "768:YNbvbVVZEl1vcMCIRTyCJ4tJmXIXQGOoWBu8Jx1eS7G2kj/elwEd:YlDvmllisEQGOoWBuMx1vt4G2Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660437, "uuid": "72724d07-6ebc-4478-a146-ce70b13babc4", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660437, "uuid": "d8be5f63-5742-41cf-b1d1-84aa81ecf7d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660437, "uuid": "b0052e64-8636-46b6-b1d4-e24597a70e51", "value": "6a684f04b6dc6ed0ca2bc55dec214e78c664aa18ee412fd290e6d543866115a9_sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb00fbf-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697907, "uuid": "4e54493d-3157-43e5-aa5e-ab6765131489", "comment": "Malware payload (RemcosRAT)", "value": "878078c466bf39d3889c537f02f8fa54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697907, "uuid": "7bb11e89-0131-4b48-86dc-aa9330dd07d2", "comment": "Malware payload (RemcosRAT)", "value": "68ccb463fdab2c51914f73f43af0938c3c368df411655c0e66d5f105ac6f21b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697907, "uuid": "fdd863a6-ec84-43d2-ab2b-bae1e32127dd", "comment": "Malware payload (RemcosRAT)", "value": "6d98648e7442ef9edb69642fd4e20c933e815aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697907, "uuid": "73c571c3-cab6-404c-99e7-880e5528243c", "comment": "Malware payload (RemcosRAT)", "value": "80e5f5a781628eee2f31221c2b370ba70315494a9ea93443f1e8be91aea33108db41e8355b29515a524e388a6bcd880d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697907, "uuid": "9f76bbf2-6bc6-4955-abff-f087b650d05e", "value": "T15185BE2276E4553AF222747917967BADF92D6D3C98226CD566F1280CFF23200FF08667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697907, "uuid": "d2290716-cfc6-4e87-ba4e-82d050a6c2ba", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697907, "uuid": "3fd3b4b8-0db1-409d-b1df-29513c8f4cba", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOj:gcP7HHQU72UHk7c7mvrq0gOPiQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697907, "uuid": "01a9d2bf-594d-435c-b40f-8d3cb00f70f3", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697907, "uuid": "79192f13-7d15-4919-ba1b-8c3490162427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697907, "uuid": "c5f7d029-85ff-49c2-8eb5-9fa763e0d681", "value": "Fatture Saldate_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bbc7a6-c012-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706689404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689404, "uuid": "5420c3ad-f994-4366-ac32-95527423cc9e", "comment": "Malware payload", "value": "6d17432f26432cb832c5779a52ca36e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689404, "uuid": "9fde5947-886f-4a8b-b6f9-929535de33ec", "comment": "Malware payload", "value": "68ed975715ac568f50cfa4ca210c347c51dd8f4eb2869159ac15785394b7351f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689404, "uuid": "267c7722-900f-42cf-8a66-9b45c4a7625c", "comment": "Malware payload", "value": "8b86d878d0d57e04ab93fc6b18bdce55aeaeea24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689404, "uuid": "a3b65764-0f5f-4f69-ae8b-3961fbef0d05", "comment": "Malware payload", "value": "10c4cf2cdbe630a3423a8dbbd0923ec6d5893d53bef3a73c78cfa1f9011161021ac728d1a13428bd04588a7f53cd5d04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689404, "uuid": "70be3406-18db-4ee7-987e-4d3f05507e33", "value": "T11C150272501A41F4C2F5C2759C665E4F7B60238F30E96DBD3E988932D897A072E7B1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689404, "uuid": "3a646633-22b8-4adf-b46d-6391e76e274f", "value": "25e757430a32a80ff7eae8c4416e9f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689404, "uuid": "876f14aa-1dbf-4e5b-9c32-ca83553f9801", "value": "24576:23RLr6fM+vu+7QARgm29U0Jx1aO+jyfGCBG:2Vr6fdub+C/X1/+YGCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689404, "uuid": "8d2cda36-0c04-4287-a365-75af71939e61", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689404, "uuid": "056eddd4-04eb-4b29-9de3-a271a101c5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689404, "uuid": "681c35fa-148b-40d0-9c62-01f0eedb8c70", "value": "SecuriteInfo.com.Win32.Malware-gen.12534.10068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5ab7b3-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699356, "uuid": "c861fbb5-2f45-4b53-8389-2646e239c0cd", "comment": "Malware payload (AgentTesla)", "value": "2f28e4ec0d902c758d729ac99e7e89f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699356, "uuid": "5ff1510e-13b3-443a-894b-fa86660e4cfe", "comment": "Malware payload (AgentTesla)", "value": "692174a7e316ea4308b664cdef2b7d3d243c8d5b01a1b93029d92331f7602e9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699356, "uuid": "5da1779d-65ee-4cfc-b38a-dd934e3a473c", "comment": "Malware payload (AgentTesla)", "value": "b1438fc44e58f09652df992f86e5555ba4c5bcfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699356, "uuid": "16cae97c-e17d-4be1-a7ac-d88a254b79e7", "comment": "Malware payload (AgentTesla)", "value": "10b96f5931568a406dc940e483468f12d8bf89349e540f999ed20a3c1349c76557180b2700cb88eaa49071693dc328e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699356, "uuid": "15598422-6334-4174-9b8e-d452ac74de60", "value": "T131F4122B77D85963DA5C0EF9CC0901CD1B70CE25AEE3E3C72DC871982AF6395265A543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699356, "uuid": "b7ea2690-8f87-4026-b734-2089a5b581f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699356, "uuid": "f3dbdd62-401d-438d-8e58-f9c774dc6f9d", "value": "12288:FO9xUDrMMc0YqdnKcvG1O5fCi7VM7GAdFyuwN8bFU4gg8gjysxKWYR9P7TAVQh:Y9xUFc0jdKcvGeC0VM3dFEAFU49yScPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699356, "uuid": "7c68698a-cc31-4470-a9f9-7ad7f45416df", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699356, "uuid": "7424bdfc-4dd5-4dbb-902f-2fbf3731bb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699356, "uuid": "cb1bc13b-0357-4ca9-a97f-5bf82138fd56", "value": "Transaction_Receipt Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94a97e2-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698787, "uuid": "e586de28-7ebf-411a-ae4e-8a4b4e834e7e", "comment": "Malware payload (AgentTesla)", "value": "a622242aa840a298fca774b57562e19f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698787, "uuid": "ffdaa125-bbff-45de-bf6b-d2afb7697821", "comment": "Malware payload (AgentTesla)", "value": "6939519f69f8ad0529ae05709bdac147a926cfe0dc462784eeb08bdf13d4592f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698787, "uuid": "64d572ad-1f2e-48e3-ac00-e0980d503d33", "comment": "Malware payload (AgentTesla)", "value": "89e739928ad16d770620693c78194cc80d094604", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698787, "uuid": "0f04240c-8985-4e13-a4a4-9f1077aca305", "comment": "Malware payload (AgentTesla)", "value": "547d70a89b18f799deb597064466e27b8356e0eff2df1da1a271be6e1bb45ef61897d4d54e6f10e1e7c171c84d9a973b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698787, "uuid": "17e40342-ad39-43b8-9ebf-4b5d60879f3e", "value": "T16305BD84D9545AA0ED2C9BB16636CD3093333EAEA834D56C2CDE3DA73BFB7921111853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698787, "uuid": "f53ea9d1-a63b-4a1d-aef5-79cbec4bdac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698787, "uuid": "83156b09-49e9-4682-a81e-bd183d9b6967", "value": "12288:TRc+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l2P7r9r/+pppppppppppP:TRLa6u/ZKCcmdqw6S2dR21q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698787, "uuid": "c2127711-7258-4f49-a3f3-c015648e80a1", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698787, "uuid": "b2f46ee6-e6e6-43a2-b281-2690fd7c81cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698787, "uuid": "8b14c634-7aac-4d40-8b5c-dabf551e986f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63ba71a-c04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706714620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706714620, "uuid": "765a5351-c52e-4043-b731-4b2ad1e123ea", "comment": "Malware payload (RiseProStealer)", "value": "8471d656e237482c2011472da91e9c2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706714620, "uuid": "6d929874-58f5-4347-8486-244b06ab09ed", "comment": "Malware payload (RiseProStealer)", "value": "69e0255466741a6bdea3fbe4c2c83cd6af4fd274fa1f2646efcd91211f0d45d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706714620, "uuid": "958557ed-bd0d-49cb-83b3-0d3357d7dfe5", "comment": "Malware payload (RiseProStealer)", "value": "2c40b588362fdaf13d60c3581e54591bf1777afb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706714620, "uuid": "97f35856-f262-472a-bb7a-7ae49d82a1ff", "comment": "Malware payload (RiseProStealer)", "value": "008dcd95b4a5c1253d1d98ea809ccc9340ac6e8010e65a8a362066ff1f7af61393b5caf700d6acaed9779e580f59e573", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706714620, "uuid": "15632429-daaa-4750-90b0-5954e1de7579", "value": "T15BB533EA2D77D1B3F89BA7BE969702860717AC0F0B3112183064F96A537EA70579CF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706714620, "uuid": "a2297a16-698b-47b8-b2b0-333b0051bd6e", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706714620, "uuid": "7f9690b8-a924-4c9a-a5fd-1ffea0a9c032", "value": "49152:JDdVW5iFUCZ8zezcNPLzHIEtaku21GiEDrWfyRQ44x9FGZYL8V+DUikX/LK6:ldRWNfbaTsBE/WfyK/xSYe+UikDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706714620, "uuid": "2e58741d-5501-462c-8b93-ca76b65a78b1", "value": 2309120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706714620, "uuid": "bbaf1016-ca2e-4ff4-ae52-608eb449c120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706714620, "uuid": "085e3969-1831-4039-b73b-ff44aba6e3fe", "value": "8471d656e237482c2011472da91e9c2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2429b852-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706682162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682162, "uuid": "6803874d-0c58-4788-99ac-218577b2daff", "comment": "Malware payload (RemcosRAT)", "value": "b3521b438b1707d742aa5d30f5390962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682162, "uuid": "e6a0c525-90a1-4102-a51e-625e04c90584", "comment": "Malware payload (RemcosRAT)", "value": "6a02a0fd037b5bba2f76936c69a025cbefb3d104835cc9a1a5485097b2636331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682162, "uuid": "e70860c7-7a02-4c57-8ed2-4f815a97315e", "comment": "Malware payload (RemcosRAT)", "value": "700ba8107e6a6b9c5c487e337c2797563cca487b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682162, "uuid": "9afdefb1-d1a1-4c0f-be58-ae069af546fc", "comment": "Malware payload (RemcosRAT)", "value": "503dbcde4a66250fd6cdbe176266caf025f13147502f6f1d86463f602eaaae8974c4560cc7c18bda3399065d3345ba80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682162, "uuid": "32bc67a9-ca4a-4676-9232-7e311083c25a", "value": "T13A85BF1276E4442DF226B43913967BACF82D6D7CA8256DD666F1290DFF33200FB08667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682162, "uuid": "5bd3661b-e106-42c2-88fc-0ddfc806da36", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682162, "uuid": "f9a365f9-7cde-4d19-ae44-91288e34f32a", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOK:gcP7HHQU72UHk7c7mvrq0gOPtQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682162, "uuid": "20a00394-ea17-49c8-8e97-4baeab9d1039", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682162, "uuid": "46bcb746-688a-434c-905f-0a4960da8020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682162, "uuid": "cc43baeb-74fc-4a9e-bdc5-0f886091c8de", "value": "SecuriteInfo.com.Win32.MalwareX-gen.6079.20446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6bc8b8-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678495, "uuid": "2513f28b-78ab-4d23-a2be-3b99551e2ae8", "comment": "Malware payload (Mirai)", "value": "a45e2dcd51b945d34eb2537c1dd954c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678495, "uuid": "4185e38e-1b58-4a79-9dde-0578ac2485c1", "comment": "Malware payload (Mirai)", "value": "6bc86e1a9bcbe630052bf191bf07e472a49b0084b6bb9d8209c1289e34107719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678495, "uuid": "0f89f248-b43d-425b-ad29-77e0853c62f2", "comment": "Malware payload (Mirai)", "value": "48bb05156267da96d9df2892618d31464f058969", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678495, "uuid": "596ce1a6-2169-4934-9623-a6346d5570cd", "comment": "Malware payload (Mirai)", "value": "73746411a9cdfdc58a22f079154f437d985d94ff24421d39b8590c96bfa63757f10e96a1ed94f52411095ecb41d4adb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678495, "uuid": "da1006a5-4668-4e84-ae49-d4b681c33933", "value": "T1DF33F27C3B138788CE2FCABA03801AD015E406275471E4191957BAE7F6CB9E6FD1B5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678495, "uuid": "3f3b819d-60a5-4c3d-8a87-8bbad0738123", "value": "1536:lkmnMUEDSjUuy+/Tb2LdM4SoOcOIQAbOPmrJ2lVJu6:lkmnMUExhskM4SKpQAxrElVQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678495, "uuid": "f9315db2-d5da-4c90-b9ec-9f3f95836c3d", "value": 51312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678495, "uuid": "e99313e3-a2aa-4153-a3ca-1455f20d33e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678495, "uuid": "64983d9a-3847-479d-b57c-c2a264a7ce76", "value": "a45e2dcd51b945d34eb2537c1dd954c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a7ecb5-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698784, "uuid": "0d09a4fa-883a-4906-82dd-013ac5e055c7", "comment": "Malware payload (AgentTesla)", "value": "972c2d3b68b4d65eb9bf9f3cb3562c7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698784, "uuid": "008aa570-43fa-4b1b-bc11-58809d5451fd", "comment": "Malware payload (AgentTesla)", "value": "6c3bb0b782e21e0a8dd0307b01a0cc3825f8d6f30819ae832b599509ea6ce992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698784, "uuid": "3d7896c6-8155-4634-99e4-a2ce55139a8b", "comment": "Malware payload (AgentTesla)", "value": "b4adeb0e91eece10e9c781de0f837013e929d3e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698784, "uuid": "6e4e74d6-4868-4d0a-9dc7-b6539c450046", "comment": "Malware payload (AgentTesla)", "value": "3d166b5887ebf9169570bd4a28fe9fea849a12aabfd1b4a37c49b974dc2d3dc25a64bab1a6c7b37af705240688aa5b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698784, "uuid": "84d5e280-2bd0-4f45-aa1e-91f018e18240", "value": "T105C402289A349F16FA3D0FF620B4BD11E3F212976516D7B95CD920C52AB3F250B04EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698784, "uuid": "6881b923-acb4-498b-9973-939cbdf2ecc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698784, "uuid": "ceda8595-5554-464e-8a48-daa52153c0a7", "value": "12288:aAY+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:aAXa6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698784, "uuid": "5eee46de-00ba-46c3-bd2c-59e26812a83f", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698784, "uuid": "bac92f46-bac1-42c3-8210-61f1901b0146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698784, "uuid": "d2aeb65a-f391-4688-b696-b8a0e2cf7342", "value": "HG09876780000.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7096ab76-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706698612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698612, "uuid": "6e5f8a16-6140-4159-8da4-cefdeb0dd12e", "comment": "Malware payload (GuLoader)", "value": "da80b4ec72949dd75da2f5fd0c6cb168", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698612, "uuid": "5863219d-5344-42db-bbd3-4cbd1389ff3f", "comment": "Malware payload (GuLoader)", "value": "6da8e252d906abeb6049f1e46c800fab49ff82b466ae32911c5638eef209c398", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698612, "uuid": "7dc13e35-e34b-4c84-94bb-c71724c51821", "comment": "Malware payload (GuLoader)", "value": "d693d8a82324332b707d2322fe18d7d3babe8a61", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698612, "uuid": "9fd8482c-bcd5-424a-b665-d51eb0481903", "comment": "Malware payload (GuLoader)", "value": "e4821862e779d95e6edb7034f1d7de37d09eb561160b2b88512c7bd92c634fb13903e9e610352e0c3dab0fa920fbfa41", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698612, "uuid": "5846e571-066f-417e-bdb2-658da73374e1", "value": "T1380339A0DB4B39154D4A3369FF5888018A7CA410582774A1BF9A076E9C0757CE3EF7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698612, "uuid": "2876e664-d0a6-41f5-b597-20fb5de80911", "value": "768:jhibhgjVqyQESC653tTlVmrOOAcqvpmKPjkvcub28mLL5t0QrwEAM:9bQVs659Z4ipv9PQcY2p6QrwEAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698612, "uuid": "eb87d7a6-4527-4844-b8b2-ba95a66a8126", "value": 40466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698612, "uuid": "98c19303-73ab-42d9-b77b-2ce079f7922c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698612, "uuid": "aed82c3d-6456-473b-86d4-7798c713ca02", "value": "List.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f70491-bfef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706674626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674626, "uuid": "b5c7fcfa-2360-4aef-94c8-6a8fb7a08e83", "comment": "Malware payload (LummaStealer)", "value": "32259010418da240da7f3a5d2b8e3981", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674626, "uuid": "a49f080d-cbf4-4d35-822f-e98c282dca4c", "comment": "Malware payload (LummaStealer)", "value": "6eb059db599f4264f5faf4d183ae69eb0d8b1310a11afd775e312d392f69ebd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674626, "uuid": "54f56830-fd33-4be5-a393-bc5e84e6c2df", "comment": "Malware payload (LummaStealer)", "value": "af176350cd487d046bce54736f93a7bc54518947", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674626, "uuid": "f3a9406f-86dc-4b5b-ae76-6ccd42d85cc6", "comment": "Malware payload (LummaStealer)", "value": "fc4801611f7bff37aae8752b6ae849bbc90e0cc296a17b944e7999317aaa02423eeb5be80c500ad8ae3fad31b9e37e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674626, "uuid": "f60f2937-4fa6-4b04-991c-e50f7f9db7a6", "value": "T1C0D4124A37CB5236C89908BD80E748A003F593977AB3DB0A6A5C92D94E02FD5C356FCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674626, "uuid": "0756c1c3-1b12-4bb0-a743-a192276a6185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674626, "uuid": "b39bf661-1817-476f-9b04-e1e11a420833", "value": "12288:NPZ0eqzykCRAf/WfyKKdu02gtDbzrT/4YYUW1u3gCPUZ+1aPBp:NPZ3qzzCoRrrNRW1u3KNPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706674626, "uuid": "c250c955-05dc-4971-b057-1e53a938b01a", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706674626, "uuid": "433c6418-598f-42b6-ba2c-13281ac34c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674626, "uuid": "4f7564c8-23ef-4392-ad16-3a1c412c4a7a", "value": "32259010418da240da7f3a5d2b8e3981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813a7a59-bfe2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706669004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706669004, "uuid": "9007f274-bc55-4cf4-b835-30867f1daada", "comment": "Malware payload (Mirai)", "value": "f65810a969e45e4e5632c908c752eb35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706669004, "uuid": "8db4c243-35a6-458a-89e4-c169b57f6614", "comment": "Malware payload (Mirai)", "value": "6eefc435106d6cba2b64585473c59bd90e7204613bac2ce7befa6d763caf5f97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706669004, "uuid": "60a86c0e-f563-48d5-8276-59294194c138", "comment": "Malware payload (Mirai)", "value": "67f630a7dd974ebce0f8654de0833891b1cb4fb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706669004, "uuid": "dafba3da-0999-4793-aa25-f7c41aed0f07", "comment": "Malware payload (Mirai)", "value": "7e19db196b9debedc727c36fa0f26b8fcef59b91fc4148688718d940ad6ebdea4109f1655392d8e5103aecebb399056b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706669004, "uuid": "8b868439-bc8e-4853-a9cd-a3dad39e613a", "value": "T12EE329C7F800DDFAF80AE33B48530909B630B7D155825A372297797BED3A1991877E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706669004, "uuid": "cc50d484-b8c2-4349-a7ec-83e153d956db", "value": "3072:e06myfQL9O6rO/3bN2NtzAocA8BXoVrjbi8LDELtuyNxFJdK:smyf3wNRAzBXQLDEsyNjJdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706669004, "uuid": "9a8fccb8-e140-4207-a665-2e84c393e874", "value": 154528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706669004, "uuid": "d74d1f3a-f4ce-4338-a0f4-7dd0cbe7504a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706669004, "uuid": "1998d33b-75c9-45db-b206-e0b6a8b5ea2e", "value": "f65810a969e45e4e5632c908c752eb35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce0ab50-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706699062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699062, "uuid": "a33c9626-7af7-429d-97cc-34763a42bc18", "comment": "Malware payload (SnakeKeylogger)", "value": "e12779a7b7ac2d2c85e96c9ac6d7d7dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699062, "uuid": "e2a34749-6e20-40e2-9abc-e43bf543b79a", "comment": "Malware payload (SnakeKeylogger)", "value": "7006ebe925d1d4c3921787ad6ffcae07f437ebacf41d332b24803cc700796b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699062, "uuid": "52aa7e93-2e24-4f16-8183-8bcd223d2dda", "comment": "Malware payload (SnakeKeylogger)", "value": "3484bd1094df0332bf9e4c5f55abb4d645140015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699062, "uuid": "7fa86e0d-6e7b-4f9e-bde0-46fe1e519035", "comment": "Malware payload (SnakeKeylogger)", "value": "de701e3e7a5aa3c0767346d014df4ec5a87bd67109f322fd85ac3b01f8a5b504a9e364ff8dfdbe8d1680c052983e307d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699062, "uuid": "47af8f46-93ff-4d84-b5d9-819400172cc6", "value": "T1D0C41245A7F84B25CBFE4FFD05F164010BF16A3BA926E3540DA1A8CB1A37B110A61B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699062, "uuid": "8a35f7ec-a0d9-4a3a-a571-e4cd3548ad2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699062, "uuid": "0bd8eabd-29dd-4d10-9f95-b148d77bc40f", "value": "12288:BxNGIAYQ4IlQoXl3qzyheegDgdWzWmsGSnhXhawq+n0hdxaL:3sIAlQoXd8ykegDgMzWmsGSzbqsCdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699062, "uuid": "968334a7-670d-49a6-a4df-37f2632ce1a7", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699062, "uuid": "2e2a21f0-d452-4a45-ad8d-a575325e5aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699062, "uuid": "239a728e-5843-4594-9f46-d8f0a407d2fb", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a8e490-c016-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706691444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691444, "uuid": "784246bd-1573-4417-884f-7dfc3bc54880", "comment": "Malware payload", "value": "6a4cfb4777634bc170a30c23fbab0120", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691444, "uuid": "180c32c7-bb03-4b46-ad9f-56bd00fd8182", "comment": "Malware payload", "value": "704b955bf7013a6cf8e56cf55f8e6cb1d5eb8092e4e238e58113d96e4c113b5f", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691444, "uuid": "cba2a7a3-a29e-471b-a7d4-c3c121d24676", "comment": "Malware payload", "value": "aedb89cc0e8786c19c7077097b880fd67f7877e0", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691444, "uuid": "060d99d6-c97f-4aa9-9d5f-4aa3dacd11c3", "comment": "Malware payload", "value": "986363896c6e6a9a7fcde616f3d7f6f2194d29a8263dbc0fb8508328cee015513c7adcbf0054dc460bb4cf0487daa85f", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691444, "uuid": "77faa0ac-7b3f-4330-af6f-557df1d106fa", "value": "T1C0A18E92969F4C3E886562FD71A3C003922BC76F4A477BDB2A0D2688B3424D70417386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691444, "uuid": "050c906a-c7f8-42fd-8543-0946486c6cd2", "value": "96:RGP2KeMVOef3906aOsWzkPIDLv70WkgjeLJWG/DmK+z:R42KRMeF06BsWrvwWkg6LwKmNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706691444, "uuid": "f09e8365-2ea3-4ca9-bb9e-c2fa72441a4e", "value": 4908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706691444, "uuid": "e5cd51d2-b9a5-4829-8ed7-013a51c18312", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691444, "uuid": "7b5b3eb9-0d81-42bd-bb71-fe73294ee81a", "value": "Dispute_Verification_Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7809411b-bfe2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706668989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668989, "uuid": "91954090-84e7-42ee-bd96-88515fcca718", "comment": "Malware payload (Mirai)", "value": "7d39b2836a25cb4520a086065f4f3559", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668989, "uuid": "987a4f6a-6be5-43f9-9385-b3d136200c78", "comment": "Malware payload (Mirai)", "value": "70e71d1bdb075cdb7cb2165875799913ab630d29207bd59474c9bd6f65bebd2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668989, "uuid": "97135633-1075-44b3-b47b-a93db3834821", "comment": "Malware payload (Mirai)", "value": "163cc694298bf9c96f266a0935397bac4948d627", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668989, "uuid": "e46b1ad6-de37-4f78-a4fa-cba86abf2c2d", "comment": "Malware payload (Mirai)", "value": "ccb1cac47a6140f04a4d97c0a5599bb739d8aa737f030a77ea9637abcc35c2340772eb0e68fab299fbe5607a7e58ebf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668989, "uuid": "dea5c227-f0a2-4767-bb6d-4d78951067e2", "value": "T1CCD32A05B31C0A53D2632EF03A3F67E093EFEA8121E4F644255F9A8A91B1E335585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668989, "uuid": "c565639b-0b09-4263-8056-c5091ddd8255", "value": "1536:eBNPuw933JIc5Zoy4xpcvTCN2B7YYHg4EXM8fvAfINKFQxLhPq+NwkM+BSx:IHxoy4xC7CSXgDXM9fYM+BSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706668989, "uuid": "b3b0ee35-f66e-4750-aafb-ed6f05e108ad", "value": 136760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706668989, "uuid": "3e6f0b6a-afcf-4556-8dbb-80508fdea469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668989, "uuid": "cad47626-3a7c-49f3-a984-7579f8132347", "value": "7d39b2836a25cb4520a086065f4f3559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c4652a-c02a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706699857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699857, "uuid": "e3c4ba19-221b-4c4f-8cb4-15fc0f83315b", "comment": "Malware payload (Formbook)", "value": "72701696400811716f4f899668503436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699857, "uuid": "6aa69b6b-f4f8-4a7e-a9a0-9b8bbd70e8d6", "comment": "Malware payload (Formbook)", "value": "70f3f4df592b84eb9089b2d80ed347198dbbf5a2ea7157f8e064be3fec842c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699857, "uuid": "ae1eaecb-7c46-4428-8067-96c472c9ab41", "comment": "Malware payload (Formbook)", "value": "fa72a52dbe8e088efbb135777abb4e687bc1d992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699857, "uuid": "cdfb65b2-2134-4923-9fff-70252ccfc7a0", "comment": "Malware payload (Formbook)", "value": "ffdf07e9dad51aa3b9ded0aeb3ddeecddde3bc740052f5551318232212271f0a6430347cdb336eca2f6cb3709efde818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699857, "uuid": "a0f3830c-9779-4baa-ad2f-de7ebd7f6a74", "value": "T182F4122C271C9FB3C67D39BEE2E110C04B74862F35A2D76B82987A7904D6B405E0739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699857, "uuid": "2bffe255-26fb-478f-ba30-b713c85e8b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699857, "uuid": "1e574c73-c02b-4e7a-a647-8f49d4ecf092", "value": "12288:rNItdTnxk6+UUKoJYTgmibqL5Jh2CXG32d2uRixh5VIOPEGZDq3d1LM:xItBuhGyKj5Jr18xh5uOPEoq3d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699857, "uuid": "fa20ee16-8d2d-45fd-8ff0-31951f4f71b8", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699857, "uuid": "9a97d6bd-7415-455e-9951-9c6026e52b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699857, "uuid": "3c42045b-a165-4583-bd1c-daea8cbcaace", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e85ccb-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706660499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660499, "uuid": "71218bbd-a071-474f-a90a-4355cdd95a6b", "comment": "Malware payload (Mirai)", "value": "45ccf4f1d28a0b2d08ecdb1e12b21cf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660499, "uuid": "6990bcd9-ac61-48bb-ae1d-67101bd73c12", "comment": "Malware payload (Mirai)", "value": "72a088b93c3b0643d6bc273cf6006990f0b580978ac97a7788f56738674c8602", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660499, "uuid": "83e4ee58-ca90-43de-a233-9a4f615ae2c6", "comment": "Malware payload (Mirai)", "value": "fd517201f307815aba7e632ba322a2764eec345f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660499, "uuid": "b6699669-c17e-4ebb-98b2-d6893815798c", "comment": "Malware payload (Mirai)", "value": "1a8bba7e0b67c4a9ff2ad60b7d0359074656047ab537aca5ad5c46f5c9abb6900a37ed715183b73f74c108369c99cb49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660499, "uuid": "3c3f7201-69e5-4476-8e0c-91ced9b8e3a2", "value": "T1A863024429F5A6E33B5404B7B02B77D8F3DE695CE94A32932C241238F6834DDAF74909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660499, "uuid": "e5c378a8-7427-4f84-9a8b-fdadd8cef1d0", "value": "1536:8y4y5ZHZeUMo0gAj7894FTs4xqf2YOBxeZzND5WJf8mR0:zH5zMo0jj789qAuYOBxWN9W+mR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660499, "uuid": "962a9902-aef8-4cfb-bee5-0dd4f1ec5f95", "value": 68612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660499, "uuid": "555b3529-5e45-4aa4-948f-ba2ff9a86680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660499, "uuid": "0271def5-bdb1-401a-90db-83308a2c3009", "value": "45ccf4f1d28a0b2d08ecdb1e12b21cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93baba91-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706717568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717568, "uuid": "cbbbfebe-d68e-428d-837b-cd154d38798f", "comment": "Malware payload (Gafgyt)", "value": "55d4a61f0f5255eb4ef7524f7d0f6193", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717568, "uuid": "6757164a-298a-4900-a0c0-6326e0a817b2", "comment": "Malware payload (Gafgyt)", "value": "74eec04298147085c5bc157152fb8de43ec67977c285045b7a37e342cbb51bf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717568, "uuid": "c148df17-081b-4214-baaa-a7d35e36286f", "comment": "Malware payload (Gafgyt)", "value": "2e57eedcd66f38a71409be040061f8c983ea4168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717568, "uuid": "67c185c8-6c3d-49a1-b721-e33b21e8103d", "comment": "Malware payload (Gafgyt)", "value": "37f17f54d949a160211a923b176e971baffbaa1d3f24454ebb0ae02d09f479cfcf923a92d056cb252d9fbf1710e92da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717568, "uuid": "8574bb9a-4a97-41bf-9a80-1ec3ea336342", "value": "T10583F796F800DB73F41A973605D78F257A30B7D12B972632736635A9AA731C43823F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717568, "uuid": "af94f7c5-4d99-415f-8951-dd0dd216372a", "value": "1536:mcBWj8/JrsEQlBkqXc7GLQyiWQ1yiVeVX402RattOMAFA5dYDTi7mzLi0hmPdFEG:mVsMBkxGLQyiWQUiVqjttOMAFA5dYDOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717568, "uuid": "147b5e5a-1825-4590-ba9c-c7a47d5d64f0", "value": 88491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717568, "uuid": "194770b1-0fde-4382-86e0-8592b4e2950d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717568, "uuid": "a8469ead-71ee-4918-87d1-4be40e287ef5", "value": "55d4a61f0f5255eb4ef7524f7d0f6193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaf71aa-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718038, "uuid": "821439d3-bbe3-48d3-b8ac-8daabcaf2b0b", "comment": "Malware payload (Mirai)", "value": "e86bf3e35f0c79037bbb16c1a5c20d7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718038, "uuid": "2c4c74aa-3e90-4b52-87a6-9b6f0004eb3e", "comment": "Malware payload (Mirai)", "value": "75bf7994893c31de8ce99ddc190f76fe4694567ecf2e163fc2b3f41694a4625c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718038, "uuid": "01283c4b-16ae-4dd4-83eb-e58e78bada8f", "comment": "Malware payload (Mirai)", "value": "af5fe0e092448da477706e5e2eb7a14a961b3ba5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718038, "uuid": "c8a83980-fb8a-48c5-b383-826a2b4c14a7", "comment": "Malware payload (Mirai)", "value": "06e45c323aba21e91c9e758cd3e042210867ee94ec78fb3fd8bc2e388cd76a1e757dfbceb1c10907b381e58db0241f5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718038, "uuid": "1bd2bd71-0441-4bdd-8e75-a1c6f3daca03", "value": "T1C2534A9AB8029D3CFE4BE67E54560E09B92073C552830F27A2A7FDE3BC731945D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718038, "uuid": "d5057bdd-39d2-4bd1-acb1-0ff015675e36", "value": "768:Ox6eqqtT9i4a1R8Qxj19D/gulU/ww67ntHnIUuj01NxYbV6LM2P6d8lgGKSO4:m6ERaj7IrIxRI9j0NYZ6A2PS8DKST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718038, "uuid": "e9512d61-e08d-47d1-b06b-ba6e0f5a21a6", "value": 64780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718038, "uuid": "bb0abbff-13df-4994-a931-bc823c1ec565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718038, "uuid": "05a64a4f-65c4-405d-9635-32b6d0cedc7a", "value": "e86bf3e35f0c79037bbb16c1a5c20d7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72950640-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706699474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699474, "uuid": "398d8df2-ed6b-4a89-a032-5fc2705eb94b", "comment": "Malware payload (RedLineStealer)", "value": "69b78d974ff4b5564582ad30d72cacdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699474, "uuid": "79c2bba9-52b2-4f3c-bbb8-646429e08c69", "comment": "Malware payload (RedLineStealer)", "value": "76fb51b5a059403e86ebfd733fe24e26b80af9919db2b5c482e3bceb8bc47178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699474, "uuid": "5cc2c37e-97c7-4551-8ff9-02c92e774114", "comment": "Malware payload (RedLineStealer)", "value": "c95db580e2277e43f0496d2111d2a51a229d6805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699474, "uuid": "e710cf54-471c-4e77-be08-f9ec8b7f69d3", "comment": "Malware payload (RedLineStealer)", "value": "a7f301a5663941c05a65ea2ace7dccf2660dec9478433ca06335941141fd89c6c1a19c681e1c6eae7a78982e0edf23cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699474, "uuid": "41524928-198e-43ca-ab2f-fb757a3a5cd0", "value": "T1DC65BF2F67F1806EFE5AA2735F1DB151567CAF208033851FB26CF86479708A3167E226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699474, "uuid": "5cd9e2bf-61ae-4906-9865-9a1b68469788", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699474, "uuid": "28109ddb-194d-4a81-beca-eb6bf67c4e60", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHa0m5bVSt/Zjh04MgGi6D3BxqS3hR3K5:ch+ZkldoPK8Ya0m5R+xji4M+uxX3hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699474, "uuid": "a76d2431-91c9-4353-9fbd-933127dbf5af", "value": 1423360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699474, "uuid": "15d3ad2b-0abf-46e4-83f7-d8c6d4a45965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699474, "uuid": "63a2a215-5980-4cae-bc30-0ba5d19dc2eb", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4961d272-c07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706736341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736341, "uuid": "474e5eb3-2226-4ea0-89fc-a3d8910a1c28", "comment": "Malware payload", "value": "627445fd5bdb8ca234e47f007b5913e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736341, "uuid": "b34a1572-6265-4dfb-9fcb-488ff03bba4a", "comment": "Malware payload", "value": "77b519b40fc7f6b63d7f3810ea8bf8d661fed8df973a64d06748a45e44b9d50c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736341, "uuid": "08701f05-7828-4f98-b8fa-cd8d26e190f8", "comment": "Malware payload", "value": "7d0ad38ebd8799b54eaef7135d1e397792f2ba75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736341, "uuid": "c55d2aee-bd41-4d60-8969-6179d207a7ae", "comment": "Malware payload", "value": "4203676e196bcb07c080a43d6690605938304cfa3d85b38c9937912ad09df7f51854da1bf72ae194bb656fe57ba1edd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736341, "uuid": "3bc098f7-f152-4f72-b3e3-1685be7d6bbe", "value": "T1992633E2B7F09275C447F6B624295E4220B47FAA6976E105FBF4AC8D1B2118B3D133D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736341, "uuid": "ad4beba9-53b8-49cc-b47e-5d11f1a2afcb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736341, "uuid": "358af07b-dcc8-45c3-bd8f-4077be9a986d", "value": "98304:Y1zS7mu/hV8mrOdw3ZKvwlFhoeyfG/x1sGyOWj+7E6t0/CLTbhzW2yb+3:02hhV8z23IolFJx1s+Wjgr4UTbsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706736341, "uuid": "3fa688ed-5a1b-4cca-9875-1d5f2da68324", "value": 4737655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706736341, "uuid": "56f5c3b2-3cd3-4a92-925a-d0b9770c91d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736341, "uuid": "6f8c80c6-33f0-463c-8a76-5f8c280a3534", "value": "CRACK-IDA-Pro-V-And-_JehGUtJMeN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3594755-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706697918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697918, "uuid": "e8793f4b-b752-4882-b040-a0a5e3fdb5d9", "comment": "Malware payload (DBatLoader)", "value": "26e2e47018d68491b42b12bea74a04c4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697918, "uuid": "fd9911de-72d6-46f6-b539-4b2cd4865c9e", "comment": "Malware payload (DBatLoader)", "value": "77d38d585e01fc1d0abebd6869cf421314e1695c35c62f086bd32e3a6bc51e93", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697918, "uuid": "2112b029-a6f1-4525-99f5-5354251b236e", "comment": "Malware payload (DBatLoader)", "value": "51bf304b0d4190d09d9d5e750c5f717bd4650e18", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697918, "uuid": "8883bf73-6e93-4153-be44-13ec2668fc99", "comment": "Malware payload (DBatLoader)", "value": "8249717548abe6278c47a1fec094d4ca0bb14dd7e7969710c9b13accc5314550f138ee697894727c08913dce54575db8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697918, "uuid": "4bd78c95-9b8f-4d61-9c72-4edbd63b2fec", "value": "T1CE85CF2276E55439F222B07917A67B6CF81D6D3CA8256DD666F4290CFF33200FB08667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697918, "uuid": "82b3e15b-abc9-4132-9ac6-cca5bd1e3038", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697918, "uuid": "cbdc2a68-9521-4acb-b975-f75db1025f18", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOM:gcP7HHQU72UHk7c7mvrq0gOP7QJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697918, "uuid": "df3ef704-8ccf-4de9-b6e8-d6f9a6242134", "value": 1870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697918, "uuid": "71a9aa3b-80d6-4ae2-a03f-f317e11c081e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697918, "uuid": "eb5b74de-f649-4674-a9c3-3cc34fd70068", "value": "Swift EUR97k_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bd07c6-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706699392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699392, "uuid": "146d132d-74d5-4c15-b831-fae099be46af", "comment": "Malware payload (PureLogStealer)", "value": "5f77f80a9cfb9a3e3952408e2b588311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699392, "uuid": "e1c0dae1-7526-4020-861f-a802929ca012", "comment": "Malware payload (PureLogStealer)", "value": "79b9e8d0afc4acebf53c2e9fc34c4c6fba8ae2d2e0888a506296ab265ef192a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699392, "uuid": "037bb2d9-2413-48f6-91ae-87988d59ae37", "comment": "Malware payload (PureLogStealer)", "value": "c68274f250f1b652756a2a1f3f16b1452d6f6e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699392, "uuid": "8f85658a-0370-4665-a1ed-54b46db910db", "comment": "Malware payload (PureLogStealer)", "value": "8573a6356f48d65c7d5847ed7bcfd5bdfdb89ae69839645c3b4da3993ca3b6d9c8da47e6e37265367c829e505b63b1dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699392, "uuid": "87314f4f-ad11-4e50-9bca-6e755467547a", "value": "T1B9F412177BA54C53C36D56F8CD15A1CC43B78F6A3D83D3CB6DC8319829BA3A92626123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699392, "uuid": "b7550c78-d6cb-4c07-9fb5-de8fed15d53e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699392, "uuid": "b334050c-80a6-45fb-9641-2b8d0ca33eaa", "value": "12288:mGu9SCF1OdjB55AW0TxejqaL6LWrKeoh5ORhVZYwUW5Rl/nn4xwHlLQph60uh2V3:Bu9ZQ5nQQWL805ORh/JUW5Rl/nnqwFEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699392, "uuid": "a9a27248-e37f-48e7-917b-9078126a01c9", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699392, "uuid": "fba72ad1-2db1-4015-8159-54687daea123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699392, "uuid": "7d486d4c-c260-4370-91f8-a6d28c661327", "value": "TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9715a21a-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717574, "uuid": "6001edf8-a733-49b8-8e8a-aaca0e06deed", "comment": "Malware payload (Mirai)", "value": "97f43a07c8865b466853c3ad42b60b3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717574, "uuid": "4fe49236-e405-4943-9f06-2b46bae7caae", "comment": "Malware payload (Mirai)", "value": "7a30a4d23ab3fb601fc2e48a75411a7d95f03c44dfc4182883564a5cb9419301", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717574, "uuid": "bcdea9eb-1aa4-4dc8-b8e2-81c07dd2c60b", "comment": "Malware payload (Mirai)", "value": "2ac3298795e063ab8255a920f8cbb2eb404ecb20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717574, "uuid": "63b957f2-b774-4b9d-997a-2fe3b5b3b109", "comment": "Malware payload (Mirai)", "value": "2e6863ca660934d6b27c2a5c83990027195213aece2ac37669931a85182c9fbd2bbc2b76342b63f7eae0d948b7bd7697", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717574, "uuid": "3dd8e0bb-6b31-431b-bb76-01af131d8e54", "value": "T1C9C2E128614FDD35C2E0C63FDA2F164337935EBF2268769702505A7CA31544F72FA952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717574, "uuid": "86a75f34-e9a6-4969-8039-5b0415221b93", "value": "384:q1/mnoI9u/QgxaF6pDrOmdp2zELhmGz6blB1Ejj59QE/mS8ib6MLPNOAhymdGUo9:k/m9uL5O7z0kps/5mEuSTLIAs3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717574, "uuid": "0efd2577-5e84-4ffb-b63c-ecc650772bf1", "value": 27264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717574, "uuid": "e6c58ea8-0e31-4143-8cc2-10534710e0eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717574, "uuid": "aaec39ad-344e-48da-9e3c-43f5c2e73641", "value": "97f43a07c8865b466853c3ad42b60b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7423e222-c01a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706693034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693034, "uuid": "b4fd0e47-c5b0-4f1b-91ae-cf57de80f405", "comment": "Malware payload (AgentTesla)", "value": "7f370f3632d971350382a7bec54840a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693034, "uuid": "945b0cba-d41a-45a3-b734-50b7495bec43", "comment": "Malware payload (AgentTesla)", "value": "7a97e2e571d16bf14763fe2fdf5802a2c01e4d103b7eb98b9784a09b4d9cdc01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693034, "uuid": "89f9db2f-0701-4b8d-80b4-2699d84a2669", "comment": "Malware payload (AgentTesla)", "value": "c48eee88268b46fc1bd0860949b709a459f6f55e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693034, "uuid": "4b046efd-79c1-42a8-b1ea-7b02de533293", "comment": "Malware payload (AgentTesla)", "value": "128969b5993bbec57f3b166716539f01883fe14c9492279433926afc5231721af3c6475097955527e1be3841fd9a9c4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693034, "uuid": "8ecc943f-eada-4e66-8fff-e51460dba8ba", "value": "T11CE41251F1A8DF26F4BE0BF56620408023F23D6BD961F799CE9320EE25A5F010B51B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693034, "uuid": "0f6cecac-1bae-489b-a2ab-a226011aeb57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693034, "uuid": "0a4d8008-9561-4592-ac30-ba7f9d8df2e6", "value": "12288:qM8j8qshDi3E+WLe/Pt3dydEQj76puYIh3uAeVNxKwL0czOft7P+YE8GjGPyP:58bshG3VnnWd/jE4xuAMf44YEiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706693034, "uuid": "97584ff4-95a0-4621-b36b-04f1032e4dc0", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706693034, "uuid": "73089c7d-f7d7-45f6-a96c-1aced1a1ddbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693034, "uuid": "86dc2714-a6fa-4df5-8973-a4cd808e1999", "value": "SecuriteInfo.com.Trojan-Spy.AgentTesla.13943.2161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6a566e-c02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706701452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701452, "uuid": "d901858c-cf56-4891-b4de-e747fda31fcb", "comment": "Malware payload", "value": "f3f205c1285a4065ad1283cbf517d199", "object_relation": "md5", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701452, "uuid": "b677eb41-166e-43e9-99ce-b54166ff93bf", "comment": "Malware payload", "value": "7b8ea2570efd12099805167c50673b75a2ed38c4c5b2b86db8d0cad4068c4d67", "object_relation": "sha256", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701452, "uuid": "15d2b2f1-d1ac-49a8-8f25-c2d71e68ea46", "comment": "Malware payload", "value": "d9f078215a05978a831d5a8b1435a1681a985f04", "object_relation": "sha1", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701452, "uuid": "62def7b0-db5e-4102-9941-0204d274630f", "comment": "Malware payload", "value": "fd7f016fe3a41687ca1e1df2480ffa84787762348c43905144d863fc79c3f2608a24d4bbd383b395cdb1f9c9276822e4", "object_relation": "sha3-384", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701452, "uuid": "292f4a91-d3bd-4bae-93e9-a2d1887ecbef", "value": "T1D9E73301AAC2AD12DF033D7D8B8451B3F08B67D9B852EA2EA1DDB744D4179F09E2531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701452, "uuid": "232f4d80-9373-4416-b62a-581bd10c849a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701452, "uuid": "e230e87a-cf03-45d2-9eb2-9bff1045267f", "value": "1572864:OyXoONw5ltEslmuv8fmLJcu6m/rQ9qcGx5wYweCmvUSRtYm7:TXk5/u48YJHXrIF9Yx/D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706701452, "uuid": "7c10356a-ccb5-4a63-84b2-b3b587406c61", "value": 69682730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706701452, "uuid": "5e635070-8aa8-4424-ba86-5cd6cedd935c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701452, "uuid": "0ef97a6c-970d-485f-bde1-12125211ab76", "value": "BlendyBeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c517ec5-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706699437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699437, "uuid": "c5faea69-751f-4f8a-a860-0baba800242d", "comment": "Malware payload", "value": "33d9cec88037d7bb9d904f21a6cbc4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699437, "uuid": "ee019988-4016-4a60-99c5-4cd83cf18ccf", "comment": "Malware payload", "value": "7bb078adf25242f7a62c5a49805b7ca48eb920b5e0cb00ae44017b2c9f23f740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699437, "uuid": "eb41c154-2945-44bd-b4bc-c1da74788e6e", "comment": "Malware payload", "value": "30e73b4784c1cf41880925c372354dc7d8cf4030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699437, "uuid": "bc90db83-14dc-40a5-8137-43ad04114c11", "comment": "Malware payload", "value": "826af0e1f1aa2f03b3c869b7eca79a63891adc7423b76b41109380cbe1f1ff3b6b3b7102596e80732240c82ad8b5983b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699437, "uuid": "fa50507d-9504-4324-997e-fa76a570a789", "value": "T13755AE4FB39290AEFEDA9D32CA56E2D1467869D60123A51F06DD1879F9F00F0133E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699437, "uuid": "a7a89cf7-d1ef-464b-ac28-c62016fb00ce", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699437, "uuid": "829e2af8-fa87-4191-ba1a-e82e2a558159", "value": "24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8aZn7CXZF+19U:eTvC/MTQYxsWR7aZ76A9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699437, "uuid": "ecdb9ab2-df42-4c4d-a860-882b9d3bbf2c", "value": 1330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699437, "uuid": "97dee0cd-29f8-4b57-b151-7d619861654f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699437, "uuid": "72a91011-a696-451d-9148-3d23024396c3", "value": "PO#8981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f24fba-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706718003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718003, "uuid": "d7fc21b3-37cf-4e8f-be51-95b19351e41a", "comment": "Malware payload (Gafgyt)", "value": "7b5b5b60a84f975bb048aad4e10f3df3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718003, "uuid": "7d4b0ba4-7a90-4e51-8803-0f217592b21e", "comment": "Malware payload (Gafgyt)", "value": "7bea73b6de3cf4fa85d1034dc95c0239aeeb3149d91380257bf26868cc1ace64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718003, "uuid": "207cabe6-b6b0-40c5-95a7-cf6933509e8e", "comment": "Malware payload (Gafgyt)", "value": "8814aa43a95466c3cf9a0cb674a09031275c0933", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718003, "uuid": "fb1b448c-28e3-4fc0-b44d-60687c27f32b", "comment": "Malware payload (Gafgyt)", "value": "683f9df7f0e5f9c41213d72de8ea9b9208e487d06df74688ab0f169bcb5a7967a9b827063da0bd9d11855ad790d44069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718003, "uuid": "ac3024ce-4e8a-49c0-b48d-8fec24efcb17", "value": "T1EB73F903F451CF67D19757B526AA8D300B33AAD13B4F365A7138AAF846074CDB81AF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718003, "uuid": "6b4fc05d-2be8-4654-a8fe-95ab77eaa263", "value": "1536:/Jlj+w8MGGfrfNKaTBjJFuCErzEamvi0hBfdPEv7n:OMGGoaFuXn7mvi0hB1PEv7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718003, "uuid": "317474df-2f7e-4d0a-a1e5-751839f20761", "value": 75905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718003, "uuid": "5fa259da-ab09-4d62-ac27-803b3966777c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718003, "uuid": "11c38c25-9ecc-4399-a9aa-29e8157bbb37", "value": "7b5b5b60a84f975bb048aad4e10f3df3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de732472-bfdf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706667872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667872, "uuid": "fe3bc0f7-16c4-4dca-b518-7a81940d1902", "comment": "Malware payload (Gafgyt)", "value": "4dab0c5b392b5ea3e197b99e91d66eae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667872, "uuid": "4e12045d-6abd-4ece-9b67-7626037cdf12", "comment": "Malware payload (Gafgyt)", "value": "7bfa3d729843ae57beaef8cf040e2fd2efc5ba8f663827ca93ed153a3fed5be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667872, "uuid": "a155c00c-5033-465e-99f4-b85bfd52dc02", "comment": "Malware payload (Gafgyt)", "value": "f1a8401dd8fa762d6df8a2f1c97c670df9cff2e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667872, "uuid": "6ddf39d7-bb3d-46b0-b265-e0c25e59720f", "comment": "Malware payload (Gafgyt)", "value": "f5c13dabdfebd957c2f1e5060fa9b98b1d91071263a660e8c6962c81a4ad835ec28a20446d3fcf20de23650a73eafc83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667872, "uuid": "8560cfa1-693e-42e6-a81d-74cfc273cc9a", "value": "T18723F1B35077A634D2BFE534189E2A103EA07053A84D07736CFFD6AD1DB66F04E615A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667872, "uuid": "8b2d2246-d9dc-4f7c-972d-a50151af09fb", "value": "768:b5cvNNnDUhLAZ2c35/Y2A6gqrs5cCrGJw3frCP6FJLVGOV5Zyr48ZFac/Esax0Ei:ANDGAZ35xrskwf06zLNVTzc8nbM42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706667872, "uuid": "256a8fb3-76ee-4ddd-ab71-3460dadb0138", "value": 49372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706667872, "uuid": "29906655-0a1d-42b7-aa4e-b6bbfc4ed7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667872, "uuid": "c6460eb7-85eb-4c04-be11-a7c56344a13c", "value": "SecuriteInfo.com.Linux.Siggen.9999.6736.22177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00d562b-c030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706702583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702583, "uuid": "3470f3b4-5540-435d-ac74-2eaa00ea9f48", "comment": "Malware payload (Formbook)", "value": "a26c6c22e060e3f6e83a36b81a06f49b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702583, "uuid": "fc3e4f83-af36-46cf-840f-f594c81874cc", "comment": "Malware payload (Formbook)", "value": "7c3c5db1be920d65d9f3e1507ad053141b43d5a5cda9c77e01c0eeeeb9a0cf17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702583, "uuid": "f9e3a1c5-2413-4fb9-9f27-949878cf3a1d", "comment": "Malware payload (Formbook)", "value": "0de54937cee989604448315bcddbc0bf490bf304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702583, "uuid": "60b53461-e4ae-4c8a-bd13-4f73cc7299c5", "comment": "Malware payload (Formbook)", "value": "675db52db6a36c327d7343daefa5285f353f88a76765c94dfb69caf3f8d8b188091d37dc0748f7f071fc20ebb10e51fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702583, "uuid": "a54ffe37-2852-4391-80dd-ad2eb608f397", "value": "T1C1E412A1B3789B36E43B17F516B1854017BEA5ABA935F70CADCB20DC76A2B004F12717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702583, "uuid": "fdce392e-d399-4fed-a331-561eb46a5f5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702583, "uuid": "e5421ec8-d246-47bf-8020-50fb5b29e99e", "value": "12288:+S8j8qshDrsUCUX7635MvWb/1W8wQriTPZwFVwUbBYNqprQHet5dHXE0FQIP1Ip+:r8bshcU7X763cu/1Wwri7XUbB2qoexjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706702583, "uuid": "2fb0a6da-ed95-4634-ab8a-0cbee2b894d6", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706702583, "uuid": "52793fa5-0390-4521-8497-e874dba289cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702583, "uuid": "83b7e5d0-c535-445c-a392-b8ef7684183c", "value": "rSC_TR11670000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7541cae5-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706699478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699478, "uuid": "d0ce31df-f7be-494b-871a-4ac033c4cf64", "comment": "Malware payload (SnakeKeylogger)", "value": "8a2102b1708487bb3096c4d176ca498e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699478, "uuid": "62be61ee-2f7e-4579-9e15-6e5782d0918d", "comment": "Malware payload (SnakeKeylogger)", "value": "7c55e53536e6fe6f646bbdd2278b67176788a31a727bc24b4ed872c617d46dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699478, "uuid": "ad06a50b-7933-4833-bc4e-452044cd0dfd", "comment": "Malware payload (SnakeKeylogger)", "value": "ec4b9988410528115495f63014aac126249b8cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699478, "uuid": "0f64c496-e411-4d80-a081-8cc830320299", "comment": "Malware payload (SnakeKeylogger)", "value": "077465c272f0f3c42f427433c6fa839775503acec1dd46a86a0b0779fd5a36709fb60e736678fc8f932ab2fb47ac5f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699478, "uuid": "a9658385-f156-45ac-b266-9acdb2d00048", "value": "T1AD155ED1F1508C9AED6B09F1AD2BA53014E77E9D94A4810C5A9DBB1B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699478, "uuid": "ab03b617-2387-43de-96dc-528b514ae4b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699478, "uuid": "b48f83b8-6887-49ec-9234-1a38921220da", "value": "12288:foacIAYQ4VIBiYoaJD1+7/KeKDtc1Tjv7Ynx:g7IA1N7JZmbKDyNr7Ynx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699478, "uuid": "ad8255aa-7931-4e05-a3ac-a4d31b6afc74", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699478, "uuid": "eb2e575b-512d-4087-b708-3a649bdaa7e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699478, "uuid": "4fe0d739-7439-461c-b207-8208d891b073", "value": "BELGELER VE \u00d6DEMELER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b632537-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717554, "uuid": "e1d5eb36-7dd0-4cf8-be5e-487362a386a8", "comment": "Malware payload (Mirai)", "value": "9382e7b69772158206e559b215d60c21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717554, "uuid": "075c7752-7f87-4815-beab-b83e249b7506", "comment": "Malware payload (Mirai)", "value": "7d16c5c4658175911491815fc882534ca1702531c01ae5c8fd440969f3df84b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717554, "uuid": "23dbdf61-dca2-4fa0-a63d-3dfea6ab9e47", "comment": "Malware payload (Mirai)", "value": "9453ffcde3429dd111df7d8d0ac75dd494819615", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717554, "uuid": "911b55a0-5813-4162-b0c4-9d6f608e7b97", "comment": "Malware payload (Mirai)", "value": "c56dce8d9a37375ad8edffed2e7db70c715116e47de2f1b381ba54375376041849b9e6d824e103d3fbe0dac09879d475", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717554, "uuid": "780625a5-1a62-4214-8a76-996c1b8d5593", "value": "T19EC2D0F0F2C52965EAE9FCB1646565C03BD65F8E2BB5CD422AC0AF460242527631ADF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717554, "uuid": "e9799f0b-40cd-4b23-ad46-120d3ee0f37b", "value": "768:oLf04xYIJqVulIgVbYobaaJs4h4uVcqgw0z2L:o70C9JqVXgbzy4h4u+qgw0z2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717554, "uuid": "23cfc79e-92e5-4a24-a3a9-e4e07feb9722", "value": 27192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717554, "uuid": "75706e73-446a-415e-99ae-a00ee53aec60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717554, "uuid": "3300d2f8-3335-42eb-9b98-cf5e579e3482", "value": "9382e7b69772158206e559b215d60c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d8a30b-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686323, "uuid": "e05d8969-9f74-4035-86be-198c3e1b6bd9", "comment": "Malware payload (Gafgyt)", "value": "b965df974d393076550cc99f373b88e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686323, "uuid": "47e4d647-e3d8-45a0-89f4-16f5946408bd", "comment": "Malware payload (Gafgyt)", "value": "7d3ed38d3b5edda6a66ec169a386a9bb5c2eebb42384cb221b8ebc568a567051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686323, "uuid": "0c1bfad3-cb54-4601-861e-c66df6ddd617", "comment": "Malware payload (Gafgyt)", "value": "7856d5f2bbcd2200ef7d4f9e43d85173f048db26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686323, "uuid": "e401500d-a507-4c53-a8ec-d00b30338348", "comment": "Malware payload (Gafgyt)", "value": "8eda48c5dda85450a73d8e1522b45a035067fcb9ef653ad965b8c10d0919445ca01c88818332500ac5a3a0bc16ac2a37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686323, "uuid": "7c45c616-4dc9-47a0-9a50-16a96e703905", "value": "T1B2B30741D6548627C2D32B7BAB9F438D3336AA54A7E733095528BFF03BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686323, "uuid": "08357bc7-a688-4079-8363-630bd24f5aa3", "value": "3072:HgvUxOcKFN+B9Jy8D3XvpIhfXI4CHz9cm7QnKQXaeW:HDEKXy8rvOFXI4CZcm7QnKGaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686323, "uuid": "f76b42ca-24d3-46af-8e79-bd0e9416da69", "value": 111561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686323, "uuid": "853e9e2c-dce3-4906-9ecb-895478f0b629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686323, "uuid": "9c63f9b4-0053-4ee0-aea6-758e9451ad83", "value": "b965df974d393076550cc99f373b88e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a624298-c037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706705446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705446, "uuid": "5443588b-c956-4b82-9d72-2d4c69841b55", "comment": "Malware payload", "value": "3d628d04ef7a6297788db0f43f74fbf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705446, "uuid": "2bcd57be-5e8b-48de-bda5-7066eb6a2dbd", "comment": "Malware payload", "value": "7db58483ed021cf22b0481ccd5fb97cb543e0737146ed27c1182b88598fec4bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705446, "uuid": "37372cc3-33a5-45e1-9e3a-2f6a63b8c98d", "comment": "Malware payload", "value": "028d293fdc1aaf028266ed47c4fc81e65e8af63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705446, "uuid": "62fae90c-2ee4-4f53-9e56-ca6d8246e8dd", "comment": "Malware payload", "value": "582c760f8386ec73adb3e57778c427ad69e61d90d07cf8c40f4c53b00c035433475e2d58f98f0f9b7e2d14cff9c33208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705446, "uuid": "b6fc3117-8c36-4160-aaa8-f4dd11b40838", "value": "T183B633E485F138F1E0AB1036F484547C67E3782B4765D6AF8767D24A2F03AE65C7AB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705446, "uuid": "a0df0f08-596e-494f-b904-9a9f428ee0f9", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705446, "uuid": "008b6f3b-c6fb-4719-8b33-595446605df7", "value": "196608:9NY3avu9cBDzf4LBIP6xDfyGI21X5Sp6GemDMPwuWumNoApiFtxV10+uP:nY3ayszf490yDfDrpfaMPONoApm7aP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706705446, "uuid": "e4b0ef28-e849-4465-9866-5ddf306476f5", "value": 11172202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706705446, "uuid": "27527cd7-602b-4adc-a0e1-08e63814b3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705446, "uuid": "7d74f0de-7a93-40ff-ad47-bbf1bcd27a39", "value": "SecuriteInfo.com.Win64.Evo-gen.22775.26811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5c8336-c011-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706689402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689402, "uuid": "dded1716-f946-4ec0-8e8f-f08dbc4a1a75", "comment": "Malware payload", "value": "c77a3c5f4732d1bf531ce69c3372ac41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689402, "uuid": "60120de4-de71-47b0-8fac-f24846262b6c", "comment": "Malware payload", "value": "7df7dff3a012aaef71132a39b7615fda16e3eba7baf8b86aac0efc71efaddd53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689402, "uuid": "71f8f2da-7532-43d6-9ce9-4b8aab1fdcae", "comment": "Malware payload", "value": "4d7fb45c00c3a2eeb190f840029bcc2a0945ea94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689402, "uuid": "843a8ded-3f5a-4b52-8312-3cab37cff66d", "comment": "Malware payload", "value": "e2e28b3b35a5bd736b135947edb7558b78b43a1113347cd0ec46ba0c92410e201f06e7194bced693809a0a85b7a34e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689402, "uuid": "375449ca-57d3-441d-ab18-2f97332e8025", "value": "T165F423A28FFAB573C95D69B045D2BB044B32827670DBD36FBD3C25262F5811C7E6A480", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689402, "uuid": "b6ed8e92-a8b8-480c-aa5d-da59f6d6222a", "value": "12288:md7DQO78AM9WmCKjV0d+nz27hAx0V0aaE6mJLfvUURsEkgZD2821Wq7oNQyKofNQ:md7MUvKj6x9GNaXJrUUTZCNoNQcfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689402, "uuid": "3ea64be2-8f3a-4d5a-ae82-44a493152555", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689402, "uuid": "ab2ff203-0b65-4dc7-8e6a-25bf653dd779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689402, "uuid": "fab003ad-3e6f-4cca-bd82-cb40dfd7564d", "value": "SecuriteInfo.com.Variant.MSILHeracles.50522.24384.22028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6219f653-c06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706729081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729081, "uuid": "fe0eb8ee-086b-4a1c-af09-398850836fad", "comment": "Malware payload (RiseProStealer)", "value": "7574c11875732810a323da731bb76500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729081, "uuid": "9689b986-0806-41e7-a124-fa83e0886b0c", "comment": "Malware payload (RiseProStealer)", "value": "7eb6ffa03c8d2f62529adca15d3cd9901aa07da874c8fe1f653a6af07b70211f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729081, "uuid": "13b61fcb-3ee7-4645-a6ab-402419aa2c22", "comment": "Malware payload (RiseProStealer)", "value": "2be68d637ed8af79453eeb07eb02818b336ecae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729081, "uuid": "1bad12e6-0350-43ce-af61-a7922317e26d", "comment": "Malware payload (RiseProStealer)", "value": "75a526c0ca904ab58d3ce36e551e22c0d94240e8f0083224cc7667b3b5b0c3ddb92c8db41a743134ae77bb2af840b882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729081, "uuid": "31490e26-d769-451c-88f1-50e3006254fd", "value": "T130B533F32CF960E0E05327B3D5A255440307FF6BABA92166A7EDF0588BBC071D946D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729081, "uuid": "7ab30955-3baf-48a7-94f6-dc279d48e862", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729081, "uuid": "803b0e38-d584-4b1a-9b0b-f3f404bff267", "value": "49152:kY/PPGN1+Ofu5ZEzDXRcHRpTyd81uy/AHWZs9Dk8cw:xO+OfGwixQ812v9D/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706729081, "uuid": "88b494f7-8ff7-475f-8d9d-84726f6fe63c", "value": 2292736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706729081, "uuid": "7caeb62f-1c5a-4db4-b2b5-ffb0e99a5ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729081, "uuid": "8fa9e739-233d-466f-a411-1ccb0e178870", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9408.7245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377ac534-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706697657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697657, "uuid": "aaf58cee-a093-4bd9-9dc0-9b904c190a92", "comment": "Malware payload (AgentTesla)", "value": "fde8031b0f164873a0f3dbb0ec3f4440", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697657, "uuid": "1cc4be51-73ef-4c4a-80fd-edd5187bac46", "comment": "Malware payload (AgentTesla)", "value": "7f6c8b5906b46483358eac0fe419f28cab57e935d8cb0bb0abf4fb0d3e1714a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697657, "uuid": "e97ee2f4-911c-4009-95dc-bc3d16338178", "comment": "Malware payload (AgentTesla)", "value": "43766cdc8f6098f5f0f5b939aef317a7d446bbcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697657, "uuid": "ec015209-0f70-47e4-9a22-4b607a45a860", "comment": "Malware payload (AgentTesla)", "value": "df05d156356e1a221036624f210af84a70c0f6f976fc2b3b85cfacdd895b2c6e4daed657f8c658c17bc268dd527b94d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697657, "uuid": "4f901751-c2a0-40ad-84a9-3eea8786b2b8", "value": "T108F4F1C5FA651761DC6A2BB51176D8300BA37C3F9030EA1C2ECA3EEB3A7B7420511967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697657, "uuid": "f7e99991-2746-468e-a247-0c265ae3f8f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697657, "uuid": "dc3e1634-9b91-4097-a263-32e755680e99", "value": "12288:sVlIAYQ4+HqJ4MiIizlcDgvCGjkpB5g1EmFYr/PqeVnJFcCszUR3SQb1aiKGtf:mIALW4MiIiSgaGjkDeYrnRlMs1x55J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697657, "uuid": "1ce88761-9fd9-4de8-87b7-092f90013ab6", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697657, "uuid": "a74b553b-241f-4dd5-ae12-366bbd1e719b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697657, "uuid": "7a78389e-95e6-47ca-bfd9-e802ace254a6", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc11410-c02b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706700538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700538, "uuid": "e652f217-a39a-4e8a-b956-81fd15c21f00", "comment": "Malware payload (AgentTesla)", "value": "c110453bcf012eb83207e03d4e514e76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700538, "uuid": "3c48b62b-c204-4642-b85d-362c5ee361a3", "comment": "Malware payload (AgentTesla)", "value": "811a8a070c378c06d99c7d719dd149ba3af15124cbcdb3d1e42dc56238dc022e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700538, "uuid": "2cd51d26-9c3c-4f59-9c7f-ae713b64af94", "comment": "Malware payload (AgentTesla)", "value": "6f74c416c8e72a46133173a2215b298d0c94bf42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700538, "uuid": "2fa4414b-c465-4035-8cb5-f78b7ad06375", "comment": "Malware payload (AgentTesla)", "value": "d3279b13bd454925499521e41b6f4f703261fd6581eff4f86ebc096a8f171e0a329a61a2164cf80a61d34e4b85db101c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700538, "uuid": "c3a52a9b-6b0f-47e6-800f-2dd86d47e8c8", "value": "T1C715DF9C3210B6EFC857CE729A685C64EA6074BB531BD203A45316ADAE0DAD7CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700538, "uuid": "b80d7f7f-4a69-4a34-a7f2-5873d764037f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700538, "uuid": "11882680-3a9e-4e0e-aa42-67234b55254c", "value": "24576:wFwwFLrvr5JARcCKXhdQ7K4Mfo68bshF:oPfvr5SRcCMhL40ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706700538, "uuid": "4ad65949-3b4f-4c03-8e2c-9db265ba8e71", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706700538, "uuid": "64332b41-d399-4f5b-9741-8cfe0b338e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700538, "uuid": "99333f09-004f-4634-a9cc-7f8ab7ae3424", "value": "c110453bcf012eb83207e03d4e514e76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0e90a3-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706713049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713049, "uuid": "d057f270-10c6-4387-9603-b5d6ff99b357", "comment": "Malware payload (AgentTesla)", "value": "1fce1fb1786ef84f83b3c046ab5a82b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713049, "uuid": "ca86849c-110b-4068-9f28-b847125fd02c", "comment": "Malware payload (AgentTesla)", "value": "83a1edee674942deaf7e0e6e4639569b4afa5f6b8d7553107f2ae2bd4ce71c74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713049, "uuid": "69c98d3a-c798-4a22-bd4c-4a6ac032e34a", "comment": "Malware payload (AgentTesla)", "value": "a07b08bcb903807305ea94acbbef8e849b84ca15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713049, "uuid": "544708fa-c49c-4b92-9fbe-f1d8c59ccae5", "comment": "Malware payload (AgentTesla)", "value": "a620780585a4481c9864cd690a8c3a1d38685a181c416a54b6a233b54ba4bdff3c7d396c85ae0410f99d77d4ff6e73bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713049, "uuid": "1bc8862d-a543-4b7f-b0bd-3b14e528ea94", "value": "T18505234173488A23CAED87F60082B2C063F9E65F5019E7AE9DD250ED79D7BD0CB61693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713049, "uuid": "7766f30f-2ceb-46ce-9a18-a60b1393e815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713049, "uuid": "2b607366-acfe-43ac-9109-18d11a0aa871", "value": "24576:c8UxT3jkZhmU5rEZ253IXR4Mfoq8bsh/:c86DjkZfwaCR406bM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713049, "uuid": "08a7c953-a629-4d57-96cc-38422e67324f", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713049, "uuid": "cdfcfbb7-32fd-49a2-98a9-2ed9359d629c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713049, "uuid": "ec2b997d-ea18-4d2e-95e1-bda11562d595", "value": "Al Adrak-RFQ-FEB-2024.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded6bde9-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699226, "uuid": "ea70a401-ef73-4fa5-b2a3-bf559ac2d65e", "comment": "Malware payload (AgentTesla)", "value": "5a6fb38cf8757d5e2b10ed29108c330e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699226, "uuid": "5ba2dde1-8070-49ed-812a-1ae1e01a9080", "comment": "Malware payload (AgentTesla)", "value": "83f16f60e0b2e724a173a5a2ff4da5d0426417e8180d0b53d78a53694e829c79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699226, "uuid": "e34ae5bb-c9c6-4572-93cb-372a1d070e4a", "comment": "Malware payload (AgentTesla)", "value": "d50ed8a1832f195931060b54a98f62baddfde3cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699226, "uuid": "1943a769-3d0c-4cc1-befe-3b2fe8affe7e", "comment": "Malware payload (AgentTesla)", "value": "aab94448cd1779a8111507290b27be697da36b2a81247633028448a1850a768aad6ddea92729a1168dc40f23cfe4405f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699226, "uuid": "4410dac3-8ab6-4c37-9ab9-7d2b67c7989b", "value": "T106F4126433A51817DA5D06B8CC7182CC5773ED36BE56E3AB8ED8319C89F631617A2B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699226, "uuid": "f17943e5-0393-4855-901a-0741d8036b31", "value": "12288:ih/xUDrMMc0YzK7LU/9mCwWh7AdFhF3OQ6E0Zmv3b7aMa3sSUi7CGOatn:w/xUFc09U19wWFMhROQ6avXaMa3sHi7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699226, "uuid": "be1f2b87-28ad-4b52-ba5a-38e783bd9915", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699226, "uuid": "a379686b-87b6-4946-ab09-243e4a3339e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699226, "uuid": "afd72183-eafc-4a33-ad04-fa4ddbc752f3", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a449ff59-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706715878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715878, "uuid": "9e0d7aa5-2107-4278-bcd2-712582499ea4", "comment": "Malware payload (AgentTesla)", "value": "030c3fc4a3595aced7cc63d92a3ad339", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715878, "uuid": "482b1943-7ed3-49f1-99f2-be95e87a136d", "comment": "Malware payload (AgentTesla)", "value": "8433e43c2cdd2eda991cf4b569591dfd1bfc9664cdd68162e264651f6f12c368", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715878, "uuid": "f16a5c01-69b1-48f2-99a6-273e5e98e00f", "comment": "Malware payload (AgentTesla)", "value": "309110a3142dc6872a34a9cf9c1b7fd7897f956b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715878, "uuid": "60e85171-dd1c-4a02-b6a5-6d962fcb3355", "comment": "Malware payload (AgentTesla)", "value": "fd649804b9f50ade6aab4db45dbbec63425dc8661d4840d055c7cb4c478742d93af9f385309bc1db186bcac4effc2042", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715878, "uuid": "a4139fc2-1dda-4f9c-9ffd-653fc0c5d623", "value": "T1AE917899AC8AC3191A77577C831A9418ED56403BC512D21A789DC2CCBF31538C9B6EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715878, "uuid": "feee414f-cd98-47d6-bc5e-83208b604e07", "value": "48:VdqWGjPe3kWPFzy6xsVzdWIWPvOAh1YEUbUtrD9G0637JjG3gUzIINgQiLMi3h+d:VQ6xsOheEUb8W37Jm+gi3h+yO8YoSnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715878, "uuid": "c9294654-8555-48ae-8bb6-c5849b5c0dbc", "value": 4234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715878, "uuid": "615dad59-8fff-4388-821c-5b98cd00cd3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715878, "uuid": "afd26dd7-8b68-4d4e-b797-542d01fa879c", "value": "great North Run 2024.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0eef93b-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706718101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718101, "uuid": "d7db60d9-1e09-458c-9d63-274538a4ae0f", "comment": "Malware payload (Gafgyt)", "value": "a063f226bccfffe0da0b1e39499cb82d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718101, "uuid": "5812b355-6622-4b3c-83f8-9663679bd9ab", "comment": "Malware payload (Gafgyt)", "value": "847862447201000b6356e34c5007519fe84b6294d29c06360bf0b5e7b40b3489", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718101, "uuid": "0f07f0d1-8219-4c48-8bf6-10621f68c247", "comment": "Malware payload (Gafgyt)", "value": "0181ae6f7c39d554b29eb41e36a6091bc5ff03a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718101, "uuid": "7f67d237-b751-4a71-b5ea-73e4dc5d56d8", "comment": "Malware payload (Gafgyt)", "value": "56d8fff0af192ad232b2e2355e5e79e8967f087530620d3ed875b8f4d16de0ded8a98b08d5e987ecd5320d8f5b1540e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718101, "uuid": "9cbca3f4-b8f4-420a-9f0c-58696f607627", "value": "T12EA3952ABA11EBFBE169833007F78E3156E422D237926345F26CE75C5E2128D1C5FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718101, "uuid": "acfd5f1d-7a4f-49b2-b479-883b684bdff0", "value": "1536:HbD+ljOyTqle3gauafaBJafDfBbmQBWhqpHV//gEWePkxzCmWiRqcfA4WcL2:OEbQ+qHHgEtkxzCmWiRqcf5WcL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718101, "uuid": "10f042cf-5a24-4ea0-a10d-791d92afdb30", "value": 104087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718101, "uuid": "d3aa78fa-5ec8-4e49-905b-5fda8a531792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718101, "uuid": "a155b0dc-39c8-4d33-ac4c-b54fdf537f7a", "value": "a063f226bccfffe0da0b1e39499cb82d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b6cdd1-c037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706705435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705435, "uuid": "ab41aeed-9567-4182-b67f-d4b4cf9f5371", "comment": "Malware payload", "value": "21f57e534a0adc7765d6eeb22ec5bd74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705435, "uuid": "cbc25532-15db-4a0a-97f1-b40b7b9b55f6", "comment": "Malware payload", "value": "8487b7cbcc6331ce5da7a3f19229813c10801285ed30a8d82e81bf19b1ec385a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705435, "uuid": "1df9a2dd-1c13-4822-8915-cb1937e1c961", "comment": "Malware payload", "value": "43baaefa89366a2ab42e1ad30fdffcebeb81d00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705435, "uuid": "5baa6f35-e5e1-42e2-b710-01c92ac31bda", "comment": "Malware payload", "value": "23b07ecaed4df8d9c95593a2fd57a0448afec9f3ef57eab00c26061746c6d055f5a60a14d3cff43704ae700878da0bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705435, "uuid": "55ac4e03-ad5a-4c96-96fb-1695ba78ded1", "value": "T1800733E4C1B239F1D4A60036F864563CA7F334634B61C65F97AB924A1E43DE26C7AF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705435, "uuid": "30f11a99-4048-4645-9086-77e5843cfa33", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705435, "uuid": "acb3bf9d-4467-44d7-9ea7-65b15fd66e53", "value": "393216:+Y2ayszf490yDfD608r6a0S6MpfaMPANgA5esmAl5VNR:+Y2dszfm0ybG08r6I6uf9PAPNmArR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706705435, "uuid": "a7e9d772-5b9e-4e84-8e0c-f848ebcf722c", "value": 17331701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706705435, "uuid": "f3738b7e-fe40-49e2-b24b-ef75115374a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705435, "uuid": "bbc1f033-5a9b-46ed-82df-c00dbd38c17a", "value": "SecuriteInfo.com.Win64.Evo-gen.4079.4864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24014cf2-c04e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706715233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715233, "uuid": "2209661c-a4e3-40fd-bbe0-44b330f36686", "comment": "Malware payload", "value": "d766a7c05646f6e2ad5384c66ac4f2ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715233, "uuid": "5e3842eb-aeed-4ed7-9081-f81b13d1b8c9", "comment": "Malware payload", "value": "863ba2571d0bef9242d1d8027d80117a192076a7b8158f3463b74f58bc7e68d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715233, "uuid": "ac19d31e-6c49-4c04-88ec-2ba5885cc9ac", "comment": "Malware payload", "value": "3206b4f7fea4458ed2d0d3a28a8b1ff9ba108bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715233, "uuid": "f56e09d5-baa5-4b35-81b7-767eeaa0dd3f", "comment": "Malware payload", "value": "2265429b6ea5543e2162453c57aec188615dded6642811cad4d6947e15a96b37cb9c43d1a34a961a82f7db1a31188b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715233, "uuid": "d70f9b81-8548-42e9-bdc4-73149a7f9fea", "value": "T1A6E66DA9337441CCC5BBD1B88A5BB84BE6F5B00A037499EB47B109D11FBB7E00A7B651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715233, "uuid": "dbe9ea06-7af3-4f87-b44b-f042728a1965", "value": "9aa2106b22a565066bb38bf14aa0ad8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715233, "uuid": "b0a7b0b1-4335-421b-b9f3-c0bedac2c565", "value": "98304:sNnLl/bda1vrlQ/MdduEtv9LM13izmV/3LwRFFf9zJv/UQiTJ:Il/5clxhJi13i8wRFFf9zJnyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715233, "uuid": "58ab0648-0a18-422c-b3e1-e841a983dca6", "value": 14320128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715233, "uuid": "1e0546da-1d1a-42ee-93b3-7ee194751f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715233, "uuid": "d677a520-71ff-440f-a028-3c95372220c5", "value": "SecuriteInfo.com.Variant.Tedy.525159.11628.28706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107c01f5-c017-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LgoogLoader)", "timestamp": 1706691578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691578, "uuid": "c40941a9-16fa-4fa4-b588-e82bc47c8fa6", "comment": "Malware payload (LgoogLoader)", "value": "72291a2593e330da68e21589b3977f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691578, "uuid": "90350a62-95ca-42b5-a24f-5f240215a2d9", "comment": "Malware payload (LgoogLoader)", "value": "86674590d311280ebafc9d0ea35a17c5f7a7d6edc335baaaee38309c57c73a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691578, "uuid": "e0446ecc-11be-4170-8f2c-881ec3c39e7a", "comment": "Malware payload (LgoogLoader)", "value": "3794f9d0141d1e11cfd18c67d4cff133a307e690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691578, "uuid": "17d9f3e0-ccdd-4128-9b1f-72d30163d573", "comment": "Malware payload (LgoogLoader)", "value": "4197e4dcf40c2f2bd4123459766d87123f35ad4bdc7dbcce9d766b4a0a896cd8867c21610819fe4f1b8e5afda6d5046c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691578, "uuid": "221e2817-9c2d-413f-99bf-991d236b9dfe", "value": "T11FD402289A349F12F93C0FF211B4B911E3F212976616D7B95CD960C62BB3F650B04EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691578, "uuid": "0effa3b2-1b0f-4ee8-a7ec-621953e6b768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691578, "uuid": "b85d8c0d-f269-4f58-8e32-419c429b9dcb", "value": "12288:vB+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8lE:vsa6u/ZKCcmdqw6S2dRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706691578, "uuid": "ca774600-2939-4350-acf4-a43fed913f00", "value": 602472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706691578, "uuid": "03a90ad8-f6e3-424b-9d98-d044014e53dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691578, "uuid": "fd409283-411c-4322-b2db-743ce09be2a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94590739-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1706660446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660446, "uuid": "68225a9d-fb0e-4e2d-a7c5-fc9d5a09ed4c", "comment": "Malware payload (Smoke Loader)", "value": "2bcb27364bcc7a8be2c8d3c73b25f2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660446, "uuid": "f28959b1-4a0a-45bd-a891-ea477211aff7", "comment": "Malware payload (Smoke Loader)", "value": "87023c7633cdf21fe79acaac656f2548af5de2b0ad91f8ae55e54e8490ea1590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660446, "uuid": "a14c834f-63b3-4d30-b0f7-737ab09891bc", "comment": "Malware payload (Smoke Loader)", "value": "3c4e4f19b3f5376ff30ddf8af9f9522fb0e6cabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660446, "uuid": "29b27676-d16b-4805-ad8a-a357927a802d", "comment": "Malware payload (Smoke Loader)", "value": "e84830921c321fada6450143cf7fc0ad27b190b32ec3562afb7d01822dbabce4c853d1282877e40b014a3b4f2116a228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660446, "uuid": "693e5c8a-747b-490b-82b1-5efcb1a376b5", "value": "T15303D1AB0E26AEFDCB79D77600F40596A72086771D24A21C75112C3FD5CA3A861BF30D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660446, "uuid": "cb9805a1-eaa2-4743-90bd-9ffb613fd1a3", "value": "768:DZEl1vcMCIRTyCJ4tJmXIXQGOoWBu8Jx1eS7G2kj/elwEd:DmllisEQGOoWBuMx1vt4G2Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660446, "uuid": "a4dd6d9e-d8cc-44ed-bdbb-840d935ce3ec", "value": 41369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660446, "uuid": "8055ba64-9b69-44c5-9d5e-f4c254b507ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660446, "uuid": "1bf0d756-8e85-4269-ad9f-8eef3778f8cc", "value": "6a684f04b6dc6ed0ca2bc55dec214e78c664aa18ee412fd290e6d543866115a9_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c7d3ad-c07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706736394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736394, "uuid": "6dfe8be7-33da-4b19-b5dd-fc09c2aad9a2", "comment": "Malware payload", "value": "a48b41e38228e04f44c1fbcdfc64cca5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736394, "uuid": "4c8698f1-695e-428b-b9e0-d099b80ee762", "comment": "Malware payload", "value": "87f6a8074c20aaa6c2575b92d6f79fb5a2a62676e7d2ebb132f7627e540ad597", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736394, "uuid": "168aa5ba-fc2b-4c7f-bdd4-407c3d95a492", "comment": "Malware payload", "value": "6be49423b6e512ee9699e523287f49777bb9d7bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736394, "uuid": "d8320d3b-3f7e-4cf7-8479-233ceaba8f8e", "comment": "Malware payload", "value": "73715337b381f7a2a0f3e3178462ade750dfc3b8bf6da891b9079de5c0b680cdc840772fe608bb4e34eb326f8060f880", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736394, "uuid": "eac447da-4670-434f-82f0-e6a0ba91d31f", "value": "T1EBC37C2079D1D072E4EF663A5861E67A0B7DBC20CFE09EEB634903E98F751D05E34926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736394, "uuid": "9a477ac2-367c-41a0-aa3f-717512a5c10f", "value": "2985a06760bb60fe03e308843b57ad61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736394, "uuid": "eb3836db-9f51-460e-b173-836a4d4bafad", "value": "3072:PlsbxOX0J4wsLyy8qM3h8OH28mMGmtoL2DVW:PlsbxOXvwPR3dwxL2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706736394, "uuid": "5223d2d9-fecb-443a-b6d1-d54b8bd4b483", "value": 120448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706736394, "uuid": "dc3f554c-76b5-4582-ba2c-e3732e8e514d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736394, "uuid": "b218270c-b950-4f42-b402-00b69615c156", "value": "SecuriteInfo.com.Win32.MalwareX-gen.28375.29643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cbc778-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706713406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713406, "uuid": "adb82c66-9b1d-4b9e-82ad-9d86f4e53249", "comment": "Malware payload (Formbook)", "value": "63f12a388bd7414bf823e4b7f7405706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713406, "uuid": "fd037ac1-9daa-4413-b898-8a14757d19e3", "comment": "Malware payload (Formbook)", "value": "8a9aa6cfae091920771faea5c51353f7c5f1e9e62ea2026186871861233c7756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713406, "uuid": "926c1267-b667-4c68-b71e-ca654970569b", "comment": "Malware payload (Formbook)", "value": "7bd5554cea6677175db45f7b7d1df82ba6641f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713406, "uuid": "7fa5d0b6-788d-4094-a865-c2d6b1ab0a22", "comment": "Malware payload (Formbook)", "value": "da84e8a0ddf5e309c048981cdfe4513376762cb585deaf77d17134ba2a375dbc51a4609c97e295069776b3f901f3825b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713406, "uuid": "5dfa6f76-020a-4584-933e-99603b91092b", "value": "T16284231D76D26CB3C4C78E3217BB4B3AF677E4490126B98F87E94FB71E1488A5309246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713406, "uuid": "6eeab0cb-0210-43ff-8d25-07bf71db1898", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713406, "uuid": "78990829-a880-40d9-a802-8e33912a7bc5", "value": "6144:P8LxBBcjU/VfIr0sMaG/LG8CMojoTkZQjzuaDYxuXRDNNsjQ4CEE1nYoZ:M6QIr7M3SGpQZQOa0EjNs3CsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713406, "uuid": "088b1153-4a91-4643-a4c5-87c50612e1a4", "value": 395944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713406, "uuid": "ba9958da-8a61-4b90-a3eb-3cfafea75640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713406, "uuid": "9868b352-14ca-42dd-a06d-59ce2b3563df", "value": "Quotation w residence.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f79a1d-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706698681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698681, "uuid": "58e3a53d-ad58-4bf7-843c-ade25e519234", "comment": "Malware payload", "value": "a568b289e0415f59312d4aada34408d3", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698681, "uuid": "84f2c463-42a7-4830-a779-16650f265409", "comment": "Malware payload", "value": "8bb899b3519193159c77b21abf3beaa558c662f6a45ff079479b033259cbc4d0", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698681, "uuid": "f824b5ea-98df-4060-8295-63a79c78d682", "comment": "Malware payload", "value": "e42ecd5b6a108f5f80d41b5c3b72735f65cb7edd", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698681, "uuid": "5ada0da4-ec39-4e54-a4ea-fa71b0dbb5d3", "comment": "Malware payload", "value": "859df074680364d614716eaabc14fc8dbc05b223e28121f65c769bbe61028e89399463c5631a6d80cf62577bf7383011", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698681, "uuid": "5792ff61-faa2-460a-9a91-fa328a132886", "value": "T1CC6384027245C63BE76A1D330ECBEBFA27B67C85DE6452C77144BB2E7EB66108522740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698681, "uuid": "52da3f89-56c9-4455-a45b-90b4aa6e6c92", "value": "768:hstjD1b+scl1ENa6A80+b/tpvOGbXbJyrPK3ANY:Q1bpclK3/bvxbXw7MAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698681, "uuid": "2591e928-5c96-404f-9c08-7e3fbc233b1a", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698681, "uuid": "5354a282-0061-43ab-94c8-49390a09679a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698681, "uuid": "03ecfe4b-c055-4ab9-ba54-ac7338408d6c", "value": "FarsiTools .xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b989d537-c044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706711189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711189, "uuid": "8b11da74-ce70-4c4f-952a-ec8d81b18aa9", "comment": "Malware payload (Formbook)", "value": "fde010382d125461dcacc0bf520c01c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711189, "uuid": "e5cefc73-a7a8-4239-a731-c5038ab659d0", "comment": "Malware payload (Formbook)", "value": "8cee802d5d7b59d30d7df040ba114ffae58b38ef2aa4506b96054d810e603f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711189, "uuid": "7bf0cbf4-0c12-41cb-827a-6baf7e24e9ee", "comment": "Malware payload (Formbook)", "value": "ccf028abe1a5fb2f49cb35054115bda53f5206fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711189, "uuid": "c07231d4-d514-4f86-ba98-a7bee7d09173", "comment": "Malware payload (Formbook)", "value": "18665494940756cced28571339752949b3f43962a5c1726f904540627fba7e29c8be4fb5f196a7ad49e91562ce03d0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711189, "uuid": "9cba0316-6ef2-48ca-9239-0f5f56fcb7e3", "value": "T1C505231176AC8726D6FC9FF21891510087F6B92BB062D34A8CC235EA3AB6F44579371F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711189, "uuid": "e38a599a-f5a9-418d-9d59-992e52c64e52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711189, "uuid": "eb7fb09c-f2be-49c7-8995-344581fa36ac", "value": "24576:LdGUQt5zxEz3N0zRgU9vATRegVpYz4Mfo68bshN:Zjum3N0zRgU9vAcm440abi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711189, "uuid": "5aa8f71f-a747-4901-ab1a-398ea30f0d72", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711189, "uuid": "d007eb89-b72f-44ed-a1be-1f3ef8e42bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711189, "uuid": "d49bf94a-47fa-4eeb-88fc-7b13a1a88e90", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29414.12459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad372e20-c030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706702579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702579, "uuid": "4aade4fb-9815-4556-aa3f-dc835f263baf", "comment": "Malware payload (AgentTesla)", "value": "0db08d5a0ac5905432acbf36facc1669", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702579, "uuid": "7c671c9f-c4a8-4ae8-822b-665c523946a4", "comment": "Malware payload (AgentTesla)", "value": "8d02b67220fe803ed743dfd587acea589dae4b412fad339c97efb0866adf8494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702579, "uuid": "080fb158-f092-47d6-9a45-e3075c4b9322", "comment": "Malware payload (AgentTesla)", "value": "ed3b2762e13230fe579872bcc7bff911708387c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702579, "uuid": "e8546fb7-8d1f-4899-bde1-59a830a301c1", "comment": "Malware payload (AgentTesla)", "value": "75d3aa21453bcd94f138a7520e33a7fe77cb95b9d23341c77cd399a00f5889275c145561dc527eefc9e25e5226e0474e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702579, "uuid": "1a3327e9-2257-414c-82ae-a8228a0ce648", "value": "T1E2E423DAAB78EB6AC0FD4BB33054428566F5910A420BC605FFC5A4EF3CA73C24257E56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702579, "uuid": "fb918058-c3a2-4857-a4a7-6d1fb66f3b6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702579, "uuid": "db68ff12-b911-4710-b252-309365341a34", "value": "12288:Olhlfu8liC5utlRr8j8qshDFdYoqkbsMxZulFpBpEkcvCJDW0amkbhxMK4SelIX4:llRr8bsh0ZdPzBcMamkbhxk5lIXkBnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706702579, "uuid": "4ea00113-686e-4926-8ffc-b083ab7085d9", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706702579, "uuid": "b92367cb-50a1-437b-9833-74b18e30c5cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702579, "uuid": "f9f40720-7a79-4a3d-a20e-df69ef57ad08", "value": "rFmsOrder6210FFFP2VNRDNo2561PB34870..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3243eca9-c04e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706715257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715257, "uuid": "d0add0f6-f0d5-405a-93e0-af2c4a98cfdc", "comment": "Malware payload (LummaStealer)", "value": "230c0c4d6093a74763327da465f16231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715257, "uuid": "05d0c4fb-66e7-4659-8451-45b2755236b3", "comment": "Malware payload (LummaStealer)", "value": "8e93ca07a6f30ce79c5ca912bce1d993d5ed249aeae596d5c846f4a3c1f76935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715257, "uuid": "90133290-94dc-4d02-991c-c9109ee0b45d", "comment": "Malware payload (LummaStealer)", "value": "d947898f9e89115c77ba2bf3ea1489922d7e154e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715257, "uuid": "06e4421a-2eed-43a1-9cac-be1a61511df3", "comment": "Malware payload (LummaStealer)", "value": "84fcb8efc9588b67df46e0ce99ec153384ec9c1d123c355ddbe4a8e8e2cc8fe2e4bb95f37244fdf3808bf68d1123115d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715257, "uuid": "c1f35a7d-fa18-450c-95b9-c1f69b62c46a", "value": "T161463314FFC174D9E86EA03A59CFBC1D32FF2E790569192E802937D7AD27A441A39813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715257, "uuid": "a6c8a00f-9365-4be5-aadc-6ac8671b2f4d", "value": "8036840c09d03a87577c6f33960a9d3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715257, "uuid": "4a8b18af-2537-4fab-8103-00e2b8019b76", "value": "98304:yaNhKetDJISqhQiQCjNC9bW5Bf6qkZiwUcDNGQslUsmtIFlUsOd/hFPHpFWfYRs:yctD6SqhFtjNC9bW5pb0elUulUj1HpFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715257, "uuid": "b30c6101-fa6f-4792-9049-12753c510208", "value": 5838848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715257, "uuid": "43e8c088-9201-4ba3-a940-98a985ae8ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715257, "uuid": "57f7ca17-c209-42a6-8ccc-b4c662199333", "value": "230c0c4d6093a74763327da465f16231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58110d70-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699429, "uuid": "1e244a9a-9473-4794-8f95-12503d3739bb", "comment": "Malware payload (AgentTesla)", "value": "9a822f8843681b47815b67e87740301a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699429, "uuid": "bd77874b-85d4-448c-ba05-6b3a0b33d311", "comment": "Malware payload (AgentTesla)", "value": "8f5a7bde1dd7ca484c1b41d1096e562e5db6214d4633861c849b350753ccce81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699429, "uuid": "25eafaaa-04ce-4cac-b388-ae6cd5c53128", "comment": "Malware payload (AgentTesla)", "value": "1885bf95837502f38f82eadfdbd5b4e921cbbad9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699429, "uuid": "956d8748-3629-4fc5-bd32-82acb930b3e6", "comment": "Malware payload (AgentTesla)", "value": "a28751b427c697a9092bfb0dfcfffbd6916777b62e5fce10170d21b9b625bee863ca5d852655793f16c3a21465be9f49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699429, "uuid": "b28cba66-f012-496c-bacd-edfe4bb59262", "value": "T1F0E41287327E9B26DAFC1BF945B051504FF6A9276A52F3684E4514DF3A3BF010A60B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699429, "uuid": "61df938e-319e-4a11-95f7-efcb0b926cd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699429, "uuid": "41200708-a872-4e31-90c2-0deebbf9f5ae", "value": "12288:DvBS3IAYQ4HvbBjfuvs6D2akMGfKWv/FMEs7YDeOj8Kwpgh9J9anfSTDS:DB0IA0vbAvs6D2as7GdYiqwpgh/9HDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699429, "uuid": "438b484d-d8d9-4cea-8483-77c4b8c4e22b", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699429, "uuid": "35d35646-8493-4b18-a0e2-7917a2f46245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699429, "uuid": "2bddd699-8f3d-4c14-a67b-d780937c5a31", "value": "Fiyat teklifi Istegi 23070 PER 120 Adet \u2026scanneed 00101.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edd7217-bfe1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706668436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668436, "uuid": "7bb9d022-e067-48ff-9594-f549069e93e0", "comment": "Malware payload", "value": "35f2d8f41310c52cada4d183fb60f555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668436, "uuid": "a59444d8-020e-4c0f-8b5b-f5f2682508da", "comment": "Malware payload", "value": "9017ead5d0d4c564bd208d8b3ec2476de3b7a0c220a6bad8a03cd31f627fe654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668436, "uuid": "ce2bbbd3-6897-4a47-b061-fb962337ba36", "comment": "Malware payload", "value": "84e2fc20cab5a1f36fd5926e4a0c31571332e5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706668436, "uuid": "d3d2f404-4b2e-4b14-b16f-ae181d937fe4", "comment": "Malware payload", "value": "cb9c94e4a6f58ecf5d43737ca2aa975f6300370cd5536e53302123a0ddab35819c5ce8b2a4968bf33c7bdcc272b981af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668436, "uuid": "d1ee0855-00a7-4154-8402-b9faf6af84da", "value": "T14AE5AF1AA3B900F8D0A7D178C95A5607E7B27845133297DF16E0866A5F33AF25E7F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668436, "uuid": "838ad651-a998-4ec9-8b78-f843aff7c280", "value": "f632bd17f4d7db28a6358ac22ac2cb39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668436, "uuid": "0df95e63-02b3-490a-bdb0-f9ef718f8ea0", "value": "24576:O0XQKSw3J8by7DbohdQ0hG13sU1c/TnZlgk0vUuA3ECADgB0gQWxaDY9oXWgC0gZ:OiQKBXocxcrgkOzF/8sA0sJX+lUN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706668436, "uuid": "8aba66bc-8d60-4c23-ab24-23ba092bb9f5", "value": 3064832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706668436, "uuid": "be0d5005-9408-45d7-9057-68c36ad7c713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706668436, "uuid": "e7c9d1e1-944f-4ffd-8887-fa0963577340", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c595aab0-bfd8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706664824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664824, "uuid": "9e26eb67-9b40-4b0c-8a01-545616c9f179", "comment": "Malware payload", "value": "f92cabc07a676ab522160b08b604683a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664824, "uuid": "fd7b5054-3b22-40ac-aadd-490f629ce8c7", "comment": "Malware payload", "value": "90bd78de6f692255a95c7cf07d7547dd783c3580cda0d95a515f25b564f8fe43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664824, "uuid": "acbf9e70-4ec0-4c80-8173-de324a224289", "comment": "Malware payload", "value": "ba97f2bdbe7103dd70a34c9720aef6d540d1d95a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664824, "uuid": "ecc1d274-2854-464b-8b27-0c4a403fda36", "comment": "Malware payload", "value": "ecec5914f0c252d7c3b45a31e72071195520fa802e427b6ea3ea0e3d7899b9aa8905fd6739da33324af849279558813d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664824, "uuid": "407f6b06-f46a-4927-877f-c7a7b1bdb3b0", "value": "T176D58D5662A800F8D0ABD178C95A5607E7B27855133197DF26E0CA6A2F33EF11F7E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664824, "uuid": "cdf9ab4c-e4c7-45b5-b0b1-c778fcac9053", "value": "1e6e931cdb0dfdde5dbc6639c3cbc8b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664824, "uuid": "7af1d1f3-b763-410f-a346-7f205c47ffa6", "value": "24576:ETk1nzHm9FFsMuQxS4ZEe2eqvYKQ3RSESYtp4jOULrbDX6gCVVg+UjDNdqYHQdqj:EI1GFrO9SShjOyaVQlwD/kJ8VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706664824, "uuid": "b3fe8390-652f-46fe-8f30-1186a8714dbd", "value": 2865664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706664824, "uuid": "3294747f-5734-4d74-a044-32c36e3de3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664824, "uuid": "80b1a063-8246-4773-a301-e6a92ade7260", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae7b23d-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698790, "uuid": "acb25269-97c1-441b-8f88-8769e6763223", "comment": "Malware payload (AgentTesla)", "value": "3a3949d66e0be12d481c8cea66302a68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698790, "uuid": "15f05e15-bdb0-48dc-9121-a666049a45ec", "comment": "Malware payload (AgentTesla)", "value": "90e562c3f7ee06b029a27c3e48a9a17e22ba7f075121eff25b36741978b68825", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698790, "uuid": "badc1227-ae34-4bcc-b614-425e80027659", "comment": "Malware payload (AgentTesla)", "value": "a83a75789a2256e15f173cb5e5a8dbb274ccfd54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698790, "uuid": "a76c9c07-7a90-4d52-a72b-4be1ee126534", "comment": "Malware payload (AgentTesla)", "value": "98676a6f3b735c153b365ce525d4c99eea8ee87f14a3a9d1a5c95167f8998cf84e89e2282590fa834da5d4240cc97a2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698790, "uuid": "ded5873d-f8ca-40e1-b006-aa5f4bc8e423", "value": "T1DC05BD84D9545AA0ED2C9BB16636CD3193333EAEA834D52C2CDE3DA73BFB7921111853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698790, "uuid": "010f0528-b45c-4a8b-8208-8ef1d3826b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698790, "uuid": "dc52fc4f-f95e-4f0d-b72f-23a8690369e3", "value": "12288:36lzBP+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8lfP7r9r/+pppppppp1:38Ea6u/ZKCcmdqw6S2dRf1qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698790, "uuid": "f046d297-0551-42c3-82c2-7a5e82bc258c", "value": 817960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698790, "uuid": "75c83cac-7ac9-49fc-957f-ad6142dfb596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698790, "uuid": "908f0079-5583-43ad-9afe-43855a04e5ba", "value": "Price List item.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31211d40-c02b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706700223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700223, "uuid": "e0cda997-3620-4130-ab43-9080e0dc91ea", "comment": "Malware payload (Formbook)", "value": "ad5afe8c785163ad22dddefdf5df7783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700223, "uuid": "53ef80d3-6295-4a38-8c3f-814673771db3", "comment": "Malware payload (Formbook)", "value": "91dfac4289f8b8ddc313bbfb2320ddd65edfa2387a0e1de388cb9541cd1b0853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700223, "uuid": "5f97028f-ea2e-4724-8787-488de76309e5", "comment": "Malware payload (Formbook)", "value": "432e247dd48cab6e5b2d8aa7383bfc153a5cd3cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700223, "uuid": "21419667-7e5b-41e9-a5ba-72401b330e4b", "comment": "Malware payload (Formbook)", "value": "cd10e32870a173237940ab6821a6006d7858ad221a5ab90275fe4b139586ff3f49150d224ef1c0a084557ec97d8d67b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700223, "uuid": "6b08a0ff-2007-47ea-9c77-37f970358d83", "value": "T16DD412D6A3B98F25C6BD4FF550A1E1090BF274AB4923F3680DC764EB1927B504A80B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700223, "uuid": "d7362be9-d4f5-4865-8ab6-c738bb578ff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700223, "uuid": "bc6eb848-a2b2-42e0-8b91-8030d64f8c36", "value": "12288:9KB4GIAYQ4ZBpyVdEvHuwm+MaVhAw6J4EoP4QQ0tI59O+ZL+g9ZEDTEBcAeP/uk:kB7IAkcEzm+Fp6RQQ0qM+ZiOSecAeHuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706700223, "uuid": "57726e57-10a3-44e6-9a29-9eeb77a6ac2d", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706700223, "uuid": "59d17095-3463-429a-92c8-c19b8c2037c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700223, "uuid": "9e606b2c-5e06-41a4-a5f5-834fce9effd3", "value": "Repeat Order 013024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df405d8c-bfdf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706667873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667873, "uuid": "28a98c35-c643-4e09-882d-c9f10a8efbf5", "comment": "Malware payload (RemcosRAT)", "value": "0abcfa0bbe8988b29d3f3a59bca5009d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667873, "uuid": "e03d272b-201b-42a3-b02d-0df22055fb03", "comment": "Malware payload (RemcosRAT)", "value": "939d0b5b7561b4296df6b0afdf4ebadd2b8078f06653eb25d382e426d4530077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667873, "uuid": "862d2921-fc3d-422a-a81e-45d7f51322a3", "comment": "Malware payload (RemcosRAT)", "value": "d76d809b311ec846df5054cfeeeca8165423f051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667873, "uuid": "2f788db9-5f7b-408d-93b4-afe392e723ac", "comment": "Malware payload (RemcosRAT)", "value": "c5dc2fde32d9b6c18ffbc6c730a7d2f7550741ea53919b711d068e0e3b34cb29197c8cffc90fa0e049d1cd4e5b86b812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667873, "uuid": "a63284d4-3d24-432a-87ed-84d88e5c953e", "value": "T12065BE0273919035FEA7DA735B55F201C6BD7D2421238F2F2E983D7AA9F21B1172D262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667873, "uuid": "5b514913-1f2b-46a4-a852-8ab7df100264", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667873, "uuid": "4f75b685-dd01-47a0-9f6c-a736297198ba", "value": "24576:PAHnh+eWsN3skA4RV1Hom2KXMmHaj4H4444CkUdTMJC6mTcMShlsWJ+3wO2Vxgg5:yh+ZkldoPK8Yaj4H4444CkCoC3q5M52T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706667873, "uuid": "fa275d43-818f-4188-99f3-ef0f04f4c726", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706667873, "uuid": "98d5f5b1-d66e-4cb7-99c8-0544d759fb32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667873, "uuid": "80ae2bad-8542-4376-a6aa-927f3f916cfc", "value": "SecuriteInfo.com.W32.AutoIt.XU.gen.Eldorado.30853.20520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a4d80b-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706698597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698597, "uuid": "1189f213-c289-40ee-830a-c1b967b31ca2", "comment": "Malware payload (RemcosRAT)", "value": "9c2fa949347fe405b4c6ebec92f04f3b", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "isbank", "colour": "#75DA16", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698597, "uuid": "f86d2896-f062-40cc-8ff0-aa9e3fb05846", "comment": "Malware payload (RemcosRAT)", "value": "9465320ba07f135fb0dacb59515e4cc799e6a0025b7f2e90a7daa61a707175ec", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "isbank", "colour": "#75DA16", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698597, "uuid": "151c8e60-e209-44bc-b7cd-674625e6a6fa", "comment": "Malware payload (RemcosRAT)", "value": "e6197be6f97589c4d1dda6b409e56102e9401909", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "isbank", "colour": "#75DA16", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698597, "uuid": "f6f3d638-18e7-4da6-8c07-5efab4ce8e68", "comment": "Malware payload (RemcosRAT)", "value": "2c04b09d327f8e1f1acb9305354bd8accfb8ff5c7f645853bb30c9663f5a9971d5e23094bd844a6a6ef313384bfddc32", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "isbank", "colour": "#75DA16", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698597, "uuid": "cd3e5c85-2291-463d-b5e2-70c83781c9fb", "value": "T1D205F13654937DD16F2B1F80B08D3EA75EA8B5AF8260E519F54418CC30BA6E0DF6E5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698597, "uuid": "24431fc8-f8aa-4cc9-9a52-c50d7d5a3bbb", "value": "12288:WWxDmNCdrGHfRilQGoypup1APbR3lPyEWRX4HZQKPJ4aM/bXdrshvlGPO0LDyYr:TmNkG4/up2PbRVKlRifPJWXd2tGPjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698597, "uuid": "b4b920e5-8fd1-44a3-9cb3-b4f3624de99d", "value": 826895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698597, "uuid": "777c12bb-6e61-4c16-a912-7a61b85340ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698597, "uuid": "4652e0e3-5bae-4ec6-964b-90822ea5d3f8", "value": "IsBank swift-SJ005182824013710.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a74976-c016-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706691453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691453, "uuid": "57dda09d-529c-402e-83d5-a68e7082427f", "comment": "Malware payload", "value": "87f0534a80c93abd5300eb1c9dfb4db0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691453, "uuid": "8569bf7f-3d7d-4fb7-b442-f2c15d484110", "comment": "Malware payload", "value": "94b2885a8527b3679a4b20e336535ce2af60bf5eb10a377054af0fd5aa01dbda", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691453, "uuid": "0460e3a4-3319-40aa-8b69-a02436375898", "comment": "Malware payload", "value": "9b3a0e195dbe611174f081c2aec24c229cef7d88", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691453, "uuid": "9452d39b-d6f9-4550-a725-6630acca68ec", "comment": "Malware payload", "value": "015dc03081448de6a2fef1d3cf661035fe5d6c46acb8900d21a272ece9e13b6ac7a73d87689e99881acd1a05d4f7da29", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691453, "uuid": "76dcdef9-7d8e-44ae-9fb8-0adf2f979c64", "value": "T1CE72E6B671253DFBA143E3FDF0716794B8A6A733DF024A0072FC9AA717E1C546A02494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691453, "uuid": "0f2acb3d-5610-481d-9f75-f35fc4f5bb27", "value": "192:DKhJaAvQXGUIb0bEDxA6dCPyx0dE/BfmdSIyoWzbB7SZFPV6:DKjaAv5TBsPC/BfmIIyoWzbB7SZFP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706691453, "uuid": "a08b13d3-deb4-4fb6-a506-aa189e5904d3", "value": 16831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706691453, "uuid": "d8d42468-d6d3-4c32-ad98-c5fcfda3013a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691453, "uuid": "d778fe04-fac0-43c3-a728-96523114b206", "value": "Dispute_Verification_Form.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d44f05-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699134, "uuid": "ea45022f-4491-4a25-a33c-f06c39dff9a5", "comment": "Malware payload (AgentTesla)", "value": "3469a26be2bdb5a9a56e1dab9f22b04c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699134, "uuid": "a11d220e-98c1-4423-a9c8-f8908e70ab1d", "comment": "Malware payload (AgentTesla)", "value": "9578ae5ee99f3b870bdab12cd4d0aaa9e2731e257775fe3e7136b03928a05d1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699134, "uuid": "54c24a2d-9a6a-43ac-b597-d91c671b36a8", "comment": "Malware payload (AgentTesla)", "value": "6a6b41746d9f3da782c522a56eba4b800d5c9eb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699134, "uuid": "ac7f30c5-aa4b-4a65-a474-02163e8cbac7", "comment": "Malware payload (AgentTesla)", "value": "1914eabce1fbe7f70a8862a595b327a0642e5d18e5741bc2644f09ba10c1adcb4a081cd25e6879a422c647e4badcf443", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699134, "uuid": "6c69596a-dd95-4730-95c7-1fe917a90a00", "value": "T107E42215136BCB79D07C4B722DA818D017F9698F006BD365FEC099EE6D73B029A02B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699134, "uuid": "c842bd9f-c95a-4334-925d-b86924fa9280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699134, "uuid": "7fd1bb04-07f8-4d7b-b0f3-232b7ac4926d", "value": "12288:2lhlfu8liC5utvr8j8qshDfLJ2XzPJlis6rUjdQaCsOIjenGjbDCwoVE8x/C8OPO:Nvr8bsh/AXLis6rUyaCcyS/noeNP19C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699134, "uuid": "a69d005a-3bc4-4305-a0cc-f8d0e941493d", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699134, "uuid": "86eb86d9-4e64-4862-9921-2a67ae9b5eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699134, "uuid": "d189d156-0822-4b42-a9b2-a2fde7aeafec", "value": "FedEx Receipt_AWB#6355646657577514374654-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bf43c9-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706697956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697956, "uuid": "2fc1473f-5347-4d13-9541-e3d815231c4f", "comment": "Malware payload (DBatLoader)", "value": "030b73cf2e5254f1beeeff486fcc3b46", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697956, "uuid": "8ad9c45e-e2ac-4afb-bfbd-cffebfd1c784", "comment": "Malware payload (DBatLoader)", "value": "972c9e0d23a32c2938b27768b86df418a8b23305731698c8b4f8ac33ce432810", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697956, "uuid": "9f2da372-8b5a-4ee3-8343-ece1a0d3eec9", "comment": "Malware payload (DBatLoader)", "value": "c22d5c10b62748988bbf86468d7156c66a8d1ff8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697956, "uuid": "7121dad1-d14a-49b6-a47c-86d89d0b632d", "comment": "Malware payload (DBatLoader)", "value": "5e1794d46eb681e439de9c7eade3f053d8ee96049bdbfea8c737d8e3e5ccf1b419a6222abe1ac17e2c0c6c9e249beb0c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697956, "uuid": "1da61631-de52-4676-9aac-7b8d8213c761", "value": "T11D85CF2276E4457AF222B07927967BADF81D693CA8256DC566F4290CFF33300FB08567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697956, "uuid": "13e1f622-f67d-40b8-9c2b-d4c6c1f103aa", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697956, "uuid": "9756d84a-0c85-4308-a192-d3b38d4611e7", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOB:gcP7HHQU72UHk7c7mvrq0gOPcQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697956, "uuid": "deee569a-007d-4ad4-a6c5-04c88289d03c", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697956, "uuid": "1a6e1033-ca30-4b8f-b004-83a61ec780e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697956, "uuid": "604bae11-c1fd-4169-b82e-b06f5dcdacf2", "value": "INVOICE-098789000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcda9016-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686338, "uuid": "00c9e70d-26ea-44f3-b9a2-1605fbfd6f8b", "comment": "Malware payload (Gafgyt)", "value": "d1218675e0bbb3a56d656f9a7d792b67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686338, "uuid": "b438db0c-698d-48f3-922e-b5f36c1deb5e", "comment": "Malware payload (Gafgyt)", "value": "987606e49cb67d622d5eac81355da078355aec3d55f049d986608e6bba62ce41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686338, "uuid": "59c534eb-6373-41c2-8815-87cf3dbe6926", "comment": "Malware payload (Gafgyt)", "value": "1fb274648701da6826d9e818cb8555ca0996a778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686338, "uuid": "b5bb3676-e1bb-4ff7-b707-c764347453be", "comment": "Malware payload (Gafgyt)", "value": "731aecaf0f3b521ed7b5f672b06ed890fb0eb555433c3fbad359acb1420ee129aff61a459d241d618be08de22a6726cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686338, "uuid": "242d3b9b-664f-4aa8-a68e-a287fdaf9472", "value": "T15BD3C62E7A61ABFEE169963107F35F7083A625D227A09345F26CDB181F3128D5C8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686338, "uuid": "f84e2491-aba9-4432-8112-4479269712bc", "value": "1536:DHfGlkuMau3GanIg2rK/c6U1J8iEHLfPti2dSImNEz7ugf7hoWlNDsKrj4hs29NA:Kx+/PtiJn8ugN9s4XoVmCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686338, "uuid": "7d72f6c6-fc4b-4d5a-b752-e5857bff15d6", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686338, "uuid": "c5e12526-faa7-4b7d-84b5-c4e28f4faa25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686338, "uuid": "4372b654-379f-47f2-871a-dc66821a7479", "value": "d1218675e0bbb3a56d656f9a7d792b67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68591238-c06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706729092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729092, "uuid": "b316a3c4-a4c6-41d0-9a8b-1a9a1623e2ae", "comment": "Malware payload", "value": "a5ab3cb77b199c4fd843cfbf0376e526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729092, "uuid": "a37d4228-58f0-4537-bd31-295ab5bc97cd", "comment": "Malware payload", "value": "98956dce2d6575f74fd0be2079b271cf5512643579c98aa313355313c369e3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729092, "uuid": "ef35625a-3870-4610-b45d-e1ada666481e", "comment": "Malware payload", "value": "46e86b439b57b14dd99c7c4d0ed40b276e4646ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706729092, "uuid": "faed93ca-878f-4c50-91eb-8d012033c2b7", "comment": "Malware payload", "value": "37695032ebbf1af1e74a2b871ba9a4521e0bf9490b54a76387aea002a4ddcfd3ef539380749fbb626ab0d55245387dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729092, "uuid": "8c9974fa-ccaa-418d-ac57-2a647d9ecec3", "value": "T19DE73315FA83B421D4E6CABADF75EF17DEEA7BC395212E09BE15027560881BB0E00D5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729092, "uuid": "f9b6c0db-33e9-4f35-a628-6be8cd983cdd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729092, "uuid": "f5fe2f83-125b-40c1-b9a2-608f1e9dfd25", "value": "1572864:Ym6GMa2XHP4jRwRairt+AUHQHQ3I6/DZDjuv0C/mU1N3k:76GFQHP4j9irnIa2IsDZHYd/D3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706729092, "uuid": "d8dafa05-ce60-48f5-af69-7b438e09a53c", "value": 64887924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706729092, "uuid": "2db67b3c-f5f0-4332-a7bd-0d7666e0bab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706729092, "uuid": "d90775ae-6472-471a-8e1e-58b5e59d1d74", "value": "SecuriteInfo.com.Trojan-PSW.Win32.Disco.uwp.25298.16207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46c495a-c080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1706736977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736977, "uuid": "ce1caf7b-e130-434d-9850-2e55eed22a30", "comment": "Malware payload (CoinMiner)", "value": "f985c64774f224aa6217915e7a8b765f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736977, "uuid": "2ea338e2-d2f0-4794-99f3-c4bac4dd992d", "comment": "Malware payload (CoinMiner)", "value": "99eae9fb7beec942b8b667c3982a01f9a750b9f092e08e7966d403ecd5547d21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736977, "uuid": "6e2f65a4-4d6b-46a7-a40d-221370d8ee00", "comment": "Malware payload (CoinMiner)", "value": "ba4564736e4743c408168ec7e34c4c18c46aca44", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736977, "uuid": "bc5a833a-1a89-4683-ac8c-f49e71663082", "comment": "Malware payload (CoinMiner)", "value": "4a534197dc66847e8cdc8cd41d3eb3e9ff6bfec5b28963f2ab1c7186f098a6edd29b105e09e658222460256cdefa97e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736977, "uuid": "3995e8be-c264-4a60-be24-a7bcb251488a", "value": "T1D8D5231D37A18CABC3780334AD329384D2316B509D9D5600B26E6FB6E676DDC0FE96C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736977, "uuid": "d9719c1a-8897-49fb-96c3-384dcf1c4e16", "value": "6a771759fba093ace9dc951982f52261", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736977, "uuid": "ab84fa88-dead-485b-9d3c-07bb6b44d078", "value": "49152:JBOZc61vWZ554HNiKV+3qnUcWWOJB7Cab+tA1xOFqfd1a4NAbFTG+go3G7zSqAl:JQZeZv4UKooZOJb+tA1BHdaNGU3MM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706736977, "uuid": "7ea0280d-2687-48ff-8197-7ac8f0e03f45", "value": 2829840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706736977, "uuid": "221aeb50-fd64-49f5-9ebc-fc56b71205e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736977, "uuid": "cf5c1816-5854-4d97-b90a-80c5081f81d0", "value": "f985c64774f224aa6217915e7a8b765f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254d3457-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1706682164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682164, "uuid": "b3a8d4c3-9a66-428c-b133-b3a9ba14ad4e", "comment": "Malware payload (Loki)", "value": "d920ff7b71a0f8639edaa7e292a56c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682164, "uuid": "ae74d713-ca3a-48e7-86b3-3a46eccface4", "comment": "Malware payload (Loki)", "value": "9a32cdc7e68af6220b82c21e76d1eda4a4a822df3fc75dc642538c1ef4f50901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682164, "uuid": "dbd7bdb4-8562-4521-9a2c-de00cc8bcc0a", "comment": "Malware payload (Loki)", "value": "a9e9532df7ea615e22cd2e6bbded1b82e0dcd3b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682164, "uuid": "223bf342-9291-483b-9083-bde3f7401203", "comment": "Malware payload (Loki)", "value": "6af5574d1dd3abbb17ab36deca0fd86066425892bc9690e7a93874bd05364587b92d1ea4134549fe324ab65135341551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682164, "uuid": "3031dc39-e89f-4c2f-bc2c-f1034c7bdc2e", "value": "T12C24C643FA4748A1D94A5376C9B7691002F6EE8AA6B3D60D349F33F54E733A31852D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682164, "uuid": "ff4bf22e-df90-4c66-98de-79063c77f25b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682164, "uuid": "4843100f-52d3-41ba-b334-1a5a0567acd6", "value": "3072:r5FEm+5pxecgL89l9R+mqMGDjmwHPImGCZnjGUiz6ykDxSTlWoJl0ovJvWR46fJi:rLEmOpu89XGfmEI3CZn9iz6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682164, "uuid": "8645a848-8e41-485d-bca7-06ae7591daa6", "value": 225616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682164, "uuid": "53663a62-9fd0-49b4-9453-5bfe1e448e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682164, "uuid": "98769c11-ec08-417c-a533-d8062c818586", "value": "SecuriteInfo.com.Win32.MalwareX-gen.23550.23144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba43d225-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686280, "uuid": "3aeea2f6-7562-4375-be2a-0c9dc57a9143", "comment": "Malware payload (Gafgyt)", "value": "7d0e71f167ca4c3f918ee1ea0d02bbd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686280, "uuid": "0fe4f493-675c-42a9-a80b-afd4ea587bc5", "comment": "Malware payload (Gafgyt)", "value": "9b236d4d38d65ded76ecff245374b073d7208cac9c32f9a88bb2e9225666bf99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686280, "uuid": "9a9575fe-ce56-423a-aad4-1c189ed12377", "comment": "Malware payload (Gafgyt)", "value": "17e24e9302120db2ed857bc7d0a71abd35bd704a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686280, "uuid": "0a6202cc-6667-4c16-863a-fe4c02c0721c", "comment": "Malware payload (Gafgyt)", "value": "ca4fd5b6c799c816f7a0752f572b87b9d4cfab42085e682a037bce2426509a5af83971eb8bd225f8c47ebbb69c65f392", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686280, "uuid": "63a53196-1226-4851-a2be-6149b514e275", "value": "T100A35B53532D0A87C98B9AF02DFB27F187AAECA012B25644950EBFC41773BB41056F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686280, "uuid": "b2360369-3a95-4b49-98e9-3ac9b43a9b52", "value": "1536:DEg/+165BDtuS5Xap3SQuqomJd28C40W2tRnAJfmsCskFw3DW:DXa65GSA6q7Jd6omDski3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686280, "uuid": "eb3ae03c-b1a1-48bd-8df1-6d6488ecea28", "value": 103588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686280, "uuid": "7a9d202b-71a7-477b-bf17-4b0750b51e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686280, "uuid": "beb0dec0-3107-419e-849e-a0ba12f3b944", "value": "7d0e71f167ca4c3f918ee1ea0d02bbd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08520d7-c065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706725348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725348, "uuid": "1c222281-8494-4974-8b80-d5292ac8a931", "comment": "Malware payload (Mirai)", "value": "6eae264b17a77b31620d868665063bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725348, "uuid": "2f119135-c4fd-406d-8f5e-3d8c72b963c2", "comment": "Malware payload (Mirai)", "value": "9bf60f8c49c5008b95bb6254e122da11bb1654871c2c87e122dc395055ce7f68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725348, "uuid": "21a44939-a302-41a3-bd44-158302abd2eb", "comment": "Malware payload (Mirai)", "value": "2968c66d22bbe9b2d08734a6af8e172a6da7bcbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725348, "uuid": "01cbc8d1-61b2-45c4-ac20-ff67c89ac229", "comment": "Malware payload (Mirai)", "value": "1874519e1c854377f01fdd93cc8a6ae81eb1c7e2626a0b92241f0687c0c440b5f95001cad672d57ced8d82f0538db314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725348, "uuid": "2a89f2db-cc4e-4722-9015-a45500e40612", "value": "T14CD2D17C2E0915CAD0B7C0F8EBF10B442EF11AA47911B90B9550B6E6DC916B033E7EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725348, "uuid": "321b14af-a70f-44e1-a507-69d9fbb03dc9", "value": "768:17V+dOnq6bj9EGyAhsI5izUBEZp1isELzSjpWzIuOh0M65eo0iEZJgGlzDpbuR1b:9V+dKd/ZhsIOUBqpcsEkWNOeR5z0iELw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725348, "uuid": "42a81f29-579a-41d2-b824-22145e1a38df", "value": 29500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725348, "uuid": "2b37f29b-c984-41e4-9f7d-0cbade414936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725348, "uuid": "c9bd2fbf-c0f8-43a2-b6f0-2bcc4061fd38", "value": "SecuriteInfo.com.Linux.Siggen.9999.553.18266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19892fb0-c000-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1706681715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706681715, "uuid": "877af657-9206-418d-a1f8-5610c52b9ec5", "comment": "Malware payload (RecordBreaker)", "value": "149c52fc9f8e8eb35411eefa46eed4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706681715, "uuid": "f4452099-48af-4ed0-bee5-3b30fbedc8c3", "comment": "Malware payload (RecordBreaker)", "value": "9f40425e1c2ffbf71fa43966c0e1b006fe40a9d6c02f03165a7008d982cb54d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706681715, "uuid": "eb344e70-5fca-4e62-b354-3829f2ea7f3a", "comment": "Malware payload (RecordBreaker)", "value": "f00cacd474f09bbd9ea2b11213635fa310920b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706681715, "uuid": "9526f243-2971-41dc-8836-19b7603571cf", "comment": "Malware payload (RecordBreaker)", "value": "d71bc90abb7cac96a2dd5deb68ef8c98def620ef30dd2a18422815a5676671ddabfc55bcb9518883268589bc76affa91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706681715, "uuid": "23d2c101-e8bd-42fe-bfc0-30023f8b468a", "value": "T150563AD126B40156D06B9A74C2834E93A5367C7C1F38E7AF0A8875AD3E722F4DE3E605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706681715, "uuid": "24973e1c-a6f2-4aa2-b002-98ef704e29c2", "value": "d5d03e4c143836f1f6f3281b9dee79e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706681715, "uuid": "8b10188a-9a76-482e-aef2-122487abfae0", "value": "24576:XUz+4cv3r+ys6rm4xEJ2DU4yHcEUVFmCDjanwtTI:X/zv3r+y3EgVyHVCDjOwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706681715, "uuid": "63c3d873-d4ab-4edc-9618-62c38fb05079", "value": 6389760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706681715, "uuid": "4493e0aa-3b0b-4ae9-982e-aa72573f908b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706681715, "uuid": "4af19851-8682-45f3-824b-453ca101f639", "value": "149c52fc9f8e8eb35411eefa46eed4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6baea35-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699212, "uuid": "5c14d933-cfab-4b5d-9b67-37bf1f699f5c", "comment": "Malware payload (AgentTesla)", "value": "906a8abf05554b9d1c954bb7254c55ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699212, "uuid": "ab5c5ef1-7d74-48d6-86ba-e36e6c705e33", "comment": "Malware payload (AgentTesla)", "value": "9f83d6349dcad66b3cf4348531df4a654bbf0c1d8c6af3408030dd32a2ad84af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699212, "uuid": "dc214644-cca3-4eea-ad81-655364a4743c", "comment": "Malware payload (AgentTesla)", "value": "1392e627ef6aad2f203a1933104a9b45d2621c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699212, "uuid": "d3c14708-9216-4d23-a8cf-4941d39eda77", "comment": "Malware payload (AgentTesla)", "value": "95dabfe2fbc75649154cf575425d9718ab50f9c1263bec394d5b5263b5df39d381715f3226a158ac6f77b0cd568ae2d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699212, "uuid": "47f9dda9-105c-4cdf-947e-6b1dabc3f56e", "value": "T113F4126877588847E62E0BB0DD2402EC4772AE327DA3F2DF2CC4756E59F2B869651313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699212, "uuid": "8c2e92d0-7317-46a5-9f92-ee96aaf2d77d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699212, "uuid": "13f86cdc-93ac-4d6b-b266-6d0fe9a9b3a4", "value": "12288:hZ1PR9SCF1ODPt3+zWZUpQUi4IoEZB/v1+F73goI5RfMSara:hZ1PR9Z+V3+dzIoEn/v1+5gocfM/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699212, "uuid": "a34b288b-d728-451f-b42e-b3bef2adf41e", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699212, "uuid": "0ef7f973-25ec-402d-8a3d-328a0023fbfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699212, "uuid": "25199661-36f0-47d6-a6c0-2cb2843afd54", "value": "DHL_AWB#20248791029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5854c0-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706698603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698603, "uuid": "5cbe74d5-a3f5-429a-8fb9-e7b2d927a4ce", "comment": "Malware payload (GuLoader)", "value": "da96ae3bff96062025f4f49a117eb35b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698603, "uuid": "f293d5f9-cbab-42e9-a3b5-f266e0fd00b2", "comment": "Malware payload (GuLoader)", "value": "a12df16d1e3d6cd90255cd4f09fed48117712a708622dc7f300cf71c9be56ef8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698603, "uuid": "8dff7a83-c6e5-4e50-a624-3d8fac3f8a20", "comment": "Malware payload (GuLoader)", "value": "4d6844d058f2e7850a20ed6864d22b5525381a98", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698603, "uuid": "10c29af6-0c19-4bbe-8a7c-4b69b707bdbf", "comment": "Malware payload (GuLoader)", "value": "a3848144ffa461c0030bc634ed5cf3506c1832f3b1c95c2e8fa49c2739119d848e56e3f1508c0172ffb45d2e0a60774d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698603, "uuid": "d831ac80-2caf-4ee8-8ee6-4ca4f8894e66", "value": "T1BF924CFC9D420FEB7EDB2BFA8841A54084644DC3C1351860EAAB43D970C68D9DE7D5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698603, "uuid": "411b29b3-46d5-41ff-921c-bd8ae79cb8ce", "value": "384:/hSdbH45KryxIU/ydurGTUzNXkB8VaZFun9PLC6Zz3N:p6Ywhm7yB68cAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698603, "uuid": "fd429b76-5d4e-445d-93ec-4f05c4b9f8aa", "value": 19982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698603, "uuid": "35a8c5d9-639b-42e8-bd41-5dd826ca0ce6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698603, "uuid": "3341dd3a-f7cb-48c2-94da-6e79a29ad702", "value": "PO_IONE-JV-CO-PO-0842....vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8312355-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717603, "uuid": "3f18f2dc-14a0-44b9-845f-fb1a558da73e", "comment": "Malware payload (Mirai)", "value": "ea981ab7acde587c6a4bac39967f1f49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717603, "uuid": "64c791ba-a105-47cd-b1f6-0334f2c3d252", "comment": "Malware payload (Mirai)", "value": "a13ada8911a9b38d4a88a88efa7c8eaec154d4ca8209b5fe1668670c6c0e1b1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717603, "uuid": "3341d805-ccc9-4d03-aa49-4e63eb7ebe46", "comment": "Malware payload (Mirai)", "value": "432a40542c4a81485c220f376785464f3f4f4a45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717603, "uuid": "88d3954a-3721-4138-bfe5-89fafb4312bb", "comment": "Malware payload (Mirai)", "value": "9b82f460b6d229249d1d4506d1a1594f4744439f17032578689ecc1e7ce9995d6c7b56b234bae5e57084885314dd7329", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717603, "uuid": "3c388393-be92-4548-9b8d-ec816d6ce94e", "value": "T15CB34873CC29AE5CC668D5B4B0B18FB82B53A961814B1FBE15A6C2749043ECDF6453F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717603, "uuid": "756e3b1c-fbec-4e36-8e21-9783601b34ab", "value": "1536:ejKvZA15s3jrECx9KaVSF7QAqtyKUcCW+brXjHkDNNUS:eGg58rEEkakKtpRCWiXjH+gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717603, "uuid": "36f4d63d-9fad-4415-ac01-9ffe63fb77e0", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717603, "uuid": "c9d497fc-c83a-403b-8584-c3a081ac1905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717603, "uuid": "e0a928be-32fd-4252-8813-b9eafc529a4d", "value": "ea981ab7acde587c6a4bac39967f1f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b35800a-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699354, "uuid": "c9288197-f227-4601-8005-7cb0a95e9b61", "comment": "Malware payload (AgentTesla)", "value": "bfd4092dd18687560fffb5eeed90aacd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699354, "uuid": "a5969be7-834e-413b-9d2f-1a7ef9cd4f10", "comment": "Malware payload (AgentTesla)", "value": "a240015a32ca9e0665c9ccc875788084fe58bdbbd0e9f70a0ce5a7fd9ecce65e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699354, "uuid": "8f9a72b2-e5ff-4c56-bf47-b66c4fe5d228", "comment": "Malware payload (AgentTesla)", "value": "2561ef77203cc2d87f079eb24ebebb03d7d9c97c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699354, "uuid": "1658ac9e-0561-4c22-91bd-4a044ffbb999", "comment": "Malware payload (AgentTesla)", "value": "e00d0e6408ba60d7ab82a337cfc954fb8517e5fdfae07c98b77f27a558545ab3c71d89a8e53ab85ab4d30a15e2598ad7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699354, "uuid": "fae9c213-36d4-43c0-a720-8e5e3702cd99", "value": "T140F4122437A81517CB9D05F9DC6182DC4375AE26BD9AD3EF6C88306C1AF33D94B42A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699354, "uuid": "f5ee7a8e-f500-4e5f-97c5-1d27f31affab", "value": "12288:/2uxUDrMMc0YcUwVRmqfRLiGiGIdWhKp00AaGQ7jzaQaI3bGaDlegI3szBi9:uuxUFc0LUgRmLV5W9Ix7aQaIrlegI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699354, "uuid": "fd2ef7b7-51ad-4d7f-b8b3-3bef32c5d02f", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699354, "uuid": "76f92b8d-8880-458a-b341-d72c9cc66973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699354, "uuid": "d8db2d57-87f1-48a3-989b-ec78d8d6157a", "value": "Quote-0033386.LZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4a1f0b-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706682173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682173, "uuid": "704a30f9-37d6-45df-9e81-3b893979fa60", "comment": "Malware payload (AgentTesla)", "value": "c35d2a8665fc28a0939dac586846dc20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682173, "uuid": "1a2d39cd-880a-476b-82a9-349b87c5013c", "comment": "Malware payload (AgentTesla)", "value": "a2ffc54dc009fe2a1ff5ec49f48081811ea7a9b41314bfbdc9a4874896300ab4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682173, "uuid": "aa04b4f3-9dbb-44d5-9b6f-528c3cd3a45f", "comment": "Malware payload (AgentTesla)", "value": "f8f1eb119cb04c6e43983ba61d17806065f0573b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682173, "uuid": "7965fcbb-9e74-4369-922d-d4fffb46bda2", "comment": "Malware payload (AgentTesla)", "value": "582bacf188d126827458f4fa6a9158dc92e6ac8ac5fc2e84db2d0ced606ca2ddb9496d91d6959771e41ff6c0b113765f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682173, "uuid": "9d27f8f4-7030-4b15-a752-0016bf030532", "value": "T16DF4C0423144DC9AE4171EF214AED520A3B83D9F8125C61E3F83BA2B65F3712255BB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682173, "uuid": "6ebcfe1e-1cec-447d-a3d0-8fdbd6551def", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682173, "uuid": "1d6df1ca-235a-4b0b-acc5-119dd56aa678", "value": "12288:3k+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8loSiyyjK:3za6u/ZKCcmdqw6S2dRod8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682173, "uuid": "bbdb417e-208e-4499-9846-d287487025f3", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682173, "uuid": "07dff421-9ea3-435a-9d05-140fa7d3c0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682173, "uuid": "9de58819-ba9e-4c10-a8f1-5e6c715f2919", "value": "SecuriteInfo.com.Win32.CrypterX-gen.17480.22966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048a3460-c060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1706722912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706722912, "uuid": "bbf57c9a-3148-4cf4-b57c-97f721f29f13", "comment": "Malware payload (DarkGate)", "value": "e7fb7aa7dc05e76b1c8054a9a375158f", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706722912, "uuid": "b185b659-4200-46cf-91e2-f2c4b0df8b5b", "comment": "Malware payload (DarkGate)", "value": "a31ac963ee344678ec4386bdac3a9c9cf2804049cb81e5b0daeb65082da09b32", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706722912, "uuid": "b777d34d-a23a-47d7-a4cc-7e9eca8e36ad", "comment": "Malware payload (DarkGate)", "value": "ad86bb65b231dbcd3784c80908df63f7f9a1e2fe", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706722912, "uuid": "b180d5ad-914f-47af-95a1-b425dceab685", "comment": "Malware payload (DarkGate)", "value": "e8e9054aecedac789d4de396225aec9e82def5ded8ea655675fa81f97658fc09b7c6ebc509cc726d0928813e70d1ffbc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706722912, "uuid": "cfabb657-daae-4f5b-aeb7-eb027aa2cc08", "value": "T1CF9533D8478CE615A0461647CA542B7A29FD3E4402FC3273AD63FD2FADE650A73D702A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706722912, "uuid": "ad58d674-ae52-41d7-ac5d-4847a289bc33", "value": "49152:orJxPxRwHzatcpnSZ1Z7o0MBhSUouVcuuFe//GBB:ocHzaOpA1Z7r7DuVcZOGBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706722912, "uuid": "3a3e53da-ca77-407d-b8af-cf3412069af8", "value": 1959778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706722912, "uuid": "53ff7e70-f959-434d-8874-d9e95ed27fdc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706722912, "uuid": "6d936fc9-0512-44fb-9ccc-431a0f7d6b75", "value": "mkreafr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a08490f-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699513, "uuid": "355f4dd2-b64e-4051-8354-a146ff4f03e2", "comment": "Malware payload (AgentTesla)", "value": "e02d306738ad0ad6d47bbfa7f630e639", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699513, "uuid": "a138bfbb-74b6-4d08-8a8b-df93535644fb", "comment": "Malware payload (AgentTesla)", "value": "a3f347e2407b9d46e0299ac135b0a08917d1f72071de4b11b322f178d3ec3ae8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699513, "uuid": "7431c2fa-8ee7-4304-8393-dc04c0360546", "comment": "Malware payload (AgentTesla)", "value": "538890b8fa7de4a066a220c694203845f06c4f9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699513, "uuid": "0f684ae4-1892-4402-bf01-576992146852", "comment": "Malware payload (AgentTesla)", "value": "b31616a273b9af5f7e2055db5657633efb9bdacdab5cdd515ec91bb69c56d064e1f137d395dead19ccc4f42b56a685ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699513, "uuid": "100ee3c1-d85b-4a60-95ee-e891f967a6c4", "value": "T14C55370322818322EE5E9DF23AD6A1534EF95DD60122A7DE035C3F6D6B7FD6003E9652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699513, "uuid": "5f68fd3e-c414-41d9-8eea-59aa1cd72b39", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699513, "uuid": "1ca9da69-c807-4729-bbff-11150fda8bd2", "value": "24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8a6ubAKDqeLPmbN2:fTvC/MTQYxsWR7a6uLeeLPIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699513, "uuid": "1dea497e-e3c4-4ea1-8813-ff85df40305c", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699513, "uuid": "71628ae6-9fb9-4a97-95f3-92fb6d78992e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699513, "uuid": "8a47d925-65c2-4b04-b427-5c00b4a6de58", "value": "RFQ-20034450Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76b2d6a-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678517, "uuid": "35b8bb66-cbc2-4d29-b50c-d56878fb709f", "comment": "Malware payload (Mirai)", "value": "e14a21ac8dfa8830ec2fd43f60618df2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678517, "uuid": "f888361e-a781-4c48-8257-be6c858c3efb", "comment": "Malware payload (Mirai)", "value": "a829c4ec9c0c2ee34d4468e437b6d1e7e2d9b2e85d2868774a2ce1fa1e42a88a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678517, "uuid": "b5b364ab-a6a5-419a-afa7-0c1ce8b17427", "comment": "Malware payload (Mirai)", "value": "a18ddb6b7a062d94301d03e673e18d3894f2abf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678517, "uuid": "6de66344-ca37-4b22-b9d9-465572ff7ce0", "comment": "Malware payload (Mirai)", "value": "71c26fc6d225d6e6d531e11426062293b0e1ed197427949f142b5a6af6726be5bec9c156700c770fec48cc28728f3101", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678517, "uuid": "f002651f-9f8a-4138-aa94-7f4b580cb6e3", "value": "T19E3302C4B670EC8DEB77897ADA2CD309DD4A5FF1D2E734022018860539E689778E6C97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678517, "uuid": "21a50ef9-2ef9-40fc-ba89-e0dce42bd0e1", "value": "1536:EjGRAfHXB/EMCZJof69Hf2a5GSs//i0nzfp7U9oB6vRLLY:goAfHXOhnofUHdsH9n7ZvB0LLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678517, "uuid": "dfe5dc5f-5ede-46b5-ac56-e1d0629bf911", "value": 52712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678517, "uuid": "8faae4dd-e07f-496b-b02f-9cd5752d5199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678517, "uuid": "4ed72ec5-ba67-4dba-8ee9-0622ee51341b", "value": "e14a21ac8dfa8830ec2fd43f60618df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14bf98f-bfce-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706660495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660495, "uuid": "e832db9a-69f8-4e17-b1ab-a61590da1f85", "comment": "Malware payload (Mirai)", "value": "684bbdbd59951bf6aba0c45fd9b55741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660495, "uuid": "7a07a46a-6742-4d6e-925a-fcbb6dd74853", "comment": "Malware payload (Mirai)", "value": "a8ae14011c512071011830bdefde599f7592a9864866e9e6b71f70f7fee7e962", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660495, "uuid": "e98269bc-77a9-4aec-8f74-ff3a67881f44", "comment": "Malware payload (Mirai)", "value": "785c0e67d7c84ba516df1fcb89c7d483a28ee6d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706660495, "uuid": "4f31201b-3645-44a8-b3d4-62f997272730", "comment": "Malware payload (Mirai)", "value": "bda92bef10b6524d39c43dcb4b5e049ba2b444e81955a47937da2eefca9d802d7cd2188b138205326b1964fe593f0fa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660495, "uuid": "37e2b480-9fde-48ba-92ba-d55e570a27d8", "value": "T16D13E16ED9665DC5DC5C887A1EEB1393CC9431D437CA43B817298C04DE4EE0F21EE169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660495, "uuid": "0e208934-d724-4340-bf26-2dd5cd309532", "value": "768:FN9m3mITNW+0qEjWF4Ok/GvmPwoURb+WXgXQ9AVyVahpWGPOul:FN9m3Klj3p/G+K4+96VPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706660495, "uuid": "6144d0f6-bfdf-47f7-993a-a48d8b6033b1", "value": 44912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706660495, "uuid": "92b7c292-dd41-4265-94f2-27c368319416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706660495, "uuid": "b1d638ab-f602-4114-97df-d3a8e59900f5", "value": "684bbdbd59951bf6aba0c45fd9b55741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d009014-bfef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1706674634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674634, "uuid": "530e4cb5-2a43-4dcb-af70-d2a2186b02ce", "comment": "Malware payload (Fabookie)", "value": "5fd7aff48d27771ca0aec6776afefb93", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674634, "uuid": "3a994462-5915-49ac-9d41-7e05c6a3b4dc", "comment": "Malware payload (Fabookie)", "value": "a9498e18f267a568b57d3a281d14118c70ffd1aae42411ee9a7661092beee97b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674634, "uuid": "5f6fd2db-0738-4b53-9ff6-00d21eaf724d", "comment": "Malware payload (Fabookie)", "value": "5d57e1e85a836b736d3b3c2056d500d1d2b92dd2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674634, "uuid": "8238d9ac-e69a-464c-b827-dd118ece2d0a", "comment": "Malware payload (Fabookie)", "value": "f9d1a9f10fe35a7f65bd4c04ad5cf83a4ef2af569117445f5fcd55934b3bf9ff345d5828debb81dd4c392fd76e5874f2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674634, "uuid": "0576d5df-80a0-4d88-9b13-0ea2df682986", "value": "T177544912AB25DFB8F0C7C8B6BD30410218E8B4097758B57E96CDCC751A3BC51ADB5AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674634, "uuid": "1725df2e-e0c6-4a51-bd62-1d2192ed9e8f", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674634, "uuid": "ab85e16d-a2ef-4d37-8e56-27035422aecf", "value": "6144:k7F5GxMr+PtCE2kWCZ3j9Z0CINiNRpxyN90vE:4FYxMqAEVBkCIWZy90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706674634, "uuid": "0f303e2d-71c1-410e-9103-1697ea58fc15", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706674634, "uuid": "5054cfa1-12de-4563-ab58-d429001ee5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674634, "uuid": "4ce4396d-8537-4021-8eef-91f397772ef7", "value": "5fd7aff48d27771ca0aec6776afefb93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe5747f-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678525, "uuid": "8bff4644-0fdb-451f-87d6-e82573060b76", "comment": "Malware payload (Mirai)", "value": "65afff57beaa3c438b753e588f73d1c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678525, "uuid": "e598f5cc-ddf8-4c85-915a-b1a43e125788", "comment": "Malware payload (Mirai)", "value": "a977ab0a88c172f2b320b88f9acb62b9742203b1c87d319ea56940e6bf1c6e93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678525, "uuid": "6c10f482-0621-411c-b299-d28951678fbe", "comment": "Malware payload (Mirai)", "value": "1af570992d18b04dc509a93125de64cca76de741", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678525, "uuid": "f0f17c5f-a64d-4aef-90bc-eaef27e5dc1d", "comment": "Malware payload (Mirai)", "value": "c48cdabdc96e1006bff12f919b441c05de32b646302cd9e95c2e196270029a54d29a24a0062edbf5cb4a9aa22330a8b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678525, "uuid": "b9f6ce3a-4baf-4b2b-a2d2-8cf36ce7f60c", "value": "T170E329D7F801E9FAF809E33348534509B130B7E649825A337267353AEC7A1A52577ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678525, "uuid": "6db35de1-18ae-47e4-91c9-5f374b521153", "value": "3072:To7vrzOctByB877WQgFiTtYQYZ4V1jbi9LTktD3k2wJ3r6:TovOYByB07WQgFiBrYZDLwt3wJ3r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678525, "uuid": "c6bb5096-d45c-4e91-95a6-819f1f4233e0", "value": 146464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678525, "uuid": "9e817ddc-4951-41a2-9c61-3c7a3dd0b24f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678525, "uuid": "7b9228ea-c97b-4fdb-9ea7-d239e90d8c8a", "value": "65afff57beaa3c438b753e588f73d1c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec7145c-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686287, "uuid": "49103c10-4917-4463-9a74-f5fdb4b1c177", "comment": "Malware payload (Gafgyt)", "value": "9d103f06b36292080ef693e0b17dfbd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686287, "uuid": "f4242c42-a272-4f8a-bcb6-752cac7e391f", "comment": "Malware payload (Gafgyt)", "value": "a9f46958231d6b88915c51fd7225a99836d0618478cf9e8642dc1f3aabd001ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686287, "uuid": "5cdeb2fe-66a8-4c8d-a2fb-9c69b73de454", "comment": "Malware payload (Gafgyt)", "value": "7683bb0ae2524507c1c27d9668931b424b2dcaa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686287, "uuid": "ef2a97af-15bb-409e-a427-0f4dc5fe6c29", "comment": "Malware payload (Gafgyt)", "value": "f9761551328839c2f0944edf10f6ae42328df9fd2789cf8c7bb94d3eed8c7b8b08f71356320aac77374d7fc28bb9845b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686287, "uuid": "62089826-e0d2-40ac-a94a-2163d14735fa", "value": "T18093398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686287, "uuid": "3a406120-0f52-47c6-876d-b4873a492b56", "value": "1536:TeDM+Vlabe0Ff5soS4yfafGdfmoDs2tSYVm+:Tj+Vlab/DDfGdm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686287, "uuid": "8729bce9-8e5c-40a5-9353-dc4aa4d612f6", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686287, "uuid": "ff327a48-5ad8-40d0-906e-42d890e3a7fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686287, "uuid": "26bb31a2-bd75-4f8f-a6d7-254a81b67b26", "value": "9d103f06b36292080ef693e0b17dfbd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbcb947-c037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706705717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705717, "uuid": "e1a5e3e4-e8bb-42e3-b6fc-21c5fd6c8778", "comment": "Malware payload (DCRat)", "value": "a677a266858374dd1053a0321dfa0c1d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705717, "uuid": "42ed59c8-cca2-48e3-b1cc-f7bf1e9487c9", "comment": "Malware payload (DCRat)", "value": "abd4dc063ae140718e711a70d32ee6720a3ca9076d5297903fdb4161a7866241", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705717, "uuid": "b0603b3f-bfea-4dda-9cc5-4120d4de22c9", "comment": "Malware payload (DCRat)", "value": "ee5ed49874ecb0f0b03cbf81f78dc58241a54a15", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705717, "uuid": "f877ca15-4982-48ab-9f02-eaa8c62174e3", "comment": "Malware payload (DCRat)", "value": "a042c9db762a51e31d0a34c34ffe3b35fbb6f69f6552e55294086eb47fa11f17ed1e4a4d346ac9769b9d15dd18bb44ac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705717, "uuid": "e2c94374-d599-43af-af06-9f25d834f3df", "value": "T18BF5F14666524E33C2A43F32A9C7002D8AF0C7667522EF5B3E2F35D5B84A2758B525F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705717, "uuid": "eaaf8370-782f-44a1-a4e6-dbf36cb04357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705717, "uuid": "b86f35fa-0e26-4093-8870-8eeed64158ae", "value": "98304:CmmTErJbANJRjpQwHxL1F80OQSqpORRRJez:CzEtbyLpRpF8CS7RRREz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706705717, "uuid": "c83da939-213f-4ab7-affa-a2661ce937c2", "value": 3627008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706705717, "uuid": "458342b7-3a29-46f1-8479-4a3d18fd8dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705717, "uuid": "97b0f136-3398-425a-aec2-cd9a25f9a560", "value": "a677a266858374dd1053a0321dfa0c1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb608dd-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706715865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715865, "uuid": "03bee39f-17cf-418d-855a-8cf27065e863", "comment": "Malware payload (AgentTesla)", "value": "f3e66df83736cb4d0fb7cb9f195ff895", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715865, "uuid": "4e943a7c-4488-4415-839b-1deffa1cddfc", "comment": "Malware payload (AgentTesla)", "value": "ace13ea91164ad1af7e08b21e1f88045238aea4a71236286f5906ed61cd0e389", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715865, "uuid": "7622d7cc-17e5-473d-9d90-544d0c7bd2c3", "comment": "Malware payload (AgentTesla)", "value": "26b68cd35008b2d78f969b98a8cccd051db67774", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715865, "uuid": "9d7e44cc-28ba-4ef4-b3c2-3d4e1da88daa", "comment": "Malware payload (AgentTesla)", "value": "9582f006ae4f561b296919e0ec47fc8bea817e7383eb0d05935a0397111d4c06ec5dfed59237c41236ea509c5d2c0201", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715865, "uuid": "f0a4f16d-a000-420f-aecb-5d9da55bbcd3", "value": "T1C905023764D37DD16F3B5FC0B18535676EA4B66B82A0C60DF5841C8C20FA6A0DFAA5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715865, "uuid": "6ac0bdd1-c80a-4f4a-b925-43b89c246966", "value": "12288:hs6EE+GHfRilQGoypup1APbR3lPyEWRX4HZQKPJ4aM/bXdrshvlGPO0LDb:hNeG4/up2PbRVKlRifPJWXd2tGPjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715865, "uuid": "f049af73-4458-4848-a1dc-ff977820500c", "value": 803651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715865, "uuid": "3fc68d87-edad-4d32-91a8-a6fe3301b202", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715865, "uuid": "e888dab3-e638-4f39-bd78-4f04a70b3822", "value": "Deutsche Bank#31.01.2024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a2339b-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706699229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699229, "uuid": "79092e5c-bdf0-48f9-850d-30a9ce55146a", "comment": "Malware payload (Formbook)", "value": "fd2d93eb3d99ffd8dfed263e80672542", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699229, "uuid": "043980df-34f5-4011-b2ca-ac6f9d856802", "comment": "Malware payload (Formbook)", "value": "acf572835899c617dde70bbdcee3eb6cb27582f6aad484e1d5a206c9ef9c2d14", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699229, "uuid": "c30afdcf-3681-40aa-a255-b0abc3da29ef", "comment": "Malware payload (Formbook)", "value": "2a9c3e077568a707cb03ac165be4a5d8d8836a25", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699229, "uuid": "3442c0dd-7687-4f25-b7b4-a8522d755852", "comment": "Malware payload (Formbook)", "value": "4545bea1172da2f550c5285675aa128a7e1978386162f23aee8424219fb86b98f3496ddf9017dd23e2a14f9b51c9900c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699229, "uuid": "df7ec03e-a8df-4c91-bd3e-b5562d7203c1", "value": "T16EF4224937FC871BE5F61BF42664858443B2F022A0C2EBCE4D9862DE1A72B455E2DF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699229, "uuid": "e98e9b2f-5077-44ce-be74-e9b09ee6fd35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699229, "uuid": "cfe0cf44-529d-47c0-83b6-7311328a7865", "value": "12288:HGpoIFFHgeg/c8WjJ4niDGta2PTG+3u9xkkm/DVKRkFzgkpxmpt8AMkkFb:mpXFxRjJ4niit1N3oxnqDNHxw+3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699229, "uuid": "f63eba6f-c8f6-4feb-b2c6-c6c431512ac1", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699229, "uuid": "8324af00-6d77-4fef-895b-117daef43213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699229, "uuid": "3dc14157-9dcc-4f6a-ba7e-5ce24e5f21ad", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0adf90-c011-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706689395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689395, "uuid": "a778bf1d-c257-4a4c-b739-91f78baacc47", "comment": "Malware payload (SnakeKeylogger)", "value": "4cef4213abb096ac7a418641bf3d9e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689395, "uuid": "05771126-a73b-4efe-82e8-393f2a0baaa7", "comment": "Malware payload (SnakeKeylogger)", "value": "aeeca36d177b00781e8a69a0f4cf0b95c7fba372ed672d2453ad97bc8e93ca9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689395, "uuid": "a580774f-a203-41bd-a2d7-a39b946a9ff4", "comment": "Malware payload (SnakeKeylogger)", "value": "c2e872f08030fe0c33ba31055ee7f339e3bc9f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689395, "uuid": "2ca7e2af-594d-4096-9472-48191326a368", "comment": "Malware payload (SnakeKeylogger)", "value": "86c526bfcc3d6cb08c15a079bf39eac46465e0e6033a8be82dd0e8e0c6b1b9e24d1d9b4f55c8bef6cacd12064c0a1349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689395, "uuid": "16b34103-f7e2-4152-8237-b2642aba642d", "value": "T13EC41241B6689F6DE5BE87F54B32009007FB359A7C61F35DDC8631CD2AA1B104B82B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689395, "uuid": "7481deb4-013a-4a20-9dfc-cd95de51dbb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689395, "uuid": "24f72b44-a4ef-41a0-94da-26799a45e00b", "value": "12288:FD8j8qshDLtAJE1/GnFKJjo12J9jPbrNr46x:J8bshvtQE9GOPjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689395, "uuid": "6715a282-a2e5-4ab7-b07b-1785563b2030", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689395, "uuid": "028eefe4-bdc7-487e-9087-a8c59d652eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689395, "uuid": "8d487743-3e10-4de5-90f6-1eaf23249149", "value": "SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.7337.16124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c276a7cc-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686293, "uuid": "b640b999-fc6e-44b7-aeea-78aba90fcf7d", "comment": "Malware payload (Gafgyt)", "value": "ac990da2bfbf030b1e54c65354438a76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686293, "uuid": "9d207860-b632-4159-a52c-fe2caec35b93", "comment": "Malware payload (Gafgyt)", "value": "afb8d95654532019e8c8050cfda615a4926455ce55a4fb6e327c83fdb56fe76c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686293, "uuid": "925306cc-9648-4f7a-a385-c88ffc087cbb", "comment": "Malware payload (Gafgyt)", "value": "79740c37667159b8df279ef9f02b70383acde15d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686293, "uuid": "ddee0a56-e2a3-489c-bdf9-4509927aef3a", "comment": "Malware payload (Gafgyt)", "value": "933c78ff6d0adc3cc197ec000b0f2765c0bcdfdba72f1d29e9af4b026c3bb967a701baa60960da47bdb379790a046d1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686293, "uuid": "bd75ad6c-353b-4974-92ed-fc0b801c0ce6", "value": "T1E3E34909D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686293, "uuid": "22195a50-1609-42d8-bc73-c4294b4489dc", "value": "3072:ut8iFDKEfFN+Fa+1sW5h7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaNwh7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686293, "uuid": "6e3cd329-b099-493c-9607-d3c7d7e8207d", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686293, "uuid": "48659f4d-3922-4fc9-904a-5ec01a74f85e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686293, "uuid": "5c70a368-831b-4657-84d1-ec9d7359cf19", "value": "ac990da2bfbf030b1e54c65354438a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6dc1bc-c011-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706689397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689397, "uuid": "7fcfcf44-c755-4dff-a86d-648ad52d297a", "comment": "Malware payload (LummaStealer)", "value": "c4dfbbd29f479ff9d9fc482022fbc43a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689397, "uuid": "4a1d94ed-60e1-46b9-adba-190ab6efdc9b", "comment": "Malware payload (LummaStealer)", "value": "afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689397, "uuid": "18000a9e-eb28-4336-8ce7-587adacbcf8a", "comment": "Malware payload (LummaStealer)", "value": "b41a7f08625508a15c1ac085fe9fa136a04f0ed3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689397, "uuid": "7db03910-272a-4e15-ac8a-823f7f5f8228", "comment": "Malware payload (LummaStealer)", "value": "738798eab1807cee7b5a1c0c03a9bf2789a8da24412b8ba253ab714eac005f89420e0e8fcf911e2480f8c43ca578e5c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689397, "uuid": "ae2e5016-d69e-4325-854c-1cf4cae0dff6", "value": "T1D125BE4AF1EBC5BAC0550539BDA9737B14BC0E301774A2D7B7E51AEAEAF00C199F0A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689397, "uuid": "1d49c786-9650-48fb-8153-b4d8daa871e7", "value": "5da6b031617f6ee9d662f24bc6d4c6f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689397, "uuid": "6bff61e3-a844-4859-a356-3fd7a6e219d7", "value": "12288:Cab/04n458xRrPzrUBHK5fhgxFmXEP2f7K46TnSEl1yt6zzng0LNU5R37A6Dv:Cl4n458xRrPztgxoGRNU5R37J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689397, "uuid": "067f1bc7-355e-4543-b442-fa07fbaa7dd6", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689397, "uuid": "69bdb205-5abe-4c14-b6f7-2d9f4fadb05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689397, "uuid": "f30af233-609b-41d8-b386-c3039c4756a8", "value": "SecuriteInfo.com.Variant.Tedy.384846.30911.18730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b575fe-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718060, "uuid": "0e66cfa8-2ebc-4b0b-827c-798c9fa2b701", "comment": "Malware payload (Mirai)", "value": "d329fc2ba103342b9ad25fb7a0c5d5b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718060, "uuid": "62d91036-362f-46af-a2b0-ee6d0780a25c", "comment": "Malware payload (Mirai)", "value": "b00920338c96c8d5410672c4ca0b9038a3aa4502dada4e639aac3deea5f4c60f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718060, "uuid": "3e2d2949-244d-460c-96f0-228b4bd0be05", "comment": "Malware payload (Mirai)", "value": "ebe17ed598d9a2f2238056d5acaee27b680192d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718060, "uuid": "6359a9e9-7689-4397-b112-072cf8d88d2d", "comment": "Malware payload (Mirai)", "value": "465da7ad61f902709f9c8d1677f2e6801ab79ed756aee03964ce82a0ee49bb7cb3e2c12d2dbb2401aff81255dd5f078e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718060, "uuid": "0861d205-896f-4e17-99be-c924c894dc7a", "value": "T185D32A06B30C0D47D2632EF43B3F67E1D3EF9A8121A4F640655FAA899271E321586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718060, "uuid": "ee6b50b4-7031-4142-97f1-5b8c329968b9", "value": "1536:T+pzqUBe5ZHtxBVvZzpZqxucJ+w6CfDDowpMvA8vBEVYhLAMsZqKCd5oz:TBZHtxDRF04cN6GDpx8Roz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718060, "uuid": "8512cf24-4fc3-487b-b526-5a7319f854ae", "value": 133636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718060, "uuid": "7a0c46ad-e7bc-414f-a78e-105c17a8bd4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718060, "uuid": "649d39f6-bf44-4405-8315-4f340f897443", "value": "d329fc2ba103342b9ad25fb7a0c5d5b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4106b53d-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687794, "uuid": "5d281bb2-0e9b-4628-9643-984b6befb006", "comment": "Malware payload (Mirai)", "value": "5c95c8ea504c295b9bbcdb5be7113f12", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687794, "uuid": "01e85cc5-db5b-4aa6-854c-6e83d4317940", "comment": "Malware payload (Mirai)", "value": "b143df22372de88e616b14f014709e743ee5f3b22947554b601c9aa5d0129797", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687794, "uuid": "03c9d23e-908a-4e25-85af-5c70e404927e", "comment": "Malware payload (Mirai)", "value": "e2b44e07aa2173b1ce615106b15a1b6b8ae99299", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687794, "uuid": "164a62a9-06bd-49c2-b51a-5b1e105a98c5", "comment": "Malware payload (Mirai)", "value": "862bbc9ae87d1bf4f292ffddc5d5dc3dcf0c1853c092fd46242a59b9678ad82a8b8b29e46cbe2ad849104ea311af5dab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687794, "uuid": "d1979e2d-9a08-45d1-9dce-4a6b6581ca2f", "value": "T1F5E33A07B4C180FDC4DAC1744B9EA53ADD32F4AD1238B26B27D4AE222E8DE315F5DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687794, "uuid": "74e62088-2a02-4955-87ea-0163d8d8c14c", "value": "3072:1X2c5i+V0uPO9ldHcKAOu6epIL3Naogsrw/Sly97kg3j2:1mc5i+V0uPO9MOtNh2Qu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687794, "uuid": "1533421a-a939-4b9d-8245-73fe252d962d", "value": 143832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687794, "uuid": "962aee4d-557d-40f3-97ea-03efe8973843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687794, "uuid": "222c9278-bc41-4d84-91b1-902aa42454f0", "value": "bulu.x86_64-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644b91f4-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666379, "uuid": "d10af51c-ac26-402b-a6d6-e7078e199b16", "comment": "Malware payload (Mirai)", "value": "090257ea65025151f3344c16f3834c02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666379, "uuid": "c1bdaab0-1c2a-4d87-8f00-a9cfe3c97d22", "comment": "Malware payload (Mirai)", "value": "b25ccbc0f8a6aa586638f51bb3b74d05115aefa05911ce7f8f401653a7420065", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666379, "uuid": "0b61ed32-5c6f-4cfe-9c5f-618b2f710eb9", "comment": "Malware payload (Mirai)", "value": "cde65315aae83b09ad728d8d77382570fd8d9736", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666379, "uuid": "d7f964ff-89d7-43cd-b6c3-3d9398866590", "comment": "Malware payload (Mirai)", "value": "8078018c5b6e5f3560b4c9bb6d89a3c7e90efc3ae24b6d0e74f90ef38f93f15b5126674afc9cc40a83ad8a8508cf2e26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666379, "uuid": "5881c154-c735-46a9-8363-5e9882c0f626", "value": "T122D30945F9414F23C6C612B7FB5E428D3B2A17A9D3EE72039D216F60378A95B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666379, "uuid": "1194c326-2ab8-429c-a40c-9c90906702af", "value": "1536:AEu+k6NMB8N1EUlt51PglF/A+Zh4VvrbsTgEJQe1Jk2/8Fdtl8pewywmFb4uovzK:AEuZONLtXkF/x4VIMEJQejUFEwBeB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666379, "uuid": "869a2ee3-05b1-428b-8bb0-89b5449d0ac0", "value": 137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666379, "uuid": "1885da11-9d88-4765-a435-1c150ef21d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666379, "uuid": "eef4139d-2c32-4690-9de2-61a90607172e", "value": "bulu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31095d11-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706699364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699364, "uuid": "a4ca2ad0-976a-4d53-9025-854181e9460c", "comment": "Malware payload (Formbook)", "value": "fd6532ffb1af62affc4222bf1f65945c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699364, "uuid": "70198508-0cdd-409c-bae8-00e9f771a503", "comment": "Malware payload (Formbook)", "value": "b42726f4443540c3f83c7dda13ae14f39a143193e5dfb97d03ae4bec6333f364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699364, "uuid": "288f1626-6434-47b0-80a1-b7c0423be11d", "comment": "Malware payload (Formbook)", "value": "c7ed15cdd090ed112a3ec8263f1febdcf1c1290b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699364, "uuid": "a469d555-6b52-4e03-9d36-da7f5f326432", "comment": "Malware payload (Formbook)", "value": "16fe085a8f268fcd1e996c571169f4c6f84e5cfa391234491197698bcf33b67fb01c91e06f869e9f5b39a2c47dc2a5be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699364, "uuid": "f14d85cc-6e81-47ed-b9fe-cbfc6d377b3d", "value": "T1F8E4121932140A1BD69D07B5CD6252DC03B6AE393D96D3CB3DD830AEADF27C65B82253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699364, "uuid": "4bbc515d-44bf-4864-b95f-f48101e8b751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699364, "uuid": "28efdcc1-1f31-4152-baab-a3dfbc645ee1", "value": "12288:ubH9SCF1ODuHFXffni7E5pxW8j1vlTMMhhmeglhd4ZFALk24UKZecl/++m+pDE22:+H9ZjiwHPYuVcd4ZKLCVecd++m4Db2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699364, "uuid": "03fec578-e52d-43bc-94ca-c262fe42793c", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699364, "uuid": "2ca4f037-5ce5-4b34-b385-b7f54c0b921f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699364, "uuid": "a1e0b95f-f2b0-48bb-9ab0-a2ce1fd982eb", "value": "CITI BANK TT REMITTANCE USD 23,318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc49057d-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706713368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713368, "uuid": "0ddfa444-1891-4543-9a97-391cd1e46658", "comment": "Malware payload (AgentTesla)", "value": "e2cd5ca50598b25228ce8943b9001fed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713368, "uuid": "61e3104f-785c-48cc-9195-722cfaafaccd", "comment": "Malware payload (AgentTesla)", "value": "b50abf45e0678c75cfc596847eae2d069926ea34c71302a6d2904cfd380669e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713368, "uuid": "8d266c6c-91f0-4d6a-8c90-1e72b254c6e6", "comment": "Malware payload (AgentTesla)", "value": "800171bb2db120e4ac6eff614147ce168b9f08de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713368, "uuid": "409b5f6b-e291-47a5-8ed7-452bcd0b467e", "comment": "Malware payload (AgentTesla)", "value": "d525ce26a48f2374f86bb43c0a85e7cb35795e5d063100d0fe47eae113efceee3fc9bc5fd09d4239fa4f6043138315f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713368, "uuid": "8dfcd464-ae3e-4c4c-9bef-952980148cb3", "value": "T1CFF4220537E80927D4AE8279DC2552DC93B2BF3A7E15E7DFADC5308D50F2B8606A2613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713368, "uuid": "7d757e40-c383-4fda-b91f-875bc9aeb029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713368, "uuid": "101f86d9-76b6-488b-a79a-6d66bc808cd6", "value": "12288:4kte9SCF1OrdwrnwlQwqYfMO2jWhnAqHfbZ/IJ0jBuEcthXJrab+VlSQaxpa:nte9ZQWnwQoGWBAq/NHI9FJrhVlSt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713368, "uuid": "5b41ce9c-5fb1-4ac5-b373-d3ea891b4a82", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713368, "uuid": "a56ecbe0-879d-4c7f-a3a3-33e68b3d95ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713368, "uuid": "c34148c1-a93d-4408-bfcd-c92269bc02c4", "value": "REVISED PURCHASE ORDER-PSB-17398902, PSB-18384789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9774aee-c039-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706706545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706706545, "uuid": "4209d870-6e99-4117-b039-ca725e012fe0", "comment": "Malware payload (RedLineStealer)", "value": "a647afc0219638fb62a777cd2f32a4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706706545, "uuid": "24b0a6f5-c7f6-4627-90a7-c6337494e129", "comment": "Malware payload (RedLineStealer)", "value": "b5e5a6adbbb37ddc7b3aa54df9bfb61c2038d887db8f44d1deb63e64fddf4436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706706545, "uuid": "7c9e1532-9127-4593-b64a-1a9174bd62d7", "comment": "Malware payload (RedLineStealer)", "value": "ef5ad8aaac4adcf8856a939e8d17259cccb22035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706706545, "uuid": "16b8abb2-3d36-4ab8-b54f-b46b560097cf", "comment": "Malware payload (RedLineStealer)", "value": "4579c14ac9b39ac9ab1521aa77266fe72164fc07286f60ff8465ba62345b6b90ad6d77f16348ee2e766c7c9887b8afc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706706545, "uuid": "45875643-def8-411f-bd92-3477ef43e6aa", "value": "T1AE94F0873B855712CD0846B8C0E3886817FBADC736B3D7467A9412E41E437E8DE99B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706706545, "uuid": "324f2bae-d249-4222-b14f-5bbb4029cd16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706706545, "uuid": "44a1f9d6-cd16-48e7-ad43-2ae82132056c", "value": "12288:+m4gCX6Ov/dGPvf4KQyxMDZU1mW15BcnGFAO:+mkv/d+vgK3IeEqLcGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706706545, "uuid": "3b991729-1659-459c-a15f-6a6e5bebcf50", "value": 409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706706545, "uuid": "546d5882-019f-4634-941c-78826b1ec980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706706545, "uuid": "31bb8518-7daa-45ac-9c6c-332e080871a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4566dfaf-bff0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706674917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674917, "uuid": "796b0d66-d19a-4712-aaf6-a49bcb3d5571", "comment": "Malware payload (PureLogStealer)", "value": "ee5cbb1ca21a9e066deff4ade0426330", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674917, "uuid": "af4912b4-1543-4c30-a215-777f6d180176", "comment": "Malware payload (PureLogStealer)", "value": "b60b359020b150360d52a3c0f0d9cc8b6a6aceb32075cfa06b9502e25a8403ff", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674917, "uuid": "7d0d547e-35c2-42bb-9c87-1bc4f6d0c16f", "comment": "Malware payload (PureLogStealer)", "value": "cf0ac3630a81d26733e272aeeccd8b726efd0737", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706674917, "uuid": "743bb35b-cf49-442a-b9dd-8adeab1a163d", "comment": "Malware payload (PureLogStealer)", "value": "1860fd30b88ba1ac90cf94d476fca7d0a8a82d2a3e982542ab69b1a0264c87f725b6e63f25ff2c5ff8456a73189d69c8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674917, "uuid": "45e65f96-93d0-4598-87f5-ef70436a2741", "value": "T1D0C1B655B3ED9373E93A473658F3978217B4F7968C128F1E7488012B2E232941AA27A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674917, "uuid": "49d1eb65-1dad-428a-a242-df5e9118816f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674917, "uuid": "056fceef-f81e-488c-9a86-53b0b4896dc3", "value": "96:mtKQrSLYdeQ4R8F+4DPKiTpRvR7r2VBzNt:mtretRx4DJyVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706674917, "uuid": "16494958-9e35-436e-9eb0-42a450dbc3fc", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706674917, "uuid": "c4bd8813-e075-4892-8381-80db21707634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706674917, "uuid": "67675aef-8069-4ba1-a89a-e9867b638b15", "value": "ee5cbb1ca21a9e066deff4ade0426330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991b8d9e-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706715859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715859, "uuid": "6992d5da-22b3-4268-ba05-32452730b9af", "comment": "Malware payload (DCRat)", "value": "0dbcfd318bc205a56acdc58d71e0add7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715859, "uuid": "df6e301f-c286-425d-9dbf-04dfbd971aa6", "comment": "Malware payload (DCRat)", "value": "b61b1c4320db7f1ac101de2b059636b51896c2b2fae336febd59b62a2947a7fd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715859, "uuid": "6d64525d-a2dd-45b9-b744-9a6c77c7169a", "comment": "Malware payload (DCRat)", "value": "a2ab9d791c4e1459e75ff6752b98a7203bf454d0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715859, "uuid": "15e2aea5-092a-40b8-b770-be5f606a9bec", "comment": "Malware payload (DCRat)", "value": "c54b300b1680e7f2c0ce3cafcf8e1fc164882802762eccecb5af30492dbabd74d5d40bc823ef7092bef201328fe3a6cd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715859, "uuid": "e8ff7eed-6c52-456f-bcb3-2cf2a54e837a", "value": "T1C3556B017E44CA11F0191633C2EF464447B9AC512AA6E72FBEBA376D59123E37D1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715859, "uuid": "f84da56d-fa9a-493a-a0ca-20498509b99c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715859, "uuid": "48b2b2eb-5628-4cb4-aab5-412a6c64bdc9", "value": "24576:U2G/nvxW3Ww0tCavcB/rXMMxZstmU+r2MFKYj56jWdVVTkuK9Y:UbA30CxrNL1UqGYN6UDku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715859, "uuid": "8a4aaaa7-ae9e-4e23-a98b-fc1358f7412e", "value": 1344290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715859, "uuid": "36d65378-2589-480a-82f5-5d71ae1b1d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715859, "uuid": "7d238420-ca99-4792-a98c-a28990cd82c6", "value": "myfirstprogram.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef26eda-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1706697320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697320, "uuid": "616aa2e9-2907-469e-8886-9e0c4939a791", "comment": "Malware payload (AveMariaRAT)", "value": "9a6dfc5afa64b9579b0eaaa19384008a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697320, "uuid": "90c528d8-aad1-49c8-815b-c44c49c3a825", "comment": "Malware payload (AveMariaRAT)", "value": "b66c5ebef83e48811156c3499b79c798c178d5655d6448403cb070061aba4f4d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697320, "uuid": "648ae7ec-09b3-4203-bba6-bb6671c6495e", "comment": "Malware payload (AveMariaRAT)", "value": "96ad170df9b6802ae726acc1efcacf7bf4ffb0ce", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697320, "uuid": "aeea7570-fe11-45cc-910a-d757c5b06fb0", "comment": "Malware payload (AveMariaRAT)", "value": "5a6c6ce00837495c4444b0ea42a2e08f6471198d69b665f46363a8f1c2e550f727a5f8a7beb109b929a5c9f8fcc0f5c1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697320, "uuid": "85f8b9d7-87d7-456e-85e3-038800b4f2aa", "value": "T10F85BF2276E54539F226B47427963BACF81D7E3C98256DC666F4290CFF23200FB18667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697320, "uuid": "4b4a800e-34ce-409e-9e35-f49ee2934c31", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697320, "uuid": "831581fc-c66b-4724-945b-2ad6c2843fb3", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOs:gcP7HHQU72UHk7c7mvrq0gOPbQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697320, "uuid": "fadd1272-4cd7-4fd3-9d8e-2c09fc08d2be", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697320, "uuid": "add3a650-2ed0-4811-9565-43a984dee884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697320, "uuid": "9bf9cb8d-ae32-49bd-9ae5-517040f13696", "value": "PO11550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c00ee1d-c05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706720562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720562, "uuid": "959f33ca-6396-4a86-ad8d-b2d109cc57da", "comment": "Malware payload (AgentTesla)", "value": "d417bfe203bb31ec8cc510494ae97f63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720562, "uuid": "674e6b5c-7ee3-4deb-b31a-51ce22fdef05", "comment": "Malware payload (AgentTesla)", "value": "b6bf7ea5c0f0751bddd457c4a67af44ff5048a6108c57662b49ff43ec5f780a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720562, "uuid": "d395ed32-3bfa-4b19-83c9-d56d2e6c0bba", "comment": "Malware payload (AgentTesla)", "value": "c8b19097eed30101414daf5201606fd642f9542c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720562, "uuid": "9dd6fa12-cc60-4fa7-ae59-3c8a08d9e0f9", "comment": "Malware payload (AgentTesla)", "value": "24b01efe4b4cc16059411999e96a8217889ee2ebdc1bcce91cde707c9f721ad8ad2956000bf7ff3433f8574c71791465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720562, "uuid": "535c4056-e7a3-41f3-983e-eaa0cd616c10", "value": "T19934FE037E48EB15E5A87E3782EF6C2413B2B4C71633C60F6F49AE5618516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720562, "uuid": "bf45322d-0078-401e-b0c2-d27e9a969cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720562, "uuid": "f79212ab-0288-4128-b6fe-e42fc12c7077", "value": "3072:yZUn7R1BdBjO2s/o7Mu2szEr5rxEy9rz:yW7R1BdBjvvM3sInECr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706720562, "uuid": "4a7c2c6c-9d0b-4304-b55b-3b6916c1867f", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706720562, "uuid": "101afaa6-a066-405d-a42b-2139d1132094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720562, "uuid": "f5c6c3dc-36d2-4970-9f36-f69134a1d031", "value": "d417bfe203bb31ec8cc510494ae97f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accaaeb3-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706696995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696995, "uuid": "0ab8b301-40f6-42f7-ac1c-560e7112b789", "comment": "Malware payload (DBatLoader)", "value": "12b9690836625a788d3bc12b41d13dcd", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696995, "uuid": "d9acd8bc-f031-4f04-a929-09eb44df4c6d", "comment": "Malware payload (DBatLoader)", "value": "b71f049c988b45ad09977a6e2b86ddf4e33e708244df8eb5fb31f44cf51c5b17", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696995, "uuid": "4e1abed3-96b6-44e7-8f9c-0b984e00504c", "comment": "Malware payload (DBatLoader)", "value": "dd37730147b8bcd278bda90900b1dffabf24f0ce", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696995, "uuid": "ac4102bb-3a89-4ec1-8988-c7c9705f7137", "comment": "Malware payload (DBatLoader)", "value": "cd5d5b31a85c29e10f4995b398f649f76996f8feccc9e0d0d149575139b9b830ee7f24bf3ebd14a075ca73234057f747", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696995, "uuid": "9473339a-37c2-40c9-abf7-dc5e41cdc6b2", "value": "T10995F2BAE2041476D4364136C70EF7EAA85C7D2A2F2861415AFE3CCC75B9787F42A426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696995, "uuid": "b147531b-5a3a-4441-a545-2ffe1c7ef688", "value": "5f7fe181812d5942ca24024d00d9c41d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696995, "uuid": "bf22f8a5-b768-476e-867c-2c2394ceccf4", "value": "49152:FIOAjnxf2hp4XLkrhKOekUvUeudcvHaF5P0R:FI92hp4XQrhhekUvfudFuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696995, "uuid": "7ab882da-30a8-48b4-8525-e64f0067ba45", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696995, "uuid": "2db4c21d-f057-41ca-b33b-c7cbdea7750d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696995, "uuid": "29e4881d-4fcd-4a14-8221-b71e46841afc", "value": "Delivery_Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5281e3-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699119, "uuid": "05f34757-82ba-4a7b-bcd4-013d8abae0a0", "comment": "Malware payload (AgentTesla)", "value": "01e7f5bc7971e4af3370ac5420f56ede", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699119, "uuid": "24a5be4c-eae2-4be2-bd28-e28dc3dda343", "comment": "Malware payload (AgentTesla)", "value": "b80690f5312d2360d3a790392594b78aaada3ed6120d9a28300f408f286ce6e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699119, "uuid": "dc59fee3-3cef-4013-99a2-21c7b3b0e535", "comment": "Malware payload (AgentTesla)", "value": "3c8990a30530f03ad55b434efb4268070b5101fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699119, "uuid": "12d5e947-7c40-4afc-91fa-dfa32e9bd004", "comment": "Malware payload (AgentTesla)", "value": "f91f70a2e05b769b952a75895910168469e6dd93c2add3d6756682eaab47e8339af75fc4363b0f5d59cb278071a69171", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699119, "uuid": "55f03932-7007-417a-a356-a47460ded82d", "value": "T1EFE4128266BE5713D6BA0BF1947092064FF22463642BE7160DE7A4CB673BF01CB60B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699119, "uuid": "7596f5b0-3ff2-4480-b327-a4b63ad2457d", "value": "12288:2xCS5USHsVe3vEljILOto1lAhLJTJNOox5GxQ/SlH87QrVk0tJdb96/b7O:zSVMKvElBtoPgNm3lH8ek0tnb9eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699119, "uuid": "96bac299-db47-4cf9-98e0-a81c66cc413b", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699119, "uuid": "0939e9a7-e670-42b4-b107-e2ff64b1aeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699119, "uuid": "c743aa18-49ea-425b-93da-8cf52d201414", "value": "MV EMELDA - PDA_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98d6a42-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1706699163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699163, "uuid": "bf6180e5-daa7-4c4f-9d16-9788c471df11", "comment": "Malware payload (AZORult)", "value": "31730b69ca484889e8a5c1735857de26", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699163, "uuid": "80017589-1639-4d82-bf17-06a045429c4a", "comment": "Malware payload (AZORult)", "value": "b8a5f88f60837143f18dd1494a7195ac283b91d068668d1d34b4994a8148641c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699163, "uuid": "1e5a42bc-c178-4131-acbe-8440bc760cf8", "comment": "Malware payload (AZORult)", "value": "132aa2c7565cb05760ff80752239aac47917097c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699163, "uuid": "5768afa9-1ac6-4561-86cf-348e6eea3ea9", "comment": "Malware payload (AZORult)", "value": "385856e19d1c6edb697320a1c057115e5ca8cfddda063688b6ed66e54ff1d2d1f30c9f67309446d4ce10a722c4200197", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699163, "uuid": "e0dda31a-e583-45c8-85d1-9748fe2f09fb", "value": "T130D46C31B79BAC96C4190CF2515E03EF04D0E7AF166497C3E392ADAB7F2A481452B9D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699163, "uuid": "4a35c111-a20c-47b3-9004-2e3471537953", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699163, "uuid": "2f9b36a2-5a7e-49fe-9ec3-37870e91e997", "value": "12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLRpf/T:AQy6ONsqLRpf/O1/zijTrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699163, "uuid": "825f25e7-b9fc-4bd4-90c0-2f49401a27f2", "value": 633375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699163, "uuid": "3b179f72-ed79-4456-80c4-45ab093b3550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699163, "uuid": "8874b8d4-64e6-48c6-bd2a-a0efb9fe1aa9", "value": "DOCU_957735271647895846_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06d5221-c019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706692813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692813, "uuid": "917a7695-30a8-4a2a-b76e-2aea4f857e66", "comment": "Malware payload (DBatLoader)", "value": "bbeebb01a861b951d215d8ec5707df86", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692813, "uuid": "0cb0e7b0-aa79-4f25-beba-a7a6adbbf544", "comment": "Malware payload (DBatLoader)", "value": "b8c708ee66694f5cfb55084e0d54b70bc646ebb1354885bf0d730c746a92fbb0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692813, "uuid": "907cf643-ec64-48d8-9270-a0d4aefb1ce9", "comment": "Malware payload (DBatLoader)", "value": "1e8359495d252054aad3423b73b87de839cd1cd0", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692813, "uuid": "6af7977b-5e76-46f2-a6a5-3429b05c48aa", "comment": "Malware payload (DBatLoader)", "value": "e1dd04feba137c6291b9d67f82c3ace2a170e5f2823477af569fdf6ca1ca5e9b26eabb0598e991846dddab17f6abc6c2", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692813, "uuid": "66e146c5-65e0-465a-a428-0b752e3db989", "value": "T1364533E1860F94D61553DC37B00E3AD4BA762A3BDFE22622CB9D189B07713236287775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692813, "uuid": "6c3ad52d-5730-4186-a87c-a1a4b97ea396", "value": "24576:Ep0TIuq2xJQql5HKLvb04WztgTgV74JRVv6ltfxis2YFtr4wo3vUCQZcl1uu:EpVuqcJQUVKLuRgTgBWVv/s5rR+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706692813, "uuid": "a1f8817e-dbfd-4a85-b48f-72c71e5293e2", "value": 1240954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706692813, "uuid": "e6888f3e-77d1-4837-8473-ae44d809db2f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692813, "uuid": "3ce52be6-a1a7-4782-8889-f065bb0516eb", "value": "INVOICE #202331056.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c2b558-c02b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706700529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700529, "uuid": "31080d01-1158-4839-9994-1e7119bb59a1", "comment": "Malware payload (AgentTesla)", "value": "3a03f2b8543956361e40d28834cf8e8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700529, "uuid": "676e28b0-0815-43bc-b5d0-e4375e84863b", "comment": "Malware payload (AgentTesla)", "value": "b9bdcab4f58d73a3100f4fbf8a8e27fa7c1da6feabedee89a92def5f326e9051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700529, "uuid": "a0784cc9-a9ab-41fe-9c79-c4327141e0ee", "comment": "Malware payload (AgentTesla)", "value": "57502c697e2bb03720ec1850516eeb3ad55bdf31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700529, "uuid": "6c1521d2-3c59-4f1c-b4d8-974aaae1811c", "comment": "Malware payload (AgentTesla)", "value": "b8b48190b3db817dc2dc2e161d3ccc849406d1d82a3daa005c2a9faa4267ee24b3ecb103d49f6f562c6e3195397555cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700529, "uuid": "eeff7ee6-3732-49b5-a7d9-55ad2bd99347", "value": "T179D4E02513F9522CF6721B30FCFA90E95B36FE0A2E14C3AF1552361E1E73B41566272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700529, "uuid": "243a950d-7b7e-4c19-ba2f-cc7fd8ee5481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700529, "uuid": "293dff8b-3abb-482b-91f5-917df2b961bc", "value": "12288:poqAzAbIYxxKkf9q59QZKXgMbzkIOTZNN2xu9qa/hQ4sMTa+//Tu:poqAzAblxRfs59QRMWlNN2E9rFFzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706700529, "uuid": "993c9126-da21-48f8-86b3-76bdbd058d62", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706700529, "uuid": "c16bcdd1-de9d-43bf-8b3b-626548df51c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700529, "uuid": "e257c7f3-7dad-4172-aeb3-9ec1daf643a0", "value": "3a03f2b8543956361e40d28834cf8e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbd4d48-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718067, "uuid": "4efb9517-9670-47a4-9bf2-3291d62e6d32", "comment": "Malware payload (Mirai)", "value": "68adfd42fbff3a7ca980e37e867c53e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718067, "uuid": "0c5af1b9-72f5-41ee-bec3-f5592f0d0a69", "comment": "Malware payload (Mirai)", "value": "baa9e49cf94d999f80e490d151109761f37c361a55de5b3049f8f203cfa681f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718067, "uuid": "e98424aa-e3de-41e9-81ba-64b82cfa86d6", "comment": "Malware payload (Mirai)", "value": "ecf6f1c3c4b329af1c27749e7b03f27fb3de5032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718067, "uuid": "11a58922-9ad2-41a3-9089-f7875ea3f61e", "comment": "Malware payload (Mirai)", "value": "78175a371c52a74fddfb0f8de7d4ce09e1cb57d5d33a30088538bd8e6976f84cfd3b0fecbd4a089f87bcbb53b058dc95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718067, "uuid": "00396dfc-ffc2-47e6-9001-8c5845660236", "value": "T123E2E135DF02D5A39E60FC7196A4464A6C3219BC82FF25723A6242D430F7A47A3FE45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718067, "uuid": "71c867d1-6a98-49ea-a369-55bd548f956c", "value": "768:FUoXp+q/0IwD0A5RkGm7LdC0ZIgQdnY9q3UELjg:FpXpVcIwD0y9Ik9LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718067, "uuid": "1536efb2-4dae-4673-aa87-c2679eb10322", "value": 32212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718067, "uuid": "8d5c784c-6c37-4cd8-97ba-0a882dd2c8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718067, "uuid": "c4d6044b-19c2-4ada-85cf-77f40e28db6b", "value": "68adfd42fbff3a7ca980e37e867c53e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76bbeac-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706678544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678544, "uuid": "e9e8f3e5-fbea-4e39-bfbd-0cad5141f70b", "comment": "Malware payload (Mirai)", "value": "a8b0ee02ec2c0ca571625ec2aa8f4e18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678544, "uuid": "0b0c6595-fcf1-4eea-9cc2-6870fc77506d", "comment": "Malware payload (Mirai)", "value": "bb5c408b8ce590ebbd040818ab4a6942c4afedda7e06f31e5ba01354a42c53ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678544, "uuid": "49a19e1c-a4e4-405d-a941-b753f4ab8cdc", "comment": "Malware payload (Mirai)", "value": "c84e06ae95f28134500d3ebb1b30713db5dceaab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678544, "uuid": "1ff675ba-f9a1-4aad-b013-109b15042456", "comment": "Malware payload (Mirai)", "value": "74dd221f465036d3570c221aedde1d380dc5addf0e592e220b01b03999dbe7bd368de68c00da9a5b9f1c321a8dbc7c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678544, "uuid": "4667cd97-babb-4b44-b92e-4ffc3ec3095a", "value": "T1B123E1AEE0DD160EE539F06638C99B826BF1DE1586038FC2B3D59E425B6241FE354CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678544, "uuid": "41eb38ea-2e9b-4952-91f9-0c4f8d4c2bd4", "value": "768:GPO2jUBYNHUymP1ZZabAZAwJAVMpPW62ordsKM9wx5OLA98GPy04uVcqgw09S:IMOHUZYAZAcAVT8d4u+qgw09S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678544, "uuid": "549a0b8f-3e08-434d-85cb-db5ff72bf473", "value": 46708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678544, "uuid": "56fa0e83-bda1-4400-aa10-36901addd138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678544, "uuid": "0c343564-c620-469d-a978-a354785e7fd4", "value": "a8b0ee02ec2c0ca571625ec2aa8f4e18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6993fca1-c07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706736395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736395, "uuid": "75b674fe-add4-499e-834e-d071e8bb1b7d", "comment": "Malware payload (RiseProStealer)", "value": "a16ae21452d2bc3fa746b98858e504c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736395, "uuid": "00f63b29-fc37-45c3-9b17-4eb808c2938d", "comment": "Malware payload (RiseProStealer)", "value": "bd2121f85a4f7cb088c427636f6fed7e02ed42d94e568f6de376be1774885fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736395, "uuid": "ac071c8f-6fa0-4f65-bef5-13711633943b", "comment": "Malware payload (RiseProStealer)", "value": "2719a638efd47cc5db565a8fe2b9b0f109845da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706736395, "uuid": "c27d241b-b18f-4467-b75f-c0098ff21413", "comment": "Malware payload (RiseProStealer)", "value": "df1d625355dfa79fc82cefbf784552bc0e9e1a1170052bd45b38735ae5c3c7bb044a1f9fc1a625d912b19028ab2ce75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736395, "uuid": "7f83fa75-c5d1-48a1-a95c-4fdd743fe0b8", "value": "T1A2B533E92A3A90A0DC1F177DD216715A4DE7BC1B044AA32F03E1F2980FFE4B59157E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736395, "uuid": "1069883e-1c08-40ee-860c-0a8f85627f59", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736395, "uuid": "974935cb-3118-47da-836f-55b5ff99cfe5", "value": "49152:usJajYd6fpPfzz5lmFhSBt6jG6fyriTqxUmUSbWTdpY:usJSfpzzaE4jGGyJxUmQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706736395, "uuid": "86ac591c-8de4-4bd1-8b83-42702da62131", "value": 2297344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706736395, "uuid": "0e6929e4-16e8-4544-bbb6-85b16fbd7254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706736395, "uuid": "e08013a2-4686-45ab-8448-262df63106ae", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e9d737-c045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pushdo)", "timestamp": 1706711685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711685, "uuid": "cdcb42cf-2877-4f3e-a5f9-97180b557fef", "comment": "Malware payload (Pushdo)", "value": "a92eecf0f9e2a03bb9a5554828f6f013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pushdo", "colour": "#B44DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711685, "uuid": "a7fc4234-8001-4fc8-b913-37685e5db68f", "comment": "Malware payload (Pushdo)", "value": "bd55838fd63728855d0d248b66d82083e10847172a32ac5fb98b9d200f8f8286", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pushdo", "colour": "#B44DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711685, "uuid": "b1772f8d-42d9-4799-84d2-d53e5ed80a93", "comment": "Malware payload (Pushdo)", "value": "0c1f41547db34e0711978d7f8d602fd2518e2103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pushdo", "colour": "#B44DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711685, "uuid": "c9b39cef-9617-46dc-ac34-607e8df317a3", "comment": "Malware payload (Pushdo)", "value": "9fb4e150bf5ca3c96cbd4f03a28a099af58519bcf6d5bde5ac89925b5b161c8f45b3f6a4a1629ad7112a34261c9cc164", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pushdo", "colour": "#B44DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711685, "uuid": "a3e382e0-e1c9-4827-9ff6-70e1ae3ac051", "value": "T1B0B5BF93F5687E72C1B89D7B832A401CCB18606B8F824B15B54FB1AD7DDB186BC60F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711685, "uuid": "43e739a2-3a93-447f-8660-b53690f31239", "value": "4bb1d4117812caecf3964e4cb63d4bfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711685, "uuid": "e69d9dcd-0c1e-4b75-b196-ed603826448c", "value": "49152:exwjmesOEIJVdIOwPHwwYZRYEoWLQV7iv/nPVQMkiXrqaM1Ex:iwpIPfYZRYEnLQVuv/PVQaqaMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711685, "uuid": "492a23f6-28be-4bee-b497-65216218daa5", "value": 2385920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711685, "uuid": "bc845039-cbaa-46bc-ac7b-b8fba6002916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711685, "uuid": "982967f1-a0e0-4492-9e91-83f14a412e40", "value": "a92eecf0f9e2a03bb9a5554828f6f013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a2c7ac-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699459, "uuid": "c51249e6-fd85-46e6-b1de-19ba1a3633ec", "comment": "Malware payload (AgentTesla)", "value": "fb38cde653b7f012cf096af627f271b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699459, "uuid": "a5ffea51-221a-492b-bc8d-91436c4d7408", "comment": "Malware payload (AgentTesla)", "value": "bdabb2cf81de8a6b0407b73a4711ac1d489a580481a3d10a2b0218b4fd2af488", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699459, "uuid": "6bae02f7-455b-46f6-a07b-b557e53d644b", "comment": "Malware payload (AgentTesla)", "value": "532b1db51b68c640e95543a3c721f8516e1de420", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699459, "uuid": "e0615165-b5a5-4184-b1a4-cec3c87d0592", "comment": "Malware payload (AgentTesla)", "value": "423234eafd07e29207092140d486fa7cdb2bf054f228cf0142561f5a195a37e83f90f3823098e1bf0769168dbf792ea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699459, "uuid": "f0f98cdc-c25a-4cd5-8336-7212f9eacf61", "value": "T1F9E4124126FD5F22C5A90FBA906055540BF3B94364E2F78E0EE1A8CF1727F054B92BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699459, "uuid": "00e1a7c9-eb59-4668-9a01-cffd3797193c", "value": "12288:uE9S5USHsVe3vE7pQlPFvneG0EmubP2Cq8BtWQHeHF19w5zqsmAfcBeWgik17:7SVMKvEaPcG0EmuKCLtH29w5WgcBeZiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699459, "uuid": "eb981083-7746-4b1d-b27d-77ca9e4f7a67", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699459, "uuid": "483927fc-c2b0-445e-8fb1-8fc193c7b3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699459, "uuid": "934abb2d-b946-403d-85be-6e96f91f5d1f", "value": "1364 No'lu Sat\u0131nalma Sipari\u015fi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ca367f-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706699511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699511, "uuid": "66b90865-4265-4d10-ab1e-855d8e654853", "comment": "Malware payload (RemcosRAT)", "value": "b4dbee524d43c3c34067a06c1369ca4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699511, "uuid": "245cb83b-6100-4cfb-8fe4-01787dad13c7", "comment": "Malware payload (RemcosRAT)", "value": "be58907253b68299ffaa7d7bb9104e1faa2671ddd6e18f4b53261537895c87e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699511, "uuid": "ad15ec3f-8008-4899-aed0-9ce25600bce2", "comment": "Malware payload (RemcosRAT)", "value": "876a7dac1cf8b3e2df468c83f09ec872ce6959d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699511, "uuid": "a24f9ba3-bf27-4248-ab4f-bb4cd60251f8", "comment": "Malware payload (RemcosRAT)", "value": "6bc650aef16bb1a77550c3b8c36c8f16b7153661a7c8304353ce9dd4e5bf9b2d7efdf12d8cc89465159f96c6b7dca491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699511, "uuid": "75aacb15-d728-4cea-85c2-0c1b0d302927", "value": "T1FA75590322818312EE5E9DF23AD6A2534EF95DD6012297DE035C3F6DAB3FD6103E9652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699511, "uuid": "d1f222a5-4c61-46db-8e36-57109b3000a0", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699511, "uuid": "d6ef6766-8acd-4cb4-99cd-7a34adc92123", "value": "24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8alKfrTa6w1qOoxQLSE:VTvC/MTQYxsWR7al4Tjw4FQLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699511, "uuid": "27617ccf-82f7-4a76-a252-a93321745096", "value": 1565696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699511, "uuid": "d4546923-bc68-4d7b-b3ba-0495d2f0a0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699511, "uuid": "ec3840c6-ca37-43a1-b353-8194f92e1cd8", "value": "GHA000900098790000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf28aa6-c04e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706715300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715300, "uuid": "88c5d273-f607-46b1-87cd-aca2be5fe5a8", "comment": "Malware payload", "value": "48eaacbfa74c16dddfe376c45a713f70", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715300, "uuid": "3d06fed8-0a54-4ef3-8fd7-6b12f305fb74", "comment": "Malware payload", "value": "be799e054c367305fe226d4e1ee96bb57f2b0415d5e1fcdbe6a150fdcfde6672", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715300, "uuid": "0bd17c90-c014-4f26-b854-bb594de4c827", "comment": "Malware payload", "value": "7069b74953b927df0e49bca56444c23abccdcc53", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715300, "uuid": "6d44e62a-59f4-4fc2-96b1-dfa628e5dcf7", "comment": "Malware payload", "value": "fbf81af5447de3357764180f0436f6cb4d579634165e7beabd03ea897c146aa1c6542fae8e38fbb46f7e354dc3fd6df9", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715300, "uuid": "85b25436-1412-4fae-89b8-9ed1fbcad9f4", "value": "T1FB54D055FA818646E45193714DF74EEA6325FC416F634B0F324CF72D3EB02A42E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715300, "uuid": "69df62d7-ffc4-427e-9ed2-c8c9ce93d752", "value": "6144:pWunhUY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVHDMIl1JRbj4X6GPFLFPaL:pH73bVHDMIlbpytQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715300, "uuid": "c4f723e4-fba9-4eae-9a6f-2be3d2e57fe6", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715300, "uuid": "1721fb6f-2865-4c98-bad2-dfa7fa392c98", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715300, "uuid": "0aa2d4fd-f480-4878-aa90-945b8ec7d36d", "value": "2024order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67a27f4-c049-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706713412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713412, "uuid": "daae8f76-692a-462e-96b2-b519017005a9", "comment": "Malware payload (AgentTesla)", "value": "4000d5e46cde56707f790809b10b104a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713412, "uuid": "b0e9dbdd-b7f6-4ca5-99d8-4ecfbb5c2322", "comment": "Malware payload (AgentTesla)", "value": "bedec473c4313ce0f0ee5ec648d79994c7d00acec201c032699a5539176dc4eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713412, "uuid": "63090e03-2d4b-4442-bb1c-5c9a4c36eb83", "comment": "Malware payload (AgentTesla)", "value": "e12b0960b0d84c2b0aa5e1e65346d589a3c6ee25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713412, "uuid": "6e9b3206-1509-452a-bf19-cc3591f704fb", "comment": "Malware payload (AgentTesla)", "value": "b49214362948a8a0d303e4466fc3756d1edfa46654d55376350e5ee5a714e6676e35e602cdd22237cf7dff0864dbada8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713412, "uuid": "07ca80ef-9ebb-479d-a4af-aea9dce3cffb", "value": "T110B412856788036ED8F512B37D7BB6952B38FA2A9552931E38FC631C0BD7B0449137D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713412, "uuid": "798c37f5-53af-4890-a96d-e95c2456185d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713412, "uuid": "4b530d4b-08ca-4bed-91d2-86518894878f", "value": "12288:yr0elz8bBo+llaxKQ5Kub3+CCgaRJFAzTKVLvGAXEK7ks5BOG:yr0zllaxKQ5KuyDdPFgTKZvGAXEK7bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713412, "uuid": "fa468595-0bca-4c74-9f13-78204d23dbb4", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713412, "uuid": "ec29f1c0-7025-4221-87df-d8b0f1d52f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713412, "uuid": "400e005b-bd74-41c1-96cb-f30ab6efee50", "value": "soya crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51683eef-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1706698559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698559, "uuid": "455e58fb-b4e5-467e-bd0e-7bcbf21d0b0d", "comment": "Malware payload (DarkCloud)", "value": "ac6fd0f0f2bcfa03f46c363d528ab415", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698559, "uuid": "bd9452b8-e0a4-4061-be87-06c230862183", "comment": "Malware payload (DarkCloud)", "value": "c10806d1fce24b546157417fd11f3159950d1352b7f03e819e240ef1109f657f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698559, "uuid": "104107ac-bdb9-4b05-a7e7-1e5d7d6895af", "comment": "Malware payload (DarkCloud)", "value": "27c24ab804da3b0e9436d7a4b305dec447ac3fda", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698559, "uuid": "c00c7735-c264-4205-aa0f-115d95bdbd0a", "comment": "Malware payload (DarkCloud)", "value": "a51cd4a22a6160bfa910be296245f77d1facbb191eb32ee8dea675929f4b3c187d87e5072e99a3305ba2d32091473a65", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698559, "uuid": "23c5da0b-236e-46ee-a23b-6acbfaa91fca", "value": "T1709533915C290A14E48B29A83683501F77E6C3DD8D70954773F6FF1B8EC0E6EA563B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698559, "uuid": "0affb0c9-80bd-4099-8232-09d7a22ac8a5", "value": "24576:rrhykVbxocwziacBxtQjlwmStvTTbVK4T034Tm20DQqFabxocwziacBxtQjlwmSY:r3zw5pAJsCmJQYmzw5pAJsCmJQYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698559, "uuid": "73de5417-6fd2-4f96-8464-9843dcd583c4", "value": 1919474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698559, "uuid": "ee9ea794-5f34-45d9-be75-5882d2955204", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698559, "uuid": "0259d27d-bc4e-47d7-98f5-b00f2caeb673", "value": "Ziraat Bankas Swift Mesaj.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aad51c8-c016-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706691193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691193, "uuid": "8affd5ee-f8d6-437b-9390-57c9c388ee1b", "comment": "Malware payload (LummaStealer)", "value": "e99668f0998dc41d57f64a6ce85907a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691193, "uuid": "574401e3-2ec6-4839-9591-7e4426252bd5", "comment": "Malware payload (LummaStealer)", "value": "c16bf9505630345175d31e3ef76cb52045111890849aabc7624cef9e74e35dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691193, "uuid": "e4b70406-e792-4852-a12a-5101b30816a0", "comment": "Malware payload (LummaStealer)", "value": "9c38d5cf5846c9b2ffce3e92a9dd08033349e74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706691193, "uuid": "747e3c01-4198-4fc8-81d4-210076e944de", "comment": "Malware payload (LummaStealer)", "value": "96b3d0d221ef321a841fba5bcf8968234baa5dcd797a80ffa33a81eb57e5d0be7ae77326145a721baf3cc4c76eb2102f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691193, "uuid": "ceb2d402-d60a-4d77-bbc9-e7f39e63b213", "value": "T165D41296B6800B12CA0889F9D1E7B06157F399C353B3DB8A3E4401D78F55BE4DE89B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691193, "uuid": "101abded-135f-475f-a6f1-48079975c3f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691193, "uuid": "b0c6d8cd-7572-42ca-9630-022300fbb70b", "value": "12288:oip8ewQcsb+VQBvLzHf5dbmZxPTF4S+H+tgrPqqGKDRJ0mtW/W:oi36s1tHjmvSS+mvqGKkfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706691193, "uuid": "ac63df62-07de-490e-aa56-2c9f7df45dc9", "value": 645376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706691193, "uuid": "572c708a-c6ab-435a-9248-a54977c17fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706691193, "uuid": "d29d4cc4-7213-4177-a695-d630ae907ee5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5720f7c-c021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706696123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696123, "uuid": "c7c9a90b-aba7-481a-a7e7-60422bc8c816", "comment": "Malware payload (AgentTesla)", "value": "d5db278022ed65897b767ea869625504", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696123, "uuid": "3829e055-0a35-49f3-82cd-923396dd6981", "comment": "Malware payload (AgentTesla)", "value": "c35aa759567411a50ef8158734675d343e228178795958172fcf21227c549515", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696123, "uuid": "743c1f74-45ef-4cb2-b7ad-dc082bd0b296", "comment": "Malware payload (AgentTesla)", "value": "bb5f3cf594f61097dcc76723359267503e5780a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696123, "uuid": "92a0ae8e-fc9e-44df-98aa-83b7c46fe660", "comment": "Malware payload (AgentTesla)", "value": "d6e2513aa7894a6359531d805a1f9e3bbaf19ed00bdbae0cb9f0baad5ceb092d74091a3f43a4202818a08b184110692d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696123, "uuid": "7be4cf41-6b56-4a4a-b7b7-93d0ca418ca3", "value": "T112F412047BAC0967D86C0BBADDB443DC97716E113E96D38F2CC930AD6AF3B865661603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696123, "uuid": "92582566-20ef-466e-9ae0-d1bc779811af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696123, "uuid": "efaf5216-38e3-4e96-b750-12c080dbd0e6", "value": "12288:c7s+9SCF1O/FJyqK1yTNsXrQer7j+leRluEQytPpDdt5WKV8i:os+9ZSD/TNssvwuEhtdrIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696123, "uuid": "b155140e-2c66-4223-b086-a4a6d25e98f2", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696123, "uuid": "6a311b77-37e3-4d4b-9071-5d51debd7a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696123, "uuid": "b0916684-4ad8-43bd-be5d-4425193813b8", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c34f809-c03c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706707516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707516, "uuid": "94c0c631-cadd-4bac-b9c7-51cef905b719", "comment": "Malware payload (DCRat)", "value": "a780934c5fbcef8af3f262427fa88402", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707516, "uuid": "a86b6dc0-5f8a-4986-9aba-cd137cafd519", "comment": "Malware payload (DCRat)", "value": "c48bd775f5f4e009808c69218bf1196f9d802afd2c188d5eb857ba49b6ce1f06", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707516, "uuid": "4f44249e-c4ed-4ba6-b3b1-b33fbd6eef34", "comment": "Malware payload (DCRat)", "value": "320bb4fc7be97f9cba72804d420e62c75c29b8f4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706707516, "uuid": "50b012e4-4805-476e-942b-aef8bd0dbb3e", "comment": "Malware payload (DCRat)", "value": "ede632d36fc302751058b52d768e107f417c82705416b7e97e71dff37ea505951266e653bf87f6fa878b3d2d5a056593", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707516, "uuid": "3bf885b9-105a-46fe-b087-5dcbe4455255", "value": "T1CF758D06B9518E37C2683F7285D7401D82B1DA257662EF0F3B5F10DAAC2A2309E775B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707516, "uuid": "7b24c015-c71a-4f15-adc4-a3844803929c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707516, "uuid": "f100fb42-224e-4d21-8b52-e65fee781d73", "value": "24576:Qru1DfhcpFsNXmCgKGFRZY2uMJZAXHpKtvSF7:QrkdcpO0T2XHsVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706707516, "uuid": "6f1d2bdd-da6e-4319-bdd4-2c0e3ea2d4b0", "value": 1653760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706707516, "uuid": "26d3b855-0ba7-4fb3-9e6b-a12f68ce1d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706707516, "uuid": "c7a4cf24-ebc5-44b6-a50c-97c93808b12e", "value": "a780934c5fbcef8af3f262427fa88402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad45124-c088-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706740236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740236, "uuid": "33423706-81e7-4f5f-b3dd-b2fd4e8d7713", "comment": "Malware payload", "value": "15a9d8defb55dc7124128453c630e43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740236, "uuid": "d527db0b-dd8d-4ffb-b49c-4e136c6bdd8b", "comment": "Malware payload", "value": "c5458d641be35434cf7972313363dc9c47e607b4c1d90f3808e75ed46e14ea83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740236, "uuid": "c3295d88-b669-4c9a-b4a2-6793fbb01dd5", "comment": "Malware payload", "value": "7ad7fa8cc23dabdd05f472422f63e32f9ce0c658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740236, "uuid": "d9d07cd0-a7e4-406b-b031-9196c660d8f3", "comment": "Malware payload", "value": "05609c7e0aad5a710bca6300a3d3e8530ce3997f846f4bb37c8b91ae76e2967d3b51f0851e678b95f145817f50567990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740236, "uuid": "2355b8f1-4def-4557-a6b1-4749602a1a82", "value": "T1FDD4124776C54223C19859B5D0F79A6A83F7ACD72B73DB893B8800E60D827D4CE8D785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740236, "uuid": "3bc47f04-94fb-4bb8-ae10-0c38a5f5c36a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740236, "uuid": "0438f962-367a-40f9-8373-5b7fee56e296", "value": "12288:kfPIybDEH4dDfjlQwzgtPnbz02QKBYvmFJxdwgmMA0ozTN:ktDEHgfpQwEpbVYWjdwfMAjzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706740236, "uuid": "399e2d1c-c288-4113-9b1f-08195edfb198", "value": 646912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706740236, "uuid": "c7377fa0-81f7-445f-96d2-b4a2bfd32ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740236, "uuid": "89903936-3975-41e3-b62e-ab5b721d1352", "value": "SecuriteInfo.com.Win32.TrojanX-gen.7731.24714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ccdbf2-c065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706725355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725355, "uuid": "5a73ccb1-2a5f-4133-a4b2-45452501ddec", "comment": "Malware payload (RedLineStealer)", "value": "57e2569a0440de505c1ce7915cbddbca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725355, "uuid": "2b7ceb9b-d371-4a77-9d2f-54371dc163fa", "comment": "Malware payload (RedLineStealer)", "value": "c71c615d8421e750c1df058e0ec4e63f1100ea0787a3d45bf7d66209cd24ebad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725355, "uuid": "fc89f117-715a-4925-8f90-5fd7b49a9cb0", "comment": "Malware payload (RedLineStealer)", "value": "d7b4aa07da83d18cb4f70c3b0a14993f5cd59a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725355, "uuid": "11da0c11-abec-41e6-a343-138b830b8f4b", "comment": "Malware payload (RedLineStealer)", "value": "474b05a50243315a46f2e0941e5902844b435957a8aec3678817fa18287ace7de54e8f6ec02387a0d1b8560145bf24b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725355, "uuid": "9f335d26-697e-4b85-a063-d50626be8efb", "value": "T19755AE0273D29066FF9B92739F1AFA41667D7D285433842F23643DB9FA711A2123E217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725355, "uuid": "ee3a1969-e65e-41ec-afe9-6b2c0f80123f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725355, "uuid": "cd4afb9e-45b8-4585-8408-e574e7aec256", "value": "24576:fAHnh+eWsN3skA4RV1Hom2KXMmHas11cKJ8ZZSFWd+0qW5:Ch+ZkldoPK8YaAcKJ0zEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725355, "uuid": "c7a5550c-d389-4986-bc26-c2d96b8bb284", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725355, "uuid": "a6f2be3e-6e86-4e3b-96df-2606c1794826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725355, "uuid": "bc810ded-e581-4662-ba46-67a691acc31e", "value": "SecuriteInfo.com.FileRepMalware.20076.18498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716dc7f6-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706699472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699472, "uuid": "1a4072a3-0bc9-4d69-ab3a-b85907b5bc15", "comment": "Malware payload (SnakeKeylogger)", "value": "8e94412b2dffeae1c742add73009cf29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699472, "uuid": "2e7f0531-0973-495e-8d37-f951684b982b", "comment": "Malware payload (SnakeKeylogger)", "value": "c7362845283503e1538fd1c4ba224becc55c213613c30684fa790cd6f99d2094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699472, "uuid": "d3640fce-2669-4395-a557-eb20fc5fbb08", "comment": "Malware payload (SnakeKeylogger)", "value": "e26c12105aaf9c2e35647dc4e7e400812144f1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699472, "uuid": "1213e4d8-8578-49ac-a09f-b77a925a5d54", "comment": "Malware payload (SnakeKeylogger)", "value": "f346871466acc97520362e5020eda344ea9e4323898ab5bdc77cf205e60371e889ab03cc19d22ac11df08c9625f39693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699472, "uuid": "18c20cdd-5183-4088-8fbe-3f0e75abee33", "value": "T1F3D4121837980967C9AD89B8CC6112DC4372AE267E46D38F1CC830AE5EF378757D6663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699472, "uuid": "5b1dbe5c-9f4f-4467-9dec-834a38971440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699472, "uuid": "bacd0a88-1a1b-48d5-9c56-5ce34afba0cb", "value": "12288:UTI9SCF1OxyQQB8naJ3f2e0wfJ5nqtk2KJfY4L8L5/:gI9ZkyQQEaZf2TyJ5nqo58L5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699472, "uuid": "a6e31306-e944-48b6-84e1-537e59484c98", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699472, "uuid": "e0ccc70c-e9f1-4f32-b88a-42d4e0f13c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699472, "uuid": "bf57af64-0dbc-4506-b13b-b9e7c7546ba6", "value": "SIPARIS-290124 (619 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a32306-c043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706710507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710507, "uuid": "1c414ca6-69b4-4888-bb18-6729b8b0818b", "comment": "Malware payload (AgentTesla)", "value": "a8fe83ceff2422c597a4cd496e883b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710507, "uuid": "f3c80b81-9740-49f6-8f07-398780ee908a", "comment": "Malware payload (AgentTesla)", "value": "c7e758fd23e2e8806a99e41d5c69d17450e330e69d4ab0a911aee9a878128eff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710507, "uuid": "89265e62-5be9-4cfd-a2e8-957b4da549d6", "comment": "Malware payload (AgentTesla)", "value": "00eb0086562f30ffeb3fbc3a83749ccb9ada3e0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710507, "uuid": "c5108fe1-1712-42ee-84e1-8b3aa1871508", "comment": "Malware payload (AgentTesla)", "value": "c1d4577615a2c6f4b872c0e47d6a900c58ed3213e6c0d50a14f426e4804a5e702c40adfc65cdafa6387d54e19893e9a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710507, "uuid": "bbebb84a-6438-452a-9f59-1ebcf7f6f72e", "value": "T17C558D027391E0E5FE9E91774A56E18545F86A3530338D1F12C4197AB8FF1E12E2EEE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710507, "uuid": "20bb4dd0-5b9e-426e-b44b-3a81d22d14fa", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710507, "uuid": "baa2c69d-2341-4f2c-a7ad-a9756cb84c1c", "value": "24576:oAHnh+eWsN3skA4RV1Hom2KXMmHa9Vz0lcHfikuTr5:vh+ZkldoPK8Ya9Vz0W9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706710507, "uuid": "3da6ca3f-b6f3-4fc8-a7f6-59bb3e387f94", "value": 1314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706710507, "uuid": "6491a450-40f1-4d62-8001-9999ec759d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710507, "uuid": "6a3954f7-92d4-49b8-8f97-a9f4f900f1cd", "value": "Orders___________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c057ed-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706699152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699152, "uuid": "af193843-c930-4711-9700-d95a120d392b", "comment": "Malware payload (GuLoader)", "value": "e81bbbc6e15f892b13dca30949e410be", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699152, "uuid": "3130cfac-efa8-4969-b027-06c518dca530", "comment": "Malware payload (GuLoader)", "value": "c91fc77e76bb42388ccb17099d3dcbbc30667f67f4628a875dd64467740a8704", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699152, "uuid": "e8276bd3-70f1-4371-a103-99d63478f3d4", "comment": "Malware payload (GuLoader)", "value": "ea044bd409ddc837eb3e656ac14678c23c42f1a5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699152, "uuid": "e9d3b3a2-11a2-47d5-a825-5dbcc48f06ee", "comment": "Malware payload (GuLoader)", "value": "3cf151f6335e41753b67029b9da1edfc7efb521f2af9e5b689d5da1fc7bb130180d948b050a44de5c5c017b87be814c4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699152, "uuid": "a360647f-e2bb-4716-a54e-778e39f0e8d2", "value": "T131D4F1F2B5408142F82F34BF183A5D5693E42D6986CC664E324DB66EFAB31D30D27A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699152, "uuid": "8ba5f49d-974b-449e-8475-91a0e8ed4c75", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699152, "uuid": "128065cd-21a7-47e7-9479-8ef3f91f1ed9", "value": "12288:hhNMKBSfLJ0//L0122/nqHgAuJIt+0dIpnmi3qU65DUs:hhaRfKT8hfqHyIZQn/t65DUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699152, "uuid": "02d25e98-7367-4595-91e6-b2559c40e381", "value": 638232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699152, "uuid": "3747bb35-440a-4cb7-8b79-76cad7320162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699152, "uuid": "c0b93f3d-c132-496d-a41d-4eae35296674", "value": "DHL 7214306201_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7740524c-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706699482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699482, "uuid": "30da2aa7-5876-4efc-a93b-495b488448db", "comment": "Malware payload (RedLineStealer)", "value": "82f1b498b57ecb7337b96b55e25cde40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699482, "uuid": "009ddc62-2b3b-44bc-a332-6ce338a81964", "comment": "Malware payload (RedLineStealer)", "value": "ca18c48f38c1b99ce538bf58227025162223d5d4848ebcda1e562667acc42c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699482, "uuid": "821790ec-4696-4c40-b165-5af6877b94e4", "comment": "Malware payload (RedLineStealer)", "value": "9f647d956dc08661b9bf138aeb52493a65473380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699482, "uuid": "6ad2f894-2fdd-47a9-91f9-f8b1e9326bbf", "comment": "Malware payload (RedLineStealer)", "value": "3ec43d2c3c5a1d20ef59297bc120d74a66cf8fdc0c18960e48abb9228d81f680c854608b2e16069b386d83212c2f1172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699482, "uuid": "44490835-75d8-429b-888f-da485e72c880", "value": "T1DC55260363958325EA9E9DF27AD5A2434EF96CD4002287DE134C3F6D6B7FD6113E9222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699482, "uuid": "49b65471-6f8a-4b89-b8fa-81e95bfe6d3f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699482, "uuid": "de6357b0-bc8b-4a14-8417-a1c1adfaee0b", "value": "24576:wAHnh+eWsN3skA4RV1Hom2KXMmHaZpPRjCDJdj5:nh+ZkldoPK8YaZpJCDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699482, "uuid": "5f7c524c-0117-41f8-a03d-2b4ffae66de1", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699482, "uuid": "f75c0e3c-021c-4a1e-a9e3-214a2dfc436b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699482, "uuid": "a03a55ae-56be-4877-9240-2a648f1153ae", "value": "30.01.2024 \u00d6DEME EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a7650a-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706698571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698571, "uuid": "d08191fe-a4d3-4a78-be22-10ee32288f65", "comment": "Malware payload (RemcosRAT)", "value": "cdfbe77a180b4e799beafae1a7443818", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698571, "uuid": "14b6404c-7edf-43c0-b725-c57d981e973a", "comment": "Malware payload (RemcosRAT)", "value": "ca4a2396576dce6beb4432d989f83bf0715b43ee9e7c4521921dbf488d613695", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698571, "uuid": "cf8994b2-bbba-40c8-9891-9cddafe38346", "comment": "Malware payload (RemcosRAT)", "value": "5d7d31629e8f46169dd2560b787e558ba833c7cc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698571, "uuid": "38252037-1955-49d6-8587-c6e44def9e50", "comment": "Malware payload (RemcosRAT)", "value": "69455f0eade3bb03ee48bab705e66a713d2b0d2259e76b0e8069c17f7d7ba5f0da25296f53101fa75f42f314dedac6f9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698571, "uuid": "5db7692d-0271-4396-8418-4f177979122e", "value": "T1D0050237A683BCE13F3B5D80B0D5355B5F6572BFC365CA08B5841CC900BA6A09F9A9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698571, "uuid": "39daa15e-42ac-43db-9857-a41b78a08d8f", "value": "12288:/HE5WP9HxVYYdbHtXWYBFxHLjw8TVak76irayAvvPJzPD5I+x9WXYNXn:/EYP9HQANTBg2v6r//JOhXYNXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698571, "uuid": "6ae28a40-f368-4100-b37d-a4b5aa2feea6", "value": 803695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698571, "uuid": "86160bce-b8d7-482f-b398-76577a93d13f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698571, "uuid": "3d05f8d8-f039-4a40-bb63-f2ca7d55dde2", "value": "RFQ_ 0077243001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37b6e98-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717595, "uuid": "1417bc44-53e4-4350-a77d-06f9dc51c7de", "comment": "Malware payload (Mirai)", "value": "d8fcf93dfa7a4451e98432ff125c02ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717595, "uuid": "74d18071-3611-4ce3-9941-12a06fb03dd7", "comment": "Malware payload (Mirai)", "value": "cac35f1405edfa4912b913c82b4edc90ccdceaca46a81f0e7faed1642b0906fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717595, "uuid": "8bd904cf-c77d-463d-ad59-4e5524940c20", "comment": "Malware payload (Mirai)", "value": "f635bc7d23aaacce6f0f99c80f284cc23354f8c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717595, "uuid": "78c9d7db-a9f2-4e02-ba65-6f25c0f05bdd", "comment": "Malware payload (Mirai)", "value": "e52f39348a1b027da18fb786b0375bd2e1fae066dcc9c1d154563cfe59fabe3934ca3e20221150d983884e1ee5a1efe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717595, "uuid": "83cdf9e0-c852-4e14-8199-b2e90ba5e0b5", "value": "T1FE438D36E41A9EA4C4464234B8548EF41F23F1C583632EB71FE286B29053DACB955FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717595, "uuid": "7a607cf4-cdfd-4918-abe4-97fd37043ead", "value": "768:cajooe4aYke0reltQLraouUcfdatyR5M0sblhriwFynfk3CjcoN3a/XCNnw6:capG/kKNcfoK5Shsk3YbNMXCNw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717595, "uuid": "d190c395-ac0d-4ba7-a8b4-65baf6c77c18", "value": 59708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717595, "uuid": "63f3239f-2cef-48c4-8317-43460c645192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717595, "uuid": "e1ded62b-96b9-4352-8ba9-cf61ca4c5a40", "value": "d8fcf93dfa7a4451e98432ff125c02ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151b3b58-c061-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706723369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723369, "uuid": "8fb7b483-f2f0-42db-aea7-0a83bf09ccab", "comment": "Malware payload", "value": "360d9555ea9e7c79e673466650288bd5", "object_relation": "md5", "Tag": [ { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723369, "uuid": "cebef843-257b-478b-be29-be8567979a86", "comment": "Malware payload", "value": "cafd9d3e8e0ca047f5637ac48ae6d6499cf3ab428b430e48c3705c65340570a9", "object_relation": "sha256", "Tag": [ { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723369, "uuid": "6f1c8fef-ed96-41c4-9808-3e8e6e03ef0e", "comment": "Malware payload", "value": "cf1d66f46737c24570151232ae48a0dcc0811adf", "object_relation": "sha1", "Tag": [ { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706723369, "uuid": "7f30ac9b-fec9-46ac-a0c2-41e608187888", "comment": "Malware payload", "value": "f3a56dcb47056c4e60acb3f93811fb53f009cdef5341ab12125e38b7b529196a90c0064bcd09a5cc8781605415b74b23", "object_relation": "sha3-384", "Tag": [ { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "oscompatible", "colour": "#E1A03F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723369, "uuid": "adf8d48e-77f3-455d-97c1-ce5419d20d24", "value": "T116963380CFE8FDC9D3660E349D465194EB17454C8B504AA68E377F6F83E2BFA472A844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723369, "uuid": "d39fbe8e-9be2-4caa-a928-c3871d7ef19d", "value": "196608:xjMlbvMYOZwF7slanwX1OP6dhILSlaPKL4wUxwgiS3caBJUpOyWRAgzO:xQ1vdFpwYP6DmS39UxwgiJaBJPR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706723369, "uuid": "751d12c4-a47d-4ffc-832c-587b34e41f67", "value": 8835127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706723369, "uuid": "bac8390b-523f-47e7-8444-4fb69ff9dce0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706723369, "uuid": "b81f1a9f-5f17-4edc-9ee6-083ab211e121", "value": "x86_3_13012024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac83993-c030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706702575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702575, "uuid": "ccc61e26-37dc-4da0-941c-26fe2df86c9f", "comment": "Malware payload (AgentTesla)", "value": "214ab2db5f166437c070ff2ef56faaf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702575, "uuid": "5260d801-b7d0-42a0-bf41-3cb6052dd3d4", "comment": "Malware payload (AgentTesla)", "value": "cc4d6f9aedfcfe42d77e11ca5e5495b05e36075f4fab20ea970ad9c4c7ccd682", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702575, "uuid": "9e5ba06f-0846-4373-a855-250c4804fd44", "comment": "Malware payload (AgentTesla)", "value": "47d778c3f3beaec6f8e51aff034f56f6bba3dcdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706702575, "uuid": "90d7d0e4-62aa-4d4e-a4b9-5c81988ab134", "comment": "Malware payload (AgentTesla)", "value": "cbe30501b4abf99906bb9f542b32a1f35ee8fd92b961c1bcb0dcede36675a598ff260397a365d99b01e33d550f37714d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702575, "uuid": "1137f475-5942-49cc-8da7-1a018c4a2331", "value": "T1E7E423050B98CA53B35DB141F96593DC49C798663AA8FEC0F70F24889D59DCE9CB21CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702575, "uuid": "c0beff95-1829-4099-b623-6cb9fc9fda31", "value": "12288:ofXdITjz4ER1bykVE1CZI0U0yOjAw9E3bHeW7UXkwIr47UVEuBh5/h6/g/hRA5UL:Iajzd1w1SF9WTdYk947UVl7/h6/+hRA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706702575, "uuid": "0df2dc96-d714-4a5e-bb50-de2ba59a8f64", "value": 662149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706702575, "uuid": "96dba110-abb2-48dc-9fa5-fa500b013508", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706702575, "uuid": "3cc4af09-5f0b-4cba-ba0d-4a922d543037", "value": "nFms Order 6210 FFFP2 V NR DNo2561 PB 34870 .r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58ba4b8-c055-11ee-b7ea-42010a9c0006", "comment": "Malware payload (WSHRAT)", "timestamp": 1706718591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718591, "uuid": "5670bde4-808b-410f-84f5-e53516856192", "comment": "Malware payload (WSHRAT)", "value": "88ae41b328e244baa40100550813c37c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718591, "uuid": "4794912b-3ae4-4812-b89d-9142fc32b477", "comment": "Malware payload (WSHRAT)", "value": "cd0f3713f71701451538380e8c219b0cf0f490cb560760a3e346c6559e823d0f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718591, "uuid": "e0480003-29ff-44ee-ac7a-5beabb63ba38", "comment": "Malware payload (WSHRAT)", "value": "b098a717c8f618187bec8cf50aa0bee09bce7268", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718591, "uuid": "2528e7c3-f671-4182-aa9e-65fcb0698070", "comment": "Malware payload (WSHRAT)", "value": "32d298c67281b91583665f45bc4f5e26b89b6de2b77d31bf4e4a248a3385fa3ccca8200a12d4d3cbffc34d1fb00cef53", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718591, "uuid": "93324395-ebdd-417d-ae68-dd142303c83f", "value": "T1032519C506B0261EE3A3E618C725E663EC38F9272EA35DD57CC5394EBD78C085D9DA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718591, "uuid": "b9fc5520-a5a6-4828-ad26-92621bb05dfb", "value": "6144:XQyIasDlZGlFVd94aBSGgVG5S7lN4Bw0JHqg8Mspk+w9304+7mfSFsnG6Qbfa7wG:go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718591, "uuid": "e6fe2c0a-dfd4-4590-8c70-35ac074289d0", "value": 967045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718591, "uuid": "d46018c1-c63e-4071-9247-b013fe3b953c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718591, "uuid": "866fda2b-eed2-4106-a304-de1e04b862e0", "value": "quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2175110-c01b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706693621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693621, "uuid": "1c11abe2-663c-41ef-a205-3effe8de23c1", "comment": "Malware payload (Formbook)", "value": "fed79e18902d8cab58b5a92393981cbc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693621, "uuid": "651ac09d-866b-4a37-9df9-e71589d43d2c", "comment": "Malware payload (Formbook)", "value": "ce4c49b53ecc85b547cc750a4ebd4624443c4f9d940712645a118d964ff3a668", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693621, "uuid": "941c3688-f74c-4904-ab96-30467035bd17", "comment": "Malware payload (Formbook)", "value": "f775197268542ac74cbde30e3772722b45c6a863", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693621, "uuid": "cc51505c-680f-47ee-9a24-6add76117f5b", "comment": "Malware payload (Formbook)", "value": "2ec2d9ed367117d571686389e1a8b0db6242c4cdccac334ea68b57edd859d7e39e19c1dac2be1500c487f8d0a477783f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693621, "uuid": "cd586c91-5a03-4099-a1f4-c06de80bb2aa", "value": "T1B0D423AC56FFBA10E32D690306269C3E071DC5C3B2B7DABB43D7A344744DA6E8A91474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693621, "uuid": "ceca5140-3c6f-4b18-b404-cef82ed2bcb5", "value": "12288:h6ggiKMh+xvbhFOJIaz5GIJW5u0kyq1RIpdgBzlGAd//v/:hDgiKMaThazUIc5u0qNBzJ/n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706693621, "uuid": "cb31a3dc-ea2e-4fd5-a948-d49097c7a57e", "value": 606012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706693621, "uuid": "67ebcdcb-f8d2-49a1-a61c-3769ceaa68da", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693621, "uuid": "2277d5f5-3ab0-4dee-ba7b-cbbe53f15cf9", "value": "CG230511007 Order Purchase.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d95aec-c044-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706711188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711188, "uuid": "3d6f16c0-3e8c-4d8e-9076-90c8d1328813", "comment": "Malware payload", "value": "821abf5d474d3a87ca4123f758538d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711188, "uuid": "2a59efe9-2523-4068-88bd-cc68a7f46d51", "comment": "Malware payload", "value": "cee976b1a323482eab6a237b129beb0241632dc4a0f67e5aa85c7abed5528684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711188, "uuid": "9a70a19f-2fcf-4c6a-98d6-5239b7114742", "comment": "Malware payload", "value": "1cb68657a80bcc0da8f66e8d0ca2fa0b21327ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706711188, "uuid": "ce660aac-ff86-45f9-8667-8432b5c00cc2", "comment": "Malware payload", "value": "41a89654bd7679da031023e216fd60ed5a338735818bbce53990f5a247bc7af8a5d76e4c1d0eba323fcf60393dc3bd2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711188, "uuid": "3f287322-dda2-4278-908c-84635a45bcfa", "value": "T1847623FE6158331CC01ECD349527BD08B3B6661F02D68AAA3ECBBAC02F97575D651B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711188, "uuid": "f4280a8b-70b5-4cca-a046-f93b345ae93e", "value": "a0147094046123559cccf69406835345", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711188, "uuid": "a1348a71-46f6-4478-bbe6-47600f2c3d75", "value": "196608:v3U3sdJoXLVjDVMEvouW4leqGLMZ58g/t:w0SVdrY2eqi258qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706711188, "uuid": "e68159d1-d76e-4e41-b554-e02794aae77a", "value": 7614464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706711188, "uuid": "09fe6cdd-cd22-4f87-b67e-e7f2f6453ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706711188, "uuid": "40b33618-9986-4de7-92ff-02e463e06961", "value": "SecuriteInfo.com.Win64.MalwareX-gen.14080.15904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd720aa-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706697560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697560, "uuid": "54dae171-053a-474f-b6b2-136fdb2d08b9", "comment": "Malware payload (AgentTesla)", "value": "349bdf9aab527057a5f57fe11ce421f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697560, "uuid": "1240c0e2-5579-4aa0-873c-771d32d9e764", "comment": "Malware payload (AgentTesla)", "value": "cef72412a1dd9486bae5f7e606d4330660fba98575ba1c939559ccc83536f41a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697560, "uuid": "da01f919-984b-464a-ab6c-4d7644dc6280", "comment": "Malware payload (AgentTesla)", "value": "f514f056811a82d32d45adcf7cf2d9e000ef3570", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697560, "uuid": "e375e763-1d07-423a-b369-3fa590ceabdf", "comment": "Malware payload (AgentTesla)", "value": "4176fec303cd36d3411d7f315ae33f34d9bd83a7fa5d61500f79f07d0ceee7a3d771332fd1763603f76e94e4a2214944", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697560, "uuid": "09b1af65-2d0a-4784-a044-963fd321d437", "value": "T16DD4020BB18DD31CD6E807F23039413592A8DF1B6402EB69B8D9FD7E497119E1B983E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697560, "uuid": "476eb1d2-f330-4679-83b5-717def964684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697560, "uuid": "0329f642-5749-4796-9cca-81a2754842e4", "value": "12288:R2j8FwLm/c9OHQvtz8GJkD/El9fDDj78YujVycks94Fatdo3wIu:R2j8F6zemV81rwb/mZrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697560, "uuid": "d58a8425-17ff-4951-87a4-3af90de4d35a", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697560, "uuid": "ea3ccd4a-a64b-4476-9c2b-e4f040bcbebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697560, "uuid": "302a42bf-9da4-4ec4-987f-4dcc33e0f1a4", "value": "TLX HBL_CULVXMN2302207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c425bf4-c088-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706740239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740239, "uuid": "8e13b532-7579-4b45-80df-33f1dd161f4f", "comment": "Malware payload (LummaStealer)", "value": "4b784904d1b0442fe4825e46fa1b1bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740239, "uuid": "98137da0-8670-4388-b8a4-f7743fa4147e", "comment": "Malware payload (LummaStealer)", "value": "cf40d4aec6fcb8504d90c19cf284b7db1acd69fbe7713c858fba53c10b00af28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740239, "uuid": "02e0b716-486e-4e7c-8d96-e67c46280205", "comment": "Malware payload (LummaStealer)", "value": "0e9769a2bbf2a1e20bbeb14240cfa17c3f9c051c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706740239, "uuid": "ea8120f5-1c47-4963-8db6-70c502665212", "comment": "Malware payload (LummaStealer)", "value": "a89e5de7d53d177447e8e9d4e3ff35116c43de33cfa87f7e0d15b4380418408b661327122c3f542732c34bcc70ecfb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740239, "uuid": "c775b10b-2b57-46e3-9422-4c3edd934821", "value": "T1DDD412973EC947A2C90495B1E4F360A146F278DB2B73EB46390842E95C167D8CF9CBD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740239, "uuid": "53c3c2a3-4c77-43dd-b629-6608cc883dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740239, "uuid": "d741116f-cc43-4252-842b-6c64dd058dac", "value": "12288:jPSTRpyhCpXtSSW0tUciZYmnmZBeibCZFKHR42oDYSECa4f0:jPCBhtxWIUciR0BzOZFKx4n1Ewf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706740239, "uuid": "bd54220b-893f-49f2-b99d-af022b08d9a2", "value": 645376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706740239, "uuid": "56f0429c-7054-45d2-915e-e59a3bde7aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706740239, "uuid": "7ad3c670-492c-4c19-a813-c926a57943d8", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28268.17366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6283e0ab-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1706698158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698158, "uuid": "f03e59f3-1ce6-48b2-89e8-5893ba8673c2", "comment": "Malware payload (Loki)", "value": "cb643fb143f603e1fd0127cc612da943", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698158, "uuid": "8f8037f6-6b24-475a-b18c-4f0e0300543d", "comment": "Malware payload (Loki)", "value": "d085b8b0b05fc06c61464828f58b7a7e4ae648b4808a25a4bcd0eabca0ee573b", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698158, "uuid": "e869f502-0eb5-4b32-8009-5ff68764b7ad", "comment": "Malware payload (Loki)", "value": "232d672429f7acdf6c2e522f7baca641433e911e", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698158, "uuid": "45fd459d-e58a-47ff-9a2e-6b23406fef28", "comment": "Malware payload (Loki)", "value": "669dd955c501c6617033040a50719705a630e921b986757c11f4ea504036ec1db0bb67e30d160ff1da3d6340abd6b176", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698158, "uuid": "51cfbb21-d60a-48a3-82b9-7219fcb0d845", "value": "T1F374121CB35AD94AC053C83E4DC6D1CF5319FC00EF8AA20F71A0BB6D05796D29ADA769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698158, "uuid": "14bcc4db-06fe-490b-90ca-9b4a8709bf11", "value": "6144:ykXundiqWRkbXm3AKAxYu240XAqKRKSP0ZgK9UsZyLWEhN+:ykikqlXm3AKAxY9DwrP0rlQLWEz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698158, "uuid": "eca4a863-4a40-41d0-9778-56f80df59cf0", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698158, "uuid": "dcccdec2-95ff-4ddb-854e-432c1d449b4a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698158, "uuid": "d80bbf7d-16ce-4655-89be-277e77c8e80f", "value": "DOC22141A=033467.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990629c1-c02c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706700827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700827, "uuid": "cd85832e-c0d5-4263-95b1-c53840d2dec3", "comment": "Malware payload (Formbook)", "value": "ac14b5670e192db81b2990ea1fccd1b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700827, "uuid": "2a1a883a-8dff-4e13-86bb-2790f2378f25", "comment": "Malware payload (Formbook)", "value": "d3bda2a0203467b5620179ffcf55a83e2c82d27b46dd10b6426bf6c0c7dc8c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700827, "uuid": "91fcef18-29cc-49d2-99b3-797143bed031", "comment": "Malware payload (Formbook)", "value": "44a3976bfdf38d262e8156ca1653de4166df4fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700827, "uuid": "58d969ed-e694-4ffa-9bfb-ad9db099af08", "comment": "Malware payload (Formbook)", "value": "9ff58f72fe6ad151b0740c7595e05052f1d2a7fc3bac6ab4740beefe98ea4b87d90193e54af42f485f1deab117e2b5c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700827, "uuid": "bd7d5489-12a7-4001-ada4-01afd34b06ab", "value": "T1CEC402289A749F16F93C0FF611B4B911E3F622972606D7B95CD920C52BB3F250B04EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700827, "uuid": "1cd6383f-5912-4c0b-8b3a-539f31d55d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700827, "uuid": "43030d25-8204-4cfc-adf9-28f45f61c3a9", "value": "12288:l4+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:l3a6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706700827, "uuid": "103af625-96c5-40fc-beb8-22e35f8da0ed", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706700827, "uuid": "a53a2de5-9183-4284-8a6b-284c2231f8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700827, "uuid": "3b4a152d-850d-4fad-b399-5de6e87dee82", "value": "SecuriteInfo.com.Win32.CrypterX-gen.22366.7665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b047554e-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697000, "uuid": "e6e3bdc8-781a-4891-a0ee-fe4f8d4c9d83", "comment": "Malware payload (RemcosRAT)", "value": "7ea0fddc0aa47383c4d6bf530b71f7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697000, "uuid": "03f127c5-8086-4ded-9f57-98e06081db3c", "comment": "Malware payload (RemcosRAT)", "value": "d4b6ece4be9af66fcb3414c071c1f5f87b84e74a1374f9ecda303799cb3be4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697000, "uuid": "a322faef-aef0-42ba-bce9-fdb346da6615", "comment": "Malware payload (RemcosRAT)", "value": "c7669757faccc44fa34896f4f36bc8353a5ed194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697000, "uuid": "db13fe34-6a25-4a8a-96c1-e7b6d2116270", "comment": "Malware payload (RemcosRAT)", "value": "1ba684cc85246557af66cd7f68981b7f31e5648f505af44412e772f7d99322fdf0c48a470af7913dbf1a3095c0cdb96a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697000, "uuid": "c9ec6f95-0dac-4123-a8e7-c1a92ce12b1b", "value": "T17995F1BAE2041473D4324136CB5EF76AA8547E6A2F2871455EFE3CCC71B8687F43A126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697000, "uuid": "a71c3f33-202e-44f3-9444-965fe98438ad", "value": "5f7fe181812d5942ca24024d00d9c41d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697000, "uuid": "1c5ca4f6-0d84-47da-ba8e-26d082075dc0", "value": "49152:FIOAjnxf2hp4XLkrhKOekUvUeudcv4aF5P0R:FI92hp4XQrhhekUvfudyuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697000, "uuid": "5d94cd9a-4136-4f04-9a53-0938db71baea", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697000, "uuid": "a03f06e5-6946-479d-8144-732f608fe699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697000, "uuid": "cb80c4da-5a98-48a9-a4ec-6aef9532f40d", "value": "Abchina_ Payment Swift Copy_290123.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81ebe4d-c025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706697926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "bb63b25f-bca3-44dc-8e0d-43f7f6a37167", "comment": "Malware payload (RemcosRAT)", "value": "64e33f7b771de9bcfe8d95173491db93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "df25111f-e9e6-4ecb-a7bc-3c2932e1020a", "comment": "Malware payload (RemcosRAT)", "value": "d4c71db0232772f7efd4c5e1b987c228a78fd55c440e0809eacb7c61105d31a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "6fc3ba18-d1b8-45d6-a2a3-a42fddbc1d10", "comment": "Malware payload (RemcosRAT)", "value": "e24f3ea8d5aed0b8b088b804ae2bc5c0451a3f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697926, "uuid": "9d9ae025-0ec2-44df-beee-873e6da0b9ed", "comment": "Malware payload (RemcosRAT)", "value": "b8dbd7ae60191671e8ffbf39297f326da8f0126683d1f5179a8ff3dd8a7395eedb64faae3709243e1819d7f70ef0931f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "23a587dd-edc9-434f-b171-15038f0fb8ff", "value": "T17C85CF2276E55539F222B479179B3BACF81D693CAC256CD566F4280CFB23240FF08667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "d56abb32-e53f-4d4c-94ec-d6bdce70d9f0", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "ea4342cf-8fcf-4f93-8b88-aa03891393ce", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOD:gcP7HHQU72UHk7c7mvrq0gOPyQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697926, "uuid": "302ec769-2ca9-4091-8886-f445aa0c4548", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697926, "uuid": "888b6a16-27b9-4564-8c19-b263b4e1ebd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697926, "uuid": "97380675-6505-408c-a11d-0a9fd512b2d3", "value": "Fukuan Fuben_ China Construction Bank.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9c19a1-c053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706717560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717560, "uuid": "be999a1f-b2f6-4cbc-8a02-2254d70e61bb", "comment": "Malware payload (Mirai)", "value": "841d12722534cb92f91827deae67ebb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717560, "uuid": "c7bcb444-bbc9-45ba-8ad6-380b75d610f1", "comment": "Malware payload (Mirai)", "value": "d59e34cfe0c6b6f45cb91949a2e8a9b66891a8317343830ebe552236a085e04b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717560, "uuid": "e906691a-92c4-4daf-b068-1774d0221f00", "comment": "Malware payload (Mirai)", "value": "d1bbee11858605e8303500269ce46078b6692c88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706717560, "uuid": "781b4119-9b00-4c3c-a03a-53126cf24190", "comment": "Malware payload (Mirai)", "value": "c1afaa7e43f772cfa8e004eb9d2c88204403ac6a6535ea5997e45b4bc13df967c948a4dee1a7dbaf3cb7838a2a848ece", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717560, "uuid": "cb75ece0-0264-489d-85d3-b97cbf1b23ee", "value": "T1B8C2E896BCC29667C2D1537AB76F478C339277A9C2CF3717D80427103A8AA4F8D62E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717560, "uuid": "9db89edd-66ad-4f94-8d66-a542f4b3d341", "value": "384:FvNTA72QKjQ3JcsoFcQCm48tG5rtl+6jclFfPRcKbFo6bSAvaLrybmeILop66j6C:FvJfHjQZzoFmEG5rtl+/btbyEILop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706717560, "uuid": "4b63d9f1-3f1d-4aae-91df-0459e0683772", "value": 26488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706717560, "uuid": "c6308341-69ba-46d4-99a1-87e965723f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706717560, "uuid": "6d96d56a-5af4-434d-97c5-02d97babc6cb", "value": "841d12722534cb92f91827deae67ebb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab35c59b-c042-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706710306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710306, "uuid": "6ee62b2d-b0ad-473b-8fb5-2a781d696635", "comment": "Malware payload (RemcosRAT)", "value": "7e2567feb06347258efd3722683a8cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710306, "uuid": "74d49024-62cb-41b3-9556-a60851d5fb1e", "comment": "Malware payload (RemcosRAT)", "value": "d5bc991d8b0e51e45a1b9b9baa71dda7f7dfd8e769e3a641d0cda1077bd01b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710306, "uuid": "a1f034c4-f6db-4e52-9e1c-b29215b7c972", "comment": "Malware payload (RemcosRAT)", "value": "f9d174070758ad9bafb3598f24495d47ecee936d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706710306, "uuid": "e007a2be-d590-4d5b-8030-3ac81ae463d3", "comment": "Malware payload (RemcosRAT)", "value": "fa0ab2a3afcd7ed35359a6e98238384ee4745d046e4ad2169fa7c1c4933fe2595795760da3d7ae56ae9d6f8d287c4474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710306, "uuid": "be977c7a-93f2-44ed-9737-082243c3365c", "value": "T1C6251203B1ACC32CDA6842B63938423152A8EF6B5451DB86FCD4FDBF1A7724C5B166E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710306, "uuid": "854dcca1-07fb-47b4-9e52-4205dc389045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710306, "uuid": "dc96f8db-eab2-407f-8bcf-272e40f6b26f", "value": "24576:KMr8bshYpK2r0L05CQAeqKML9eT9qrTInWKraA:zwbYtL05lAeHMLstNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706710306, "uuid": "caf318a4-3622-48b1-a95b-47a6c468d88c", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706710306, "uuid": "e9a2675e-07df-4635-b083-beb55313cd8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706710306, "uuid": "3bc35d09-efb5-45d4-b384-2b61be81a0a7", "value": "PO-2413120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dab217-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699137, "uuid": "e218b202-50dc-4624-9ff0-743e190e14ad", "comment": "Malware payload (AgentTesla)", "value": "4719a76abb7a129ec795a95b175ea355", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699137, "uuid": "61cf50fe-cc71-4124-b71f-3bc4da825789", "comment": "Malware payload (AgentTesla)", "value": "d65290c5b70e49f662e8ed25237d3ceae0b44c4ac43c138de82063315788e9bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699137, "uuid": "7251c6a0-7490-4f26-9a6e-f67a1475ff3d", "comment": "Malware payload (AgentTesla)", "value": "e4304d040cbef7cc5a84df499786375f015383e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699137, "uuid": "f4735fcc-8aab-4947-9b0c-3994fb616532", "comment": "Malware payload (AgentTesla)", "value": "81e9a26cb1d7b6e7c5af649d143f90cd0f9ce48398d674d2dfee6dd455e9213362bed27008e49b9bb1348d347b399c2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699137, "uuid": "b64d7f09-752f-45d3-b00a-c009f53c0dd4", "value": "T1DCE423E63B7CC389C0FF4A7A3CA052540BF1CE571048C6167EC55AD82EA7748965A7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699137, "uuid": "e022d4be-63b3-4fb1-b291-19f0f40eba0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699137, "uuid": "72ed35d0-26fe-41e5-a880-743437bdd601", "value": "12288:0lhlfu8liC5utSr8j8qshDvocMPgFz/3Xlviqy4JuGpDRrnOkMVBncmV6TRomrFb:zSr8bshToc5z/Hlq4JfDtxYtVjkjzt9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699137, "uuid": "f708baa6-ec5d-45d6-a0c3-251203a0e059", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699137, "uuid": "5248cb7d-b7a7-4d31-85aa-01f46b8bbff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699137, "uuid": "107af27f-a1a1-4a15-8ccb-bd482a591f4e", "value": "FedEx_23041747012.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8ea89c-c00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706687810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687810, "uuid": "a1f7a16c-d11b-47d5-b125-c57467300958", "comment": "Malware payload (Mirai)", "value": "8dde19080e2a4bf743208d1e14ba483c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687810, "uuid": "97a1ff11-5e95-42aa-a44d-81eedc4aa0e8", "comment": "Malware payload (Mirai)", "value": "d77d212bd29a0eced383b28902588cbb67c875dc657ae67437ef29639114b777", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687810, "uuid": "2a76e8e2-138a-4db6-923c-f08a92912cfd", "comment": "Malware payload (Mirai)", "value": "d03e1cf30dec939b9df7c34c44bd698bb42aade7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706687810, "uuid": "1a9e813f-3307-4b69-ab34-b653b9c699cd", "comment": "Malware payload (Mirai)", "value": "9c653f9925f069eca7257db8769f708c4ae3bc7df4264eff653ccc81c7bbbd64d820e5763a3a606ef6dab97d322b9617", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687810, "uuid": "d002358f-7fba-4cb5-9574-60cb96ba2efd", "value": "T1D6D30945F9414F23C6C612B7FB5E428D3B2A17A9D3EE72039D216F60378A95B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687810, "uuid": "b517d92c-9f40-40e9-b689-8e9b123d6c97", "value": "1536:AEu+k6NMB8N1EUlw51PglF/A+Zh4VvrbsTgEJQe1Jk2/8Fdtl8pewywmFb4uovzK:AEuZONLwXkF/x4VIMEJQejUFEwBeB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706687810, "uuid": "1db59163-5687-4a7a-a3b7-b92c25822836", "value": 137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706687810, "uuid": "39cf2f9d-95b0-4557-a9de-f9e5e2d6c870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706687810, "uuid": "0b2bb224-d628-4e43-9cbe-26d9e962f3c7", "value": "bulu.arm-20240131-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162b608f-c04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706713922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713922, "uuid": "6b20f1d8-7e8c-4a8d-a88b-8a6a8ba826e6", "comment": "Malware payload", "value": "97b33f3114369f55f8188dc149600fa7", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713922, "uuid": "77f15c1a-f07a-4dea-a1b9-954f05faa77f", "comment": "Malware payload", "value": "d8ecd5887b9f765a6405ef4e363d9792bb564aeea9d988c6a0562521c47761b1", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713922, "uuid": "41510765-741a-4cd2-b7a2-9ba1152ef6a4", "comment": "Malware payload", "value": "ba5fa5149f65b805ac143cc841782c5e89c3ea4a", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713922, "uuid": "27dcee17-8e54-4c3e-aebe-d0e82c80c57a", "comment": "Malware payload", "value": "2075523bbfc54926837a44f12c1ebbee1de696ff3c5457e120d74c3602ea31f55581e800038d5ebd1e4388f13a97c1bd", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713922, "uuid": "a2946108-02e7-405f-b48d-5d2d9f5f9fc6", "value": "T1FE830A32314639B77143ADE01BC6645D9639496B160C8CEC6CBDB46DBABC93C8278CED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713922, "uuid": "46645f44-5177-4a71-a84a-8914d6b2f4ab", "value": "1536:WQfNTbl0mKOZkMZmXzuU5V35xs3nIDKNpfZFXZIA72PzwqiWC/:VbFKgmjN5Vpxs3nIDupjXZIAIwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713922, "uuid": "acf7b846-9a57-4299-aba1-1fe9872eebc7", "value": 82122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713922, "uuid": "9b301158-e465-4678-bc89-2fa0ed7c5a30", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713922, "uuid": "f677246c-c37c-4ae4-820a-5ad83d66f257", "value": "bTrh.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0011fed2-c056-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706718609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718609, "uuid": "34f6e967-cfbb-4d68-969e-e5bfd0f114a0", "comment": "Malware payload", "value": "5c49ba5981270d73974186fa53976231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718609, "uuid": "1d35f98a-7be3-4353-9e16-a5f68f4c86b5", "comment": "Malware payload", "value": "d8fd0230b84551fa3d43288791611a1e56ffc1405551820332e88d50762217dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718609, "uuid": "1f099cfd-46b5-47d9-a5be-c986982ef2b8", "comment": "Malware payload", "value": "502ee46ab5d8b79cc967dad5c58152ec11e7fc91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718609, "uuid": "c7664f1b-570a-48d8-8cea-cd6800a54e3d", "comment": "Malware payload", "value": "ecdc04990cbcd022f39f0c84ec6bf895d02d5e6c6c4c76eb91817816617abff2c4e9e65ff3313f86c717214229654571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718609, "uuid": "6d1ba115-0b25-407d-bfff-d0e5e31c6daa", "value": "T1C136123FB268653ED9AE4B3245B392605877BA61A92B8C1F07F0081DCF6A4701F3F655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718609, "uuid": "955ae898-e306-488b-a093-d1da5b722f30", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718609, "uuid": "5b28c82f-68aa-4dda-8f21-e935f28af65e", "value": "98304:JE1IJhUS84+xv+N5YH9ajNmEw7dV78laW69Uui3TXfe0HYo8C4Esgd:iI/US84+xGN+mpacCU3NR8zt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718609, "uuid": "1b4c3f62-5f33-4f86-bb5f-5dbecbe128de", "value": 5180949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718609, "uuid": "fa291bc9-c217-4408-a30e-9e34b851c400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718609, "uuid": "e22edb79-5d94-448d-9a6a-72fe9b2a91e1", "value": "SecuriteInfo.com.FileRepMalware.17990.17420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bfc97f-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1706697244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697244, "uuid": "b0ee151e-64d6-44c4-86ba-58adfb229510", "comment": "Malware payload (zgRAT)", "value": "c2c5b70716a5ccd9a0754e9860f987d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697244, "uuid": "c62e312f-f50b-4645-a8b8-c3cacd50d54d", "comment": "Malware payload (zgRAT)", "value": "d9112ca0fbd3b9456db0410639f4380531cc0cf60c736ebc13189ad0b917f102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697244, "uuid": "7ddea5d5-d743-4e01-b394-093f15adc936", "comment": "Malware payload (zgRAT)", "value": "1dcd9f9fe7fa287f4551d8ec4e2319822e397e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697244, "uuid": "31f450a8-bb3c-4ff5-960e-437cd79279aa", "comment": "Malware payload (zgRAT)", "value": "70f016208496b0660625d947b7e53d5c46040e88ecf58e46f2ab6d7ce0a7e88b7ce0da94bb9f6dad6b9913f843862580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697244, "uuid": "b5a14090-cbaf-4e98-8288-780eb8110cd6", "value": "T1AA55F15B67164962CB966731CAB757000310E6A75263D30BE2DB26F9A4173FF8FA1B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697244, "uuid": "0ba96553-864f-45bd-b21c-216aaba95286", "value": "24576:ET47XqPn64dCMnKwa5BsDJYU1i45Qb/rwrRIjaKFrXExh2nI9eWrZ2kEC9:exP64Nn1a3sDdpQb8VEPFox5F2kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697244, "uuid": "9ef3c7cd-6f63-4bbb-b2f0-5777f53d23b9", "value": 1401400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697244, "uuid": "cc2a8124-faa7-4195-b7ac-640b478b0cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697244, "uuid": "1ffbc0be-d637-4694-9a32-7cd07288f938", "value": "c2c5b70716a5ccd9a0754e9860f987d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f567f0-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706698600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698600, "uuid": "6febb1f0-afbe-4133-9fd7-ebaeb74e15e6", "comment": "Malware payload (RemcosRAT)", "value": "211614c4cc07268c2e4f193903ad0f05", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698600, "uuid": "1b329b32-73ff-493d-96d9-79b8ad26d5ec", "comment": "Malware payload (RemcosRAT)", "value": "d96a9464b1df2abd862592d54bf81838d83883a865f602de24fa037b461bc8e5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698600, "uuid": "53ec1bc1-ab94-4d37-8342-43b18b99452e", "comment": "Malware payload (RemcosRAT)", "value": "239d88b62ddd40dc9857c5f10b4da3249b1a0117", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698600, "uuid": "4b0afb3a-0a13-403c-b286-ed425965130f", "comment": "Malware payload (RemcosRAT)", "value": "3a1de9232a01546078c29fc0d84da3a327c5896849ac6c4224dc9e21c235151e860125c3140a95194b1d5ab3229ccfb2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698600, "uuid": "c9ec1ddb-76dc-4408-8631-aa2d9338b528", "value": "T19692B1B0EF421FE69E672FF7C501A900B0B90DC182351C14BEBB46987C065ADDE6D9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698600, "uuid": "ac6c0217-048b-4824-b8e0-97c45929e671", "value": "384:rkSnFsQKZ+wBQyoS/x8zNzCsZlvousvgVG0MiHgcx5JZw3Ig:Q+aQS+wr+ousGN3p55g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698600, "uuid": "d65dbb2e-34a8-4e18-bc09-e12e4e53803b", "value": 20033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698600, "uuid": "b2e5d6d4-ac3a-4ed8-b352-99ca404320ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698600, "uuid": "d6ff94fd-ce45-408c-95c1-f4aac73af38f", "value": "?? ?? ?? ??-29-01-24.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb2d4ef-c011-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706689401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689401, "uuid": "31d4f509-e356-4aaa-a29c-8b1bc8c17d13", "comment": "Malware payload", "value": "7526dcebaf889c8684705873707c4991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689401, "uuid": "85a745d0-903b-436f-bb49-b38b805b3c65", "comment": "Malware payload", "value": "d9b9a8f5efb890420f73337d059dfb7ece53c49e384bb490ccf4cfdd0f625aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689401, "uuid": "dd37e8ae-d551-425a-9c29-3e28c31ebb53", "comment": "Malware payload", "value": "9a0841667f76cbd61ea9a8f046791e3e5def5027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706689401, "uuid": "65b3314c-cbc0-443f-879b-d22f3e108002", "comment": "Malware payload", "value": "2c86458fa88f6062ccb3997f417cfa32c3c2fee345cdce70d12892f8cc36b6f3be4ed64d158341e1a87dbb62cc948de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689401, "uuid": "2aa3d902-1cef-4af6-8505-d5ea87944a62", "value": "T16505FA0973BC0575CABB94714EFF151B68E835DA0F89B67F83D57ADA32229CC02B4A05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689401, "uuid": "02af3f3c-4fb2-41aa-ab89-dc9d0c04ccd2", "value": "dfc0b5c4798eff3176dbc76ff2565054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689401, "uuid": "8d798c77-8e81-415b-a214-a54e201c1a3e", "value": "24576:XKLq31dmdlqK50r2FwR/0mlqDTtNLoQFYxP4zuezMZOn8XoKkFkpo:XKLq31dmdla/0mlqDTtNLI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706689401, "uuid": "437f388e-f9fa-442a-9e64-088db0fd4e40", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706689401, "uuid": "bde4be28-458e-4799-b089-4462f4eb02ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706689401, "uuid": "c1d43618-d2ac-4faa-ae07-3d8f1da76504", "value": "SecuriteInfo.com.Win64.MalwareX-gen.11896.31171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f07dc15-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706718017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718017, "uuid": "1da7e867-6b9d-43c6-b85c-081c04032aad", "comment": "Malware payload (Gafgyt)", "value": "c4fa92ae6fdcc43fefedd41fd775e37f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718017, "uuid": "88af1565-aba7-4acf-9768-acba37d4ad6d", "comment": "Malware payload (Gafgyt)", "value": "da0aede395032b4119c641a39d820f818df4fef413bdb578257a45281c39dba6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718017, "uuid": "f857103e-e06f-416e-8340-68a638b920f6", "comment": "Malware payload (Gafgyt)", "value": "f50a71f79363248e91241e1e51413d89418657bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718017, "uuid": "52945d27-e0f9-494d-b60d-e676188372d4", "comment": "Malware payload (Gafgyt)", "value": "5186cfa08a7e3bee5ee3f68db1ff4d36b8cf5d5a27d14a6e3f7173fabe63b7ea15b7c00f9079b6922c44cbb982052514", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718017, "uuid": "33bedecf-a943-40d0-8333-fbacf5d0256c", "value": "T1A7A3F905F541C723C1D3177AB79F8D193B322BE4A3CF331556347BB82B8279A1A2AA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718017, "uuid": "9d67c07f-7e67-4d11-bb7e-06b0426a2d62", "value": "1536:M8nlP5GHRX8j+sIUiZuWSVIXVuSpK/atR4O5oYDGNvuCjTRNDx6EmdiQfdgGprDA:xWSVIFTpma34OqeGNvdNsEm4QfdBprDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718017, "uuid": "4739e505-ba45-4116-a530-6563970b1790", "value": 106850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718017, "uuid": "907e00a3-637b-44a7-ad54-d3b6f9ce3954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718017, "uuid": "689b044d-9d79-415d-8ae9-acfd8a684380", "value": "c4fa92ae6fdcc43fefedd41fd775e37f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8068ee5-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686330, "uuid": "5d18fef8-5a17-401f-8013-eef0277eba12", "comment": "Malware payload (Gafgyt)", "value": "93f07129eff398883247cec8a2dd4124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686330, "uuid": "9ec48fab-4851-44d4-a22f-081ae1f0d80b", "comment": "Malware payload (Gafgyt)", "value": "db61b7764ff63f17edf20b2036121497aa257905bdc2cf5a16d01d372dcbde79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686330, "uuid": "ff98fd7d-da4f-4732-9ae6-33debbe96999", "comment": "Malware payload (Gafgyt)", "value": "ca0cef91d0666d62cd418efa523ead040b15b532", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686330, "uuid": "c927d68a-bd1b-492b-a9e1-60427bfa7c3e", "comment": "Malware payload (Gafgyt)", "value": "40e46857d922c331942cba9d1a515e12a3dfb813f23bb8110ef970853a810b7412d677ad6814f378dabb298f168b4a0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686330, "uuid": "039f6aab-31d4-4117-93fc-3b74c661ba7f", "value": "T1DAD3D617ABA15DBBD80FCE3302E64521109EE49613957B6BB178CB1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686330, "uuid": "4092557c-bad5-4b10-8ced-f6270c64e5a8", "value": "1536:76ejNyUhayRB4pa4ggYJ7vOTlT7xhxPYsXm/KBgvYYiCh:74yX4pNLplhx3mCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686330, "uuid": "aab4c013-353f-410a-8a8c-4cdfa1bba40f", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686330, "uuid": "82136aad-ba4f-4194-8e40-67733e7b44b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686330, "uuid": "3de686b2-959b-40d4-9497-812c114b425f", "value": "93f07129eff398883247cec8a2dd4124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8842f2-c019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706692704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692704, "uuid": "a246fef4-342e-417e-9c09-2e6ef9e0d716", "comment": "Malware payload (DBatLoader)", "value": "0db1fdebaea0c081a4fd1c43bb83b077", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692704, "uuid": "a3103fdc-0d5d-4a40-ba6a-d73d9b1176db", "comment": "Malware payload (DBatLoader)", "value": "db6849b2b09b6f39d420b8ed21850a25e7c8be1e8ca60d6fee025887fe63b531", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692704, "uuid": "27fb0e20-ea87-418b-9d6c-1a3816cb06c9", "comment": "Malware payload (DBatLoader)", "value": "856b4e112c9ba402fa7643906a9fca829b87ca85", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706692704, "uuid": "9f43caad-1bf5-4a26-8c8e-656e6ea2f068", "comment": "Malware payload (DBatLoader)", "value": "a46aea71f11220e1be0c0fcecae998d25e43b3b75aa932f6453f1967d7f3a792c12324c1dba24cddafcb62714f5cf324", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692704, "uuid": "59b76e92-7ccf-4ada-82df-81d4ec81f1c5", "value": "T172653396A48B42B4FDCBED5DFFE592073C4A807354883109AEA41E114B6EB245FED327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692704, "uuid": "1684ca97-4ac9-4ba7-8d87-74ba80e6c3f2", "value": "24576:8BvqrA6v6KZ9NE2bkRHxTtLBvNx1wXvJXFnhCock67eS+X1yOE23+uEh+yfLc23:8BS3SSZbkRHxZLB4ZFMock67eS+F373S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706692704, "uuid": "0f4b0cf6-58c2-4886-b39b-70028d20d121", "value": 1412256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706692704, "uuid": "3565c961-652c-453f-9696-dc6665615e7f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706692704, "uuid": "989fa3cc-f1d7-4294-aef5-74cbc4548279", "value": "INVOICE.XLS..tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b891b9f-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699516, "uuid": "8a228e5a-8b6b-411d-aea1-9502cca6fa75", "comment": "Malware payload (AgentTesla)", "value": "b93c38c777a80ca9e87123c228a463a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699516, "uuid": "4073b06a-410b-4ecc-bfda-a535b201ee5c", "comment": "Malware payload (AgentTesla)", "value": "db7ad237fb8e34af424b99096e728e54ac0aa8f175f7d5a8da0d5b7485c1efc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699516, "uuid": "f3110920-1769-418b-9deb-fb6af93e66be", "comment": "Malware payload (AgentTesla)", "value": "5aa00b27d737cde784ae5d212ea3cddf52a7b0ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699516, "uuid": "f2175c15-f5b2-40d4-93df-1045027e9c76", "comment": "Malware payload (AgentTesla)", "value": "bcccbb49d78b32a2aa0d442643bad173b0aea7f639fa3de06bd746c1e2567a5f896823d319b9f690d1554efe0b945071", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699516, "uuid": "113d70e2-3f75-4b3b-8793-8ba9dd76c838", "value": "T1DB55380322818322EE5E9DF23AD6A2534EF85DD5012297DE135C3F6D6B7FD6003E9662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699516, "uuid": "fb05f9b3-5a4d-4c31-a68d-d4c373551d0a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699516, "uuid": "f44c1e6d-b8db-469d-94e0-2ff259a0e974", "value": "24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8ah4B4VttlkneKKNo:7TvC/MTQYxsWR7ahNdlKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699516, "uuid": "451b4fed-94e2-4fa0-9a9d-9828d8d21eaf", "value": 1350144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699516, "uuid": "8b4ba663-490e-439a-a9c8-1d4ce24ebebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699516, "uuid": "cdaad9aa-6bd1-402e-b2cb-8323a3b3ae97", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83a2195-c01b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706693631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693631, "uuid": "94950f04-f1a1-4448-8887-0bc1d6355776", "comment": "Malware payload (Formbook)", "value": "353747c834e8408765c71fdf2a26faa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693631, "uuid": "3f706a39-a29e-4cf5-92f1-c3015a13015d", "comment": "Malware payload (Formbook)", "value": "dbf1e7d1f99cf30b8a67c9f7cd4fc7b5702952c075855090d23f69380c3fd22b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693631, "uuid": "7787f6af-ef21-4ea7-94a8-125b2567aa0d", "comment": "Malware payload (Formbook)", "value": "192f26ff52a928b3689b923394b41235d28c2e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706693631, "uuid": "61f61375-6d0c-449c-aff2-4c3c34fa038f", "comment": "Malware payload (Formbook)", "value": "372d6c22d530536459c20cce11bbaed98a6737ee5e905e4938d78c8c74d9f3927247fb12959df0536c2dbf8e249d7e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693631, "uuid": "336c2145-463e-42cd-a58d-7cb68f6b5169", "value": "T15D05D046B2864961C795A338D6AB57010360FEF6A163D70763DB32E9251B3EF1FA1B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693631, "uuid": "bebf4c73-2e7d-42b6-9ffc-541467c95b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693631, "uuid": "6aab64a2-1e0c-477a-930e-04738f8f0412", "value": "12288:nj060wKJM12XOhFsJIZa5GI545FU3Bh/RIpDgJz7cziwdzDOLlgplFFXu:j06KErhbaUI25FUhlJzozppXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706693631, "uuid": "24ff07bf-559b-408e-89f5-42a3558b3ff0", "value": 870288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706693631, "uuid": "97038e56-27f3-4128-b02d-ea755d255fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706693631, "uuid": "830074db-53ee-4d90-acd4-542210d97b57", "value": "CG230511007 Order Purchase.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c35082-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706718052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718052, "uuid": "bb789e3b-60ef-4b9b-8c5e-db31feddf483", "comment": "Malware payload (Gafgyt)", "value": "1c96b537c6b3d07af5769a53b5f5adbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718052, "uuid": "e2e3f4b1-912c-4572-a639-f726204a4b18", "comment": "Malware payload (Gafgyt)", "value": "dc289aef48b491369acc411e582955ce50e4bfee8b10b58aacb803d82e0cc4b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718052, "uuid": "5ad1650b-8dc7-4f6e-9eba-de6f181dda91", "comment": "Malware payload (Gafgyt)", "value": "5ca5133fb421e8671fa027628cf80529f239ebd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718052, "uuid": "a148907f-8ae7-4a31-967d-cd0a20494895", "comment": "Malware payload (Gafgyt)", "value": "54663ae49489c6d4a37606b7c7317cfc40f22fc85f299ec7f9901c49285968c1df3d20a037741ff439742478803b110c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718052, "uuid": "6fadf7cd-7f0d-46cf-be27-b472c7adfec8", "value": "T15AA3A417FB11CFB7C85FCE32069A8D11249DA59622EA772B72B4DA6CF70744A08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718052, "uuid": "64a96506-cf7c-472a-957e-6ab585b513ad", "value": "1536:FBcEqoZ/ZGucPs1mZBgAAe+c7la20jGVmWiRqcfA4WcL2:FnZ/Cfuc7M20amWiRqcf5WcL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718052, "uuid": "e8fa9f05-1ec2-4283-a997-40384dd5b646", "value": 104087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718052, "uuid": "f771b6d4-de24-48d1-b1b1-4a6f5d814f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718052, "uuid": "88f9379c-c3a3-484d-b2e9-2ed547a4c3dc", "value": "1c96b537c6b3d07af5769a53b5f5adbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e19dd0f-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706696970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696970, "uuid": "f8ab0659-8ea1-4842-900d-a14c24d21e07", "comment": "Malware payload (RemcosRAT)", "value": "13292e1ef9870ccd4a9488178b384cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696970, "uuid": "d2b1f363-5a5d-4f83-bd8d-42cfe9683b2a", "comment": "Malware payload (RemcosRAT)", "value": "dc86732d61019726fc3a77639b7f2c1f497bc949f968493dff92866c7424418b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696970, "uuid": "6a64052e-ba43-4d7c-9759-1e234f49a466", "comment": "Malware payload (RemcosRAT)", "value": "26a6250ac44d40ba53600cb47c707023021b0104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696970, "uuid": "17757d7d-dc5d-4349-b030-bf9152c90cd9", "comment": "Malware payload (RemcosRAT)", "value": "092fffb7449669f17dbe6fe4a205255b67a1e9e4540da98f911ce620512c934e8dbc6e391085eecacd3ad0ad49f17b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696970, "uuid": "debd0ffd-c327-49d0-aea1-ae398d475a27", "value": "T101A5D023A6E14432F132A53959977AB5E92DBD242C267D8577E03D0CBE333007F646AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696970, "uuid": "235fa970-8748-4629-8e3c-deaeb58573da", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696970, "uuid": "5fb15cb5-03d7-4369-83d5-1c148abc2d8d", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOPaaF5P0R:pqAo2hd7Ymu0gOruR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696970, "uuid": "beec243d-2f1b-4aff-9280-b01b5e1f74f2", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696970, "uuid": "5e21bb5b-c7c9-4547-b613-bf9c459a8d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696970, "uuid": "5e88b4e5-3691-4df4-af80-3004e701afb8", "value": "QUOTATION-QU88272001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d30c50-c065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.DownloadAdmin)", "timestamp": 1706725351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725351, "uuid": "7afccb9b-6c9a-41fe-bfe0-2f667fe2c603", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "f50d0ae905a4a0122045ae392b036172", "object_relation": "md5", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725351, "uuid": "a486cdfe-4461-411d-befb-a9cf4a54a8eb", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "dd4e3b2dbbf5e5314e90dfd3679ea5d430eaace3922ce9b4cf2dbdd1c274efcd", "object_relation": "sha256", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725351, "uuid": "cff3fcab-bf53-410f-8940-6190423d1e68", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "a2abd9c8e0617cf79f0bf9a6797ad57f0649f594", "object_relation": "sha1", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725351, "uuid": "71ffba7e-6d60-4abe-ac27-e8f1241a5112", "comment": "Malware payload (Adware.DownloadAdmin)", "value": "b5fe1012253784d2c8037a4f2146484199145e10250bd677ab09c31fea2bbc62d316b6151525d472c256f1551d3ed61d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.DownloadAdmin", "colour": "#D34E1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725351, "uuid": "957d11fc-2728-459d-8a40-dc25a2e940c5", "value": "T1FD36123FB268753FD5AA4B3106739210597BBA61B92B8C1E47F0090CDF2A5711F3BA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725351, "uuid": "5d761c96-20c2-42bb-9516-e68e8b775623", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725351, "uuid": "43ebdc08-f1d4-403e-86b8-448bad0bf7df", "value": "98304:JElIhK+8W5WdmbCJ5v+RRP3Zid5bkttjJNe6Yo8C4Esgj:mIgzxmbc0fZugDR8ztK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725351, "uuid": "095a40e2-f717-44ad-806f-4c9c18c2766b", "value": 5037144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725351, "uuid": "48ff968c-a000-4ce2-9234-9182f2884020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725351, "uuid": "8c3ef4c5-f631-4c8c-ace5-2755d42e50fe", "value": "SecuriteInfo.com.Trojan.DownLoader44.26037.17339.8019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ecd32e-c079-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706733757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706733757, "uuid": "8671e08e-6e77-43df-acda-e2f4bdd51bb6", "comment": "Malware payload", "value": "6922c8d97e6d60135a3c55302ce1eecf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706733757, "uuid": "6c3b9d02-0b36-4c33-8165-757a364f184e", "comment": "Malware payload", "value": "de69281050c18627c8e75a3f4cdf933db77ace2a8dd13ef753f61ad6e0a405ad", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706733757, "uuid": "8719ca62-d95e-4cfa-ad5f-3a2a196d920d", "comment": "Malware payload", "value": "f3714edb96b5db59b392058292ed486dfd3d3629", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706733757, "uuid": "66089bd7-5867-4f83-b22c-67f15128bd18", "comment": "Malware payload", "value": "243c2ee455947ca9fc9e5b8a3e774790b29f267baba56233e4481e4e81fa3b89b6eb4704f1d5fdf2adfc078fdb4af73a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706733757, "uuid": "16c191e2-8595-4bc1-b706-66ec104b4b71", "value": "T1FBE57C326B5798BEDFA332391F22726010FE6F50D5417D8E2190B8DCBAFDAC025A5B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706733757, "uuid": "c4f0989d-5125-43f5-91d2-8dd028430fc4", "value": "49152:qpUPqczdMZnZajVw8XsmOL8ruQO7/rsGQNTRJD+jQW/XRaWEr1bCU:qpmBUZaZw8u8rJOjrsG2apKGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706733757, "uuid": "f2fffad2-0279-470d-9b34-6a107ca1a8fc", "value": 3305472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706733757, "uuid": "06a931b8-ecf1-46e8-9186-e868a4019c13", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706733757, "uuid": "e1b61bcc-a737-4fde-9ee6-10d55ecf1556", "value": "tset.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e24db29-c015-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706690876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690876, "uuid": "c8bb98a9-3475-42ab-81e0-a751b24184ea", "comment": "Malware payload (LummaStealer)", "value": "1195cf8d63a7b6b458fa99ba2953ac55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690876, "uuid": "5b7d412e-db9b-457c-a11a-08f46c241f6e", "comment": "Malware payload (LummaStealer)", "value": "de92a674c25a9e2b1111f9c38c29349c9ab05740b8cd9090009ef2f5784b540a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690876, "uuid": "78997465-bfdd-4f31-a2bc-ae2b1a53488f", "comment": "Malware payload (LummaStealer)", "value": "13d570c86acff24e86753a255794a1ba81d0f8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690876, "uuid": "9fa1a7dc-0586-4c51-93d1-14ae8386c984", "comment": "Malware payload (LummaStealer)", "value": "440577de49c7c1f75b024f1aa5da9e3f796a15e5f659d92c7ebea919773b33d9768343e26bbb86c20d7afe47413c9d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690876, "uuid": "3e4c0fd6-80e2-46df-b321-90c0f1796d4a", "value": "T15AE47C6B8638C463EEFBDCB5ED6491D6A42740B2199CC08D36CD0D4DBA32E265E9D01F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690876, "uuid": "d534b0c8-f466-4980-82da-f9fded09ac41", "value": "2b7b16ea6305513a3787fed6f5a40b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690876, "uuid": "b563cf28-cceb-4406-beaa-6686b485cd5c", "value": "12288:eAbw4xp9+KR+G6p9wKvIAHDhCwQipdjYcUAwAQKufD6t+Te1y:LbTT+R5LDY2bQr8h1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706690876, "uuid": "191ff0ae-24f4-4970-bcb8-f9338be8c8ee", "value": 680601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706690876, "uuid": "630a2aab-d033-4210-b248-3729faa7625a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690876, "uuid": "449aea00-74b1-4be6-9c9a-f165198d897f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ad5f96-c001-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1706682160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682160, "uuid": "8ac767da-edf1-4da2-993d-5e1da57adba6", "comment": "Malware payload (DBatLoader)", "value": "a667ff2e8f4007d1b40449ac751a693e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682160, "uuid": "4e7fe446-44d6-4f80-bd73-e0c6bd45514b", "comment": "Malware payload (DBatLoader)", "value": "e00b020693b64420cfc377b1298406a4afe67842edbbd2c21205913e24ce88e2", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682160, "uuid": "5b11d6a5-15e5-4581-9cd0-b560a9d14280", "comment": "Malware payload (DBatLoader)", "value": "753798062dd167008c92b9468b79e0aa26ec2aa8", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706682160, "uuid": "2b126696-6933-4da9-b32f-db69f111a2f4", "comment": "Malware payload (DBatLoader)", "value": "2f62e7dee9d25e1a1ba6ae8bc50ecb8449da6605768b23ec60dcee96a4e5cdfd6be766f6c4dfd82afeecac8c65192494", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682160, "uuid": "fb60da15-2a0c-4adc-b209-f4cd755ee9d7", "value": "T1A985BF2276D4453AF222B47517967BADF81D6E3C98266DD566F0290CFB33200FF0866B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682160, "uuid": "12b9b753-4f3e-4750-b229-5c183f0ff5e0", "value": "803e5638314db11a8b34fc1a6c4885bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682160, "uuid": "d882cc45-b89d-4fb5-863f-12ebdde70411", "value": "24576:g7+dhTZPoW+yd+NM//vHQqlTHl4Vb24WX3k7wXTz8QGFUZfM+7Dfavrjnpir0gOv:gcP7HHQU72UHk7c7mvrq0gOPGQJRWuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706682160, "uuid": "74edf7dc-633f-4065-8d99-58779aa42381", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706682160, "uuid": "60a1747a-bf3d-4b01-b478-dea76b0707dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706682160, "uuid": "ecf7d517-26c2-4a6a-a319-ac24015b6682", "value": "SecuriteInfo.com.Win32.MalwareX-gen.7190.4419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b567dca3-c065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706725356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725356, "uuid": "a94f411a-ab4d-49d9-b5d8-4a479aad425e", "comment": "Malware payload (Mirai)", "value": "00cbe3044487345a49fb0a2c508ed3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725356, "uuid": "6b647719-0724-422f-95f9-5221555daf89", "comment": "Malware payload (Mirai)", "value": "e1069f0a7aaacd7cca25fed63965cc15ca5177ac11778db739a1fe2a947aed7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725356, "uuid": "746303de-03cf-465a-868c-51163970fd1d", "comment": "Malware payload (Mirai)", "value": "f31e680ee06e3d148425aa98f288f3353992495b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725356, "uuid": "bbd604d2-ad42-43f0-b176-9ab0bd3dc845", "comment": "Malware payload (Mirai)", "value": "91bc135e944ab7ab0f1478071371c9b1786b4fb3f802c9e825ddd4d43f3781ddae16b0123961ae3f66744920bd784989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725356, "uuid": "9a1bc6bc-0106-4c92-9c7b-dcfd28687f3b", "value": "T139C2F1262B920CE8C11A6134715508DF1798C9E40FC9E62D3A283AE471BFAFF653C4BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725356, "uuid": "a454f33c-3881-4f9c-a7de-3fe225d7c2c4", "value": "768:aeSaFyQtu3ggvBiPEKz5+VHZPsK0KPJhu71Wx1HiI:8a/ZgvcM/HZPssPB19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725356, "uuid": "9cbcd3de-bc72-4b2c-b52b-97dc2e1b3373", "value": 27160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725356, "uuid": "4dfb5a3b-2bff-44c5-bd16-c87cdd4ff06b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725356, "uuid": "ed3d1890-78e6-46b5-9ddc-ebc641d3a11b", "value": "SecuriteInfo.com.Linux.Siggen.9999.15051.12672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3395c2-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706698124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698124, "uuid": "04a598ec-8c7b-4706-a126-cfc4269a5cd9", "comment": "Malware payload (SnakeKeylogger)", "value": "c5b1207624c215d286c55e9c26b076a4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698124, "uuid": "db5037a6-d88b-4b2f-b6bd-5e3f014e036b", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b2dd05d9052c5af5d376482346ceb7d01654fd395344ae59533a761c792749", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698124, "uuid": "9676f812-5932-46e9-be28-0ff1ce3b00e7", "comment": "Malware payload (SnakeKeylogger)", "value": "511d995a0de5291d3da99232e9789d400c80a46d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698124, "uuid": "768cc175-12f2-4b9d-9c8f-b634af634694", "comment": "Malware payload (SnakeKeylogger)", "value": "2b6e8829d55921c3d58f7b509965d7503e4841c994a399b8d09c2cbdad3e4a9f93689c0971d197f38bf16a5fea25fd14", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698124, "uuid": "103a9441-6182-47be-9b73-5bd762989c17", "value": "T15651E0152ED622E9E37787366BF9F2BB4261F861D92D5A7C014081C48B76640FC35F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698124, "uuid": "e9b6de00-dfb2-4dbc-a30e-efd34d166783", "value": "48:8WAIFugnN2YzaMjG2jS+dkbj3AoiYetabc:8XIvnbXGp+m3AYet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698124, "uuid": "18e99552-619f-40ca-b1ff-49fd413c0c20", "value": 2551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698124, "uuid": "54d0eb20-7e93-4da1-9741-b28a908097f2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698124, "uuid": "bcdfa7cb-36df-4697-824d-3e320d0e2c06", "value": "Tender INP-19472.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d4d57f-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699377, "uuid": "cd6b588d-7992-43ae-a8ad-bd75ad1f0479", "comment": "Malware payload (AgentTesla)", "value": "7ef0637b78458e352b7dabd52dcecdda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699377, "uuid": "abd7e09d-f734-46f3-be1a-f6cfb233d86f", "comment": "Malware payload (AgentTesla)", "value": "e45d04ff7d7cf56be94c3a62cb66f2365d861e1a8c1145d3ef602d2bc68a08cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699377, "uuid": "5abf20c8-1435-4817-b54a-866412261acc", "comment": "Malware payload (AgentTesla)", "value": "71496c00969ede017fcfea669724c474fc040a53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699377, "uuid": "79df3121-e3d3-4380-977e-ffd4d65566f8", "comment": "Malware payload (AgentTesla)", "value": "0478c7b8d96caaf66fa36f6896b79be404c132cd507ba13289f85da18f0405280f47aba36fcca8d683f71cd2cc618951", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699377, "uuid": "8dce1836-7739-44aa-9b55-bddd71c5a930", "value": "T12E159D9C325075DFC957C932CE981CECEA606C665F1B9203A01731ACAE2DA9BCF155F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699377, "uuid": "61ed80b0-d9a7-49a5-919e-f588738685ec", "value": "24576:UxUFc0iFIDOmWuNCPnkF2pbVdItyew5H:dRPDlWuNQnrpbVd6yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699377, "uuid": "e717eae4-100d-4b20-b460-5a6f4119c3d2", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699377, "uuid": "2857cbb5-7330-455f-a751-bb66ff47b1b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699377, "uuid": "a46e3263-5e78-438b-a1f9-036737abdc1e", "value": "Pament Reciept_1302024_pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3137be5-c02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706701381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701381, "uuid": "73e12ee9-1852-4c3d-8326-42809cf780a5", "comment": "Malware payload", "value": "d244f0a65e6dc1fed472efe41b5ad19e", "object_relation": "md5", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701381, "uuid": "3c0be0e2-120c-460a-a203-ecf1040d7c2d", "comment": "Malware payload", "value": "e48d391be93d37944742b6ebf1e68c9ff386dd60e72852783a0941ca2cedc4ae", "object_relation": "sha256", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701381, "uuid": "320584a9-ee30-4c74-b68a-6f7ae9bcd93d", "comment": "Malware payload", "value": "20bf5977890c675f64b661b9b71ce4bf3c974370", "object_relation": "sha1", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706701381, "uuid": "902b6c47-0d33-4edf-a0c0-e360a0c76211", "comment": "Malware payload", "value": "328c4bf97ed4cf36a1a9f1db09e103798f9d70ff3266f93428752ca46c57327127c1716ba56e4368090a4ff7098d6852", "object_relation": "sha3-384", "Tag": [ { "name": "BlendyBeta", "colour": "#0C8B1B", "exportable": true, "hide_tag": false }, { "name": "BlendyGame", "colour": "#909E9D", "exportable": true, "hide_tag": false }, { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701381, "uuid": "c225efa5-e01a-4178-892e-61b666734103", "value": "T13EE7339820308938DB1EDCDE728B507DB07F78E58702B8BB651B662249916FFD077E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701381, "uuid": "a590e915-a365-40b1-9fee-ef26de115192", "value": "1572864:I9tpzv9fVxvx9v001bltXSUa7jijCkNl+BZb9VxZmcvIR+:SpvFvxttCP7gNl+7b9rATR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706701381, "uuid": "5f765e17-0116-404a-a0cf-37969c83c342", "value": 69790224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706701381, "uuid": "05346a55-b107-4a4e-a540-48d553bbc73e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706701381, "uuid": "081e07ee-11df-466c-a5c2-3a3a861f2b3f", "value": "BlendyBeta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2966f9-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706686018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686018, "uuid": "8ce647be-5e5e-44e8-a396-d99bd66868a5", "comment": "Malware payload (AgentTesla)", "value": "dca0153abefdf1816368e1b6ca7b58c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686018, "uuid": "d3c2adae-9b72-484d-8c15-3d6755d7005f", "comment": "Malware payload (AgentTesla)", "value": "e5313fd6dd8c8a88a8e1e59feb2851e752d299a12184761e0982c4f0650a634f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686018, "uuid": "1917935f-b096-4e7f-a714-466555a49171", "comment": "Malware payload (AgentTesla)", "value": "3896ee50a6416aaf26468b6160594361bac2f9a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686018, "uuid": "9c2fac80-f49e-49ec-a036-29555ffbb8c9", "comment": "Malware payload (AgentTesla)", "value": "3b35e6f2fe56142b39a5260f3a984ea9af4f8fc8f110d64732134cc1e702368f1322c847f6ca34ca4c1c449304781080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686018, "uuid": "70410fe2-b3c0-4b82-9ab6-89ee5fb86bdc", "value": "T1D1E423267A718B96F5B54BF6523A400103FE753F2925E6192E8320C35DB7F81CA32B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686018, "uuid": "cbc93476-baab-4238-99ee-fc65e66868d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686018, "uuid": "513db4dd-95b8-4989-89eb-8f03e3ddbedf", "value": "12288:kkNAYQ4pxPd8Q07ZrLhCDbu8nf9jfNh7OM7gUoCisxbTWIcR8zuO:HAIlzirwDi8nfFfN8GgRZsxbTWIcuzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686018, "uuid": "e6d02372-8770-4f5d-ac24-947a30cabeed", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686018, "uuid": "631e2505-4ef1-462a-883a-aae8c6fe4864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686018, "uuid": "2df1f069-b0ac-4bd5-bcd1-8c9fcc978d9f", "value": "SecuriteInfo.com.BackDoor.AgentTeslaNET.5.17707.12837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34eb48f-c015-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706690966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690966, "uuid": "ece11806-46df-4bdc-8526-afd826da19fa", "comment": "Malware payload (RemcosRAT)", "value": "ba20cfd84b497902bd02f32b8a41552f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690966, "uuid": "17b2e4e0-8280-49f7-9f54-edd9b271a146", "comment": "Malware payload (RemcosRAT)", "value": "e568039b89b31c048803401ee0f8f3b1d521d30518e214a50cf0c9dcb022c8ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690966, "uuid": "65a1e983-f3a6-407e-b860-e574702607a5", "comment": "Malware payload (RemcosRAT)", "value": "5143fa5722d2d8ec1deaaf36a62461a6e8a44d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706690966, "uuid": "2436acb3-c5ca-460b-819d-472ee06a5391", "comment": "Malware payload (RemcosRAT)", "value": "d230816459ea9c6bcec450185b8dff874746cfbaffb8c51f918689b866bd601c2e63c97af6666003f082da940aff8c8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690966, "uuid": "c17ffb76-9f10-494d-8085-5b1651ff3568", "value": "T179B49E01BAD1C072D57524300D36F776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690966, "uuid": "a9ba2b10-af98-4c7b-bae3-93ccecf1f19d", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690966, "uuid": "31e2e317-9f0f-41e3-9b3f-8f30fb870630", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNw5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/Zsdcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706690966, "uuid": "88ba3156-3a9e-42bd-a423-fb14047c68aa", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706690966, "uuid": "bc29b0a8-83ac-49ce-a644-f12a4b94a957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706690966, "uuid": "f4ab8b2a-477e-462b-823f-4f5aaf527be9", "value": "xhypjhBYLasX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b784653e-c04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706715910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715910, "uuid": "7fcb5857-2d56-44a8-9132-110d1e7b1345", "comment": "Malware payload (Formbook)", "value": "93308080a9a9d5fe37c502c5ae37b12e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715910, "uuid": "45d6fc65-d9a2-490e-98c7-7c9570418c1e", "comment": "Malware payload (Formbook)", "value": "e57175d3275176ef5b61d06e25f3b4d68d61ee25af760e5736275506c775c40d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715910, "uuid": "3cca865c-6ceb-4917-923c-25d0d5f8fac9", "comment": "Malware payload (Formbook)", "value": "810c3f699cce58870d43f2a9791a6f522679d900", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715910, "uuid": "1685bd6f-8247-4019-8fba-96fd78aaa7de", "comment": "Malware payload (Formbook)", "value": "e220a51c51e42c6abb07ced47d0a1f2224b741b068be098f1caa9187139d507f56b17237808b7b6199c004041cf41a85", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715910, "uuid": "4410b490-e6b0-47bc-b1d6-267d0bb5788a", "value": "T12DF41244A7AC871BD2AE97BEA1B5101017F57A176143F30F9DC274DA2C3BBC04E816AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715910, "uuid": "fb29537c-5c5c-4b55-b84f-f39153d3728e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715910, "uuid": "4e50a493-8894-4dce-a6c5-14c1d886d32a", "value": "12288:T/yVc8j8qshDcVgJeeVQsVY2KBmynmzBuyAWlZBILEstyj3EicmNOkc9RZNbRFAY:T/yVc8bsh/znVY2KcTsyzaoskyg+NbRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715910, "uuid": "111df891-7d19-4e13-b6e2-89881fd611c2", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715910, "uuid": "4401e6d7-206c-4f14-aff3-f64edacea7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715910, "uuid": "47a5577f-0537-4fec-82e2-1ddba3fd576e", "value": "DHL_Express_CBJ231025122556.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a12cbe-bfd7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706664472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664472, "uuid": "6d653f3c-79f8-483e-8602-c34acba395a4", "comment": "Malware payload", "value": "bc67f38183e777fad39ef58cabd3fe40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664472, "uuid": "48bc6d83-31f1-45a5-9d65-29a41169f398", "comment": "Malware payload", "value": "e578885cd6e8b2e1ee354d172bebd4d1829527f3fba9abee19b1db53a83d383b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664472, "uuid": "214a7c43-15c2-4bc1-9bf7-01457c9fafdc", "comment": "Malware payload", "value": "adb3bbe996d2a41e2b51f001bf531356eb2da762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664472, "uuid": "a347c380-9839-4ee7-abe6-eccbb57d4d4c", "comment": "Malware payload", "value": "685b683905cee93457acc0482854d9b6f926d39886b2057d3341f7aee38737ced5bed4a833eaa4dfb06c43ba046cf29e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664472, "uuid": "7efa305c-de91-491e-841e-c6d5ffd4f517", "value": "T1F9C6232BB268613FD5E6363E4572B270497BAE5168368F1A77E0340DDF3B4601E3E606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664472, "uuid": "ab98399f-76de-4f10-b78e-8baa6534e7e0", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664472, "uuid": "866bb70d-2761-4d33-85e8-106b832ba97a", "value": "196608:KNQ+RL6Y6qZN1/3qPAzXjxW21K4hqTlxJ9s4e7ozfxocLKk+rQqpoO2uGO99ymTd:KNQBY6qpMAbjxWyK4hq99s4GY5hX6Q0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706664472, "uuid": "df4e804f-925a-427c-8ae1-4018330f694a", "value": 12359280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706664472, "uuid": "4d36464f-8408-47ce-9f9f-c42997650812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664472, "uuid": "c3555b37-fb16-42e8-aaf4-1c59b6ab9f1f", "value": "SecuriteInfo.com.Program.Itva.3.25171.4872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c22ba4-c065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706725353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725353, "uuid": "f0c08548-1cf6-419c-a761-22e64615b5db", "comment": "Malware payload (RiseProStealer)", "value": "b32bbdec2f4265130cc68c72064f8762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725353, "uuid": "def33193-9e83-490f-a4b8-154af206a175", "comment": "Malware payload (RiseProStealer)", "value": "e7cb9f69e8d66fa7990692922dfb473759e0c107fad7d256f875f55b36184feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725353, "uuid": "2a7c3b3e-19d9-4113-988a-6da467230691", "comment": "Malware payload (RiseProStealer)", "value": "01ec2887f9273385d9614fc49ab12e4173d3c4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725353, "uuid": "26a7f1c8-70d8-4241-ab24-11e7fd4a3851", "comment": "Malware payload (RiseProStealer)", "value": "567ceb0af34c68ca561120209fa9d1919c15abf3905cbebebcc42b05200d27a58517f8a4e0aae364f9df42113e3f015e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725353, "uuid": "be75d129-1c6b-46b1-b8ef-5454388b13e6", "value": "T1B1B533F744F35084C16743B47A5EDE00880BBC9F40268269B929F593D3BFAB5E19AE53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725353, "uuid": "754f42a8-1d1a-4b5b-b1e5-7b7874b5ce9b", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725353, "uuid": "4b11165b-aa78-4915-8fa5-2d2bed9f378f", "value": "49152:XcOYMy/6LPyvl+uAf61DgwqL4LMgDTbKlw70dalV25UGfCqr:sOYMhLKMN6GwqLCMgD3Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725353, "uuid": "c1a4519f-8699-4aef-9a9a-328e7b8fd097", "value": 2349568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725353, "uuid": "2a511d6e-750e-4e30-87a2-3f0aa3f0dce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725353, "uuid": "381618df-925f-4b8e-8213-3cb6bb52d4c5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27291.31609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345a296b-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699369, "uuid": "f219df31-4ead-4101-a216-15d42f747be9", "comment": "Malware payload (AgentTesla)", "value": "a27b42833718e4a8bd923dc244afb5f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699369, "uuid": "7d3943f0-b947-48cf-b1a1-f20d52b664cb", "comment": "Malware payload (AgentTesla)", "value": "e8b6202dfa3b0502e87b74de2cf563b05f6396be1606af3051edb059efb55afe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699369, "uuid": "8c291ac7-c098-4584-b659-51a84694e1a4", "comment": "Malware payload (AgentTesla)", "value": "647823f53f4d48cf42ea9b9b033dae08ecccfcfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699369, "uuid": "15ff198e-8154-4514-a5de-edb812789e34", "comment": "Malware payload (AgentTesla)", "value": "5c82e26df6f3922c4fde9ca21eaaef0be14d178898d0da71a7afa08f3d5ab4ca80240b813c1a48dabc7c593c6b09d080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699369, "uuid": "ee8ef3c4-2b12-4ca3-afef-19299256a699", "value": "T196F4122437A85973E9AD8BB5CD5101CC43729E373EA6D3DB2989B09C11F33865BA2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699369, "uuid": "9eb8a550-c5bc-4b67-b79a-d5cefe5b64e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699369, "uuid": "5f2e47b0-5bf6-4921-ab69-1160b04e969b", "value": "12288:xrs9SCF1OUaK+HKExqAP70cIpCiO6ICMF/za1+kMdaG7tqegh/4KHjt:ps9ZXRLEp70d4ypHYqeC4Ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699369, "uuid": "9fb5b7be-e06d-4e59-9998-aca93080c8e6", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699369, "uuid": "3082c119-8668-4db8-99f5-e0061a59f093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699369, "uuid": "5e472c4f-462d-44d5-a989-fa7f6dd5480c", "value": "Quote Quo-24-072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfcd40a-c028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699196, "uuid": "e4e9fdc2-4714-4b8c-a322-2367c75473af", "comment": "Malware payload (AgentTesla)", "value": "84b26a596f15ca813f3ef6cf0126f3c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699196, "uuid": "ce7b7b98-1f6a-483c-8bca-bc88989477c8", "comment": "Malware payload (AgentTesla)", "value": "e8c1bfc12848a7b1a67f49a1048bcb6f7f1630301bdd3c5970278a612ab53a64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699196, "uuid": "0898fb98-ae2e-4216-ae5b-c5664b1bfbf5", "comment": "Malware payload (AgentTesla)", "value": "ed83d93dff774eb16efdd99d28c28c6df12b7039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699196, "uuid": "e3730a63-2a7b-4f78-a4c0-2c39af314601", "comment": "Malware payload (AgentTesla)", "value": "6edf661ea883f318e99ab1335ec2ce060ace16d8235f7eb83fa7205768a4134fb5a0cf4a88fa32aa05f3a7ad08b64509", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699196, "uuid": "bd2c2b8b-1849-4ddf-bda2-b3a28244bb35", "value": "T167F4120877D41813E92E53F5DD7442DC47B26D267E81E3CBAE80749E4AF2BD50AA2327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699196, "uuid": "909ebba2-8695-4d2e-9845-e190d3e23c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699196, "uuid": "00e3162c-b37f-4cce-9645-096d7ec3a346", "value": "12288:uulO9SCF1OqkzqzwsrU/98PA50U1Jza6pQ/voxp2L4YgNWgCrP1HX3Rg92OA:vlO9Zrhrc8w0U1AkQ/vurqrBCYOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699196, "uuid": "31ba39f0-a043-4e54-8c78-d2548dfb759e", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699196, "uuid": "ef46dfe1-d170-455f-82c2-b1f9b39a7bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699196, "uuid": "54d995f2-1765-4b3e-ae62-d76dc5ad6f5c", "value": "Wzq5KvM1qfJ1lki.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48b5cf2-bfd7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706664473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664473, "uuid": "d8117084-b3a9-45c9-9168-d272fb047deb", "comment": "Malware payload", "value": "0fcba9339611b06d47c1ea992d7c3cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664473, "uuid": "e5876591-69ce-4abc-8da1-9303b365dae1", "comment": "Malware payload", "value": "e91ae49f2800d6ba72c9aea3cb2d477fe457b29508cdffe2939a1866a0ed9191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664473, "uuid": "fc5aed70-a49f-4f72-bb16-391d5b8a39c0", "comment": "Malware payload", "value": "dea4db89a2c0853aa496cbd2c2c37b945103d84e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706664473, "uuid": "5d1655c5-cb59-4081-b763-d5f729ad4a04", "comment": "Malware payload", "value": "630bf11624cd296219329bcb31fd1fc818020862a49c9e737cfd10dfb59035a05538eb4a9c8ffedbf568adc9ff8d159f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664473, "uuid": "953e4e63-c907-4bf0-9f62-5c1812e63774", "value": "T1FC940111E5E8BC2FE92175BD5A96BB0D8314A0E78B711A27F804344FEE847439BB2D74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664473, "uuid": "2e6a7f02-c338-4d63-8b87-225b4128281d", "value": "4bfa6e825a4206816ed8756369bf3f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664473, "uuid": "d4da717e-ce71-4d1e-8583-9719d66a18a5", "value": "12288:kUAOTRYAOFvJ8y1en4KGsS2nPAlGH6/Rp:TRBy1e4KGePYZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706664473, "uuid": "ea27babf-0f7f-4c4d-98bd-02cb5b48ff8e", "value": 432744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706664473, "uuid": "7a1b2c33-d8dd-4667-b15b-5df31de83cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706664473, "uuid": "f404af0f-4406-40b0-87f8-8d165bf4a3bd", "value": "SecuriteInfo.com.W32.S-13b40a75.Eldorado.13341.2644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a467110c-c054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706718026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718026, "uuid": "36710476-2044-45b1-891a-bd046be0264c", "comment": "Malware payload (Mirai)", "value": "8777b2d528c471313a5d0819b8916239", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718026, "uuid": "87c6448e-b131-4e86-b0a3-6de3827cbd03", "comment": "Malware payload (Mirai)", "value": "e9320bb360e76ffe9b393c30695ca5e2f0cbe4aeaef1ed2df32ac0b820e9fda2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718026, "uuid": "a3657569-6813-47fc-b494-c84151cac6b1", "comment": "Malware payload (Mirai)", "value": "da29d7ddbc2b0aa85626c2928526badcfe9a3910", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706718026, "uuid": "596e1bca-c945-45e0-a2bf-1b3e1b5addc6", "comment": "Malware payload (Mirai)", "value": "d6f066f8aafef121e5ff2fe02f8ff68fb1672de31bfa12de21bb0cf37ea89cfe5aeda03ff9ceea13ff2e10a855957982", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718026, "uuid": "60694561-80db-4e69-a49c-36d07117e10b", "value": "T126935BC5F683D4F6EA5705B15137A7329733E43A602AEF42C329AD36DC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718026, "uuid": "7ea378dc-9540-4692-87eb-cd6c13385baa", "value": "1536:WWmseUZNsbyI+ge96KUXUouggIyB2PRf1SwRXX0:VOUZcyIVM5qUHgSBu8wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706718026, "uuid": "7ab08aa0-5b05-4ec4-b782-6941106607b1", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706718026, "uuid": "0564f754-1be5-456a-b01f-220106750223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706718026, "uuid": "3d362011-9448-4941-94e0-6c08891d9f25", "value": "8777b2d528c471313a5d0819b8916239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ae1067-c023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706696954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696954, "uuid": "66274fcd-cd69-49d3-bdf4-afca00629b17", "comment": "Malware payload (RemcosRAT)", "value": "1193d6254d111f82031bffd12fedbb84", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696954, "uuid": "540ae763-e953-41ef-8247-72c5ee12ff7f", "comment": "Malware payload (RemcosRAT)", "value": "ea535ce23faae6989de67ca05ae39412399aa927ea8b60c4d0f20075403dcc27", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696954, "uuid": "4f9cc3ea-47b0-4711-800b-a97fc8ef2f20", "comment": "Malware payload (RemcosRAT)", "value": "4b854e2cc20dbc5e61b3f2e4665adbbc51d69601", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706696954, "uuid": "8d0de464-259e-4a5d-bd13-6abc7a76dad3", "comment": "Malware payload (RemcosRAT)", "value": "d3ab81a5633f0b21c219f0fe71451475bebdf350e518b7da1c578d9be2f9fd3d0cbd0784024158524d32f95ba9c8faf4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696954, "uuid": "c1eb7828-d073-444c-a1ea-771a5df312ae", "value": "T15CA5D02367E14836F122A5795AA73AA5E92D7D202C367D8977D43C08BF333407F186A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696954, "uuid": "55a3dd5c-6b76-4190-81ca-2b03b403c5fe", "value": "b849c32c8477f283a2e1a1b6798d89b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696954, "uuid": "03d03f26-43fb-4ade-bb73-5282505b9c0f", "value": "49152:pqAodhXjnxf2hd7c7mvrq0gOPraF5P0R:pqAo2hd7Ymu0gOOuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706696954, "uuid": "766a5c83-18b0-4c09-8870-94f43639c2f8", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706696954, "uuid": "33df7dd5-335d-40ee-8099-185b86fe3798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706696954, "uuid": "5453cb24-edde-4fe0-b8c0-1a09f9982a18", "value": "Aviso de Pagamento_ Banco Montepio_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef142a6-c04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1706713936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713936, "uuid": "6a7451e1-3731-42d3-a8f7-6d13e9b9bb43", "comment": "Malware payload (DarkGate)", "value": "426a59cd5e215e9f3696c1dcc8455d20", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713936, "uuid": "4265e5d1-8ce6-4f39-9d4b-49d0455280de", "comment": "Malware payload (DarkGate)", "value": "ea673e0e6986e41a73c19dd2a9cfde3d2d4186ef52c23c1253dde2d54faca7b3", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713936, "uuid": "6816b44a-80d9-4f8c-8a45-14f96833c485", "comment": "Malware payload (DarkGate)", "value": "255d113da1dc32c3b341e643c01e9f5a13e060de", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713936, "uuid": "cd031951-f7ff-4ee3-991d-f6484698f29f", "comment": "Malware payload (DarkGate)", "value": "8e75f743f19274b1815ff68b2ec64bead304282d9af84e51fa9e9e4a2d5c8687b67a48f3221a234fb33293e089137fda", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713936, "uuid": "d5db3e78-4870-45c3-b25a-29a71e0397a6", "value": "T16E06AD86666187B1F09D3E7F25B213EA0DFE7F240A41DE6746D06A88CEE534C1F225E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713936, "uuid": "1038bca6-5b6f-4778-b042-5145ba1350a3", "value": "49152:TpUPbczduZ0Yx87nxODZGMFLnd+A1m4wcMO6XOf4BmCk2ZlZ:Tp1BB7nxOtFjfBwpOff4BmCk2Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713936, "uuid": "74967f4e-5c63-4700-8083-7eba27a6eba8", "value": 3837952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713936, "uuid": "f60b5df6-152c-4b55-9e34-693ecf3f0f60", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713936, "uuid": "be5a9468-80f2-4cef-8c4c-6535a9ff0c50", "value": "doomday.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da9db18-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699358, "uuid": "2c7b06b1-e68a-4db7-9d68-e4ef886639bf", "comment": "Malware payload (AgentTesla)", "value": "24028ff2b1a0135c7c9f524a9f4415af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699358, "uuid": "2c7bc64a-4337-457b-84bb-bc1ea26d5dc9", "comment": "Malware payload (AgentTesla)", "value": "eb16562b15abf2d0b58658b014ba5d6a7dbf34c3df7921b25ae17d58b9f5929e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699358, "uuid": "eeb3df76-0560-47af-a78f-725f3d8977e3", "comment": "Malware payload (AgentTesla)", "value": "459008200b45166fe0c0eabca940adb9f15089df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699358, "uuid": "bcc378ba-fdfd-456b-bf27-02c49d90fb48", "comment": "Malware payload (AgentTesla)", "value": "f6d0e23e7949e917089c809485b0b6fe7b62a7c6227092702d9098c5319fffef7f313c2a86cabb262f71b95c4b621790", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699358, "uuid": "156ae771-ce0b-40fa-a79e-1de51e0a5f8c", "value": "T1E8F41204779418A7D96D0BB8CE2552DC0372BE25BE49D3CF2DD030AE5AF27A69381A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699358, "uuid": "6226c2d6-20d4-4b3b-9a18-f46103c397b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699358, "uuid": "262a6f38-4a58-4a4c-bc04-06d3e2ba266b", "value": "12288:E0A9SCF1OCWfW4VE8HYBEZtPEmO8CDT0CUMJ8lUuoKZxkOY74okO5NM4F+5dPkMs:bA9ZtWbEivEymalS6FjedF+5+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699358, "uuid": "1f212d3a-e267-424e-8e35-1fba927a6d48", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699358, "uuid": "a6b22bb8-f265-4b40-84b2-54ff64c55d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699358, "uuid": "f800670f-ebd5-4d24-9a25-8f2fd5af5994", "value": "invoice #3106816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae600ed-c00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706686308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686308, "uuid": "a1a0c124-4791-4be6-b9e7-a5b88efa8506", "comment": "Malware payload (Gafgyt)", "value": "28308565dccc9694156e1efb82c78e13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686308, "uuid": "d36b4538-8669-4dbb-a96a-06ccb77c7540", "comment": "Malware payload (Gafgyt)", "value": "ebda5d6cc546384fb7ccc59d450251dd0608119d2510d1fad6a37538b432be3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686308, "uuid": "68d198b0-4c45-454c-9162-c7b67b76eba5", "comment": "Malware payload (Gafgyt)", "value": "99a16500adefd1fce7c139cb2ddf3a4b7b7fea6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706686308, "uuid": "7d27c8f4-2bb0-4897-9b92-9051c1fac732", "comment": "Malware payload (Gafgyt)", "value": "2ae371c92dd719d19adcadda2cdd06bd65b9b468fd2d5d102107b39850334cc20a69c095a2835f394448adff649ee7a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686308, "uuid": "1487d226-5d3e-4638-8e66-652e288701d3", "value": "T12EB31B93F511D5B6F44AE73308D38B247270FAA14F53152263173BAAAE362D4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686308, "uuid": "0b2216f7-d31e-456d-a394-0a5478b5b95b", "value": "3072:4wQeqacWucW0JcWcBeNX2WfKIwMI278ORF/qnFH3mzmmHqzTQKHKtW:4wQeqacWucW0JcWcBYmVM978Oa18mmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706686308, "uuid": "ee115e74-12fa-4623-8559-f7bb1d316b08", "value": 109567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706686308, "uuid": "b646de54-f91d-426d-b014-222315f5e86a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706686308, "uuid": "c0941916-1ce2-43cc-b5f9-25c68afc5398", "value": "28308565dccc9694156e1efb82c78e13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1a9885-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706698789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698789, "uuid": "819ef991-b612-4af6-827d-b3e493c24322", "comment": "Malware payload (AgentTesla)", "value": "948b2914523af55cfab04313586e7075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698789, "uuid": "3e2c704e-9d7b-4f01-9be3-efbd1086879d", "comment": "Malware payload (AgentTesla)", "value": "ed76a60dbc990c3782c3d88fa9d03b9abe65b311b44d8b853ffaac09b7dff7e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698789, "uuid": "0963f091-adda-4a29-b92b-3f891f74432a", "comment": "Malware payload (AgentTesla)", "value": "cc796456d01bb603ca56a60ebbbbb80141f74dd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698789, "uuid": "68ec8a33-f6f1-4bb8-ad30-59890d40714f", "comment": "Malware payload (AgentTesla)", "value": "68f1d62dcbfa54d8b98ec3f9cc6e2795d8bcb62e37a1769a07cb06c39c1bae5aa0601042f15aa1458356afeb79952a0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698789, "uuid": "94ec119f-e9c3-427a-9b6f-6e99940f803e", "value": "T14C05BD84D9545AA0ED2C9BB16636CD3193333EAEA834D52C2CDE3DA73BFB7921111853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698789, "uuid": "055859e2-eeb9-4a1d-976c-bc811e0f512f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698789, "uuid": "e931d94a-fa0c-4d89-97db-f4d0903064e1", "value": "12288:KyM/+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8lLP7r9r/+ppppppppppR:Kyja6u/ZKCcmdqw6S2dRL1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698789, "uuid": "2c967b15-1521-4a11-ac4c-b12579efdb3d", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698789, "uuid": "e50a332a-235e-463a-84d5-f1e253506cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698789, "uuid": "6fc44619-4414-4a79-a368-887543053fa1", "value": "Styles price list xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f7ea32-c050-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706716071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716071, "uuid": "05c8332f-9892-435e-bd9a-9bdaa703c1c9", "comment": "Malware payload (AgentTesla)", "value": "ada96be07fde9b5e9df03982f6fa5069", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716071, "uuid": "0009f614-48ef-4762-b6a1-ae5bcb1b6e74", "comment": "Malware payload (AgentTesla)", "value": "f1451016ce66fc229dcad2d77dd2fbade2fdd7b1bedd1ea4adb6de62b8a165e5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716071, "uuid": "1ec38c30-8b62-49de-80c5-c2e019ade5fe", "comment": "Malware payload (AgentTesla)", "value": "7b4f8919f1e49e771b687d0db7509d618be0e9b4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706716071, "uuid": "f96e4c91-f0a4-4f53-9527-5520de862825", "comment": "Malware payload (AgentTesla)", "value": "b73f35cf98b3bf564272ce195e47aa589037729217faeac3f5714789b2196f1a15682fbe3668fb020eb4ad56e35338bb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706716071, "uuid": "d3f745a2-ccaa-4457-9ae7-80d74b013ec4", "value": "T184F4331A918208CF0E6C5CBF0D95E726A4BD5A9FFA4FC66068717841F673EB805241BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706716071, "uuid": "de4ad39f-7bee-417e-b2bc-e054ec7fdc99", "value": "12288:yDRc9jmeO2s3Ewr90iMkoeFl1E6WpeR96WSHVQuqmmFaF0O2U5E48SZ5S/eyYCsi:yDimas3Zx0DrESpeCWb8F0O2U5i/OHOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706716071, "uuid": "04869046-0fb5-4009-a65b-23ad2f6f17aa", "value": 768107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706716071, "uuid": "a942fccf-49ad-4bd4-9d49-6fa4bfc40f42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706716071, "uuid": "b4d1a442-e3fe-40aa-9576-5c6ba3050e6d", "value": "PR 2000052255.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f306d99-c029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706699388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699388, "uuid": "99156c1b-1052-4461-b9d9-6fc3faecea61", "comment": "Malware payload (AgentTesla)", "value": "7b270e34a717a31372160d6e042b5854", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699388, "uuid": "b256a70e-dee2-4a71-a661-3cfcb1f623f8", "comment": "Malware payload (AgentTesla)", "value": "f202b6e5909b6528bf4342631024bc63b6219c261ef7e0f9d3c4dcf9423064d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699388, "uuid": "4a74319e-7d58-4291-adb3-7c8e4a462e95", "comment": "Malware payload (AgentTesla)", "value": "09a716805c0765173fe8cb1be493a381672198c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706699388, "uuid": "67f08083-8975-44c7-80f7-279af1f0a597", "comment": "Malware payload (AgentTesla)", "value": "ee869fee5edbeb2aa41fc9087f92c2792c373dd5f39f1497aa87bf199c6418ed876693948db682faa63d6cbc9f46c2f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699388, "uuid": "adf53093-0155-4b24-81c9-cfecdb70bf76", "value": "T1E315AE9D365071DFC917C872CEA81DECE6216C665F1B9203A01732AD9E2DA9BDF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699388, "uuid": "e1600149-0c42-408d-be55-2720a5aaa4c0", "value": "24576:ahzxUFc0nX0NHQ/OnRaUR0KdYvGwKVZMRyJKS/V5dm4BSJ:zRhOns40KdYO9+zSXdRBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706699388, "uuid": "f94ba13b-01a2-475d-97e3-71e3c968f356", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706699388, "uuid": "b2be2089-c5f8-4fc6-9b2f-c67297efb934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706699388, "uuid": "c25461d5-2b75-4ef0-b455-e75458306204", "value": "Payment-Advice-Copy001wrNTZLpv65QR0zD.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6c1962-c02c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706700829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700829, "uuid": "524147f2-fd9b-47bc-a281-b50dd1bcb351", "comment": "Malware payload (AgentTesla)", "value": "063c95fab738de42e6444c6f08bf25f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700829, "uuid": "69936a1d-c42a-4337-ab14-e03b42dabafe", "comment": "Malware payload (AgentTesla)", "value": "f322a7a1d67ff10904b653fbc984e11152de5128b935fe94af2da82213ab073d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700829, "uuid": "b9b7b22f-b156-4d58-809f-ac178c34e6f0", "comment": "Malware payload (AgentTesla)", "value": "451b31c2096cb8752244c67398f8d643fa3eea61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706700829, "uuid": "ce14e228-856a-494a-804a-dadd6212b4e1", "comment": "Malware payload (AgentTesla)", "value": "c5ede2bf1bcc2277a228d3d2590ed1658b8fd44e78c45125c9bdfdb4bf486fb3683dd8daf21fd4b7b6d2e3fe36df368d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700829, "uuid": "4cd0f2ab-1f71-4416-890e-35a3ed0aa51b", "value": "T1F3052353665D8B23C2BD9FF51435826407FA780BB4B2D31DADC262CB78A7B804F0295B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700829, "uuid": "5d9e69db-dc31-4277-ad8e-c3da460a7f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700829, "uuid": "586c5b83-b140-44af-8ef1-b006eed3b6ec", "value": "12288:sBZuhVQ03jFgfvtJs7RQHJtvFRsNtravebUnwFvDaU4EaEfo68j8qshDPK:nF9twduxtbywvDn4Mfo68bshzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706700829, "uuid": "1f172bb9-1f33-44a8-8dc4-d6777eb4a6a0", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706700829, "uuid": "79609ac9-f1a3-4321-bf5c-2817af9d644d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706700829, "uuid": "282d25b8-294c-42e8-a387-702eb719be86", "value": "SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.18276.29312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e92820-c066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706725518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725518, "uuid": "37a8c9f5-74a1-4429-818b-192d94bdfe5e", "comment": "Malware payload (RedLineStealer)", "value": "1d48811644eb4ac06661b85fa5a9bc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725518, "uuid": "28ff3c17-b67a-49cc-92a3-83ba5b6b9506", "comment": "Malware payload (RedLineStealer)", "value": "f532ffb50ea02931797c324acc407f9563b519c8454524ec8f955bb248942b8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725518, "uuid": "893489e7-78f3-402f-b1cc-717688dc5505", "comment": "Malware payload (RedLineStealer)", "value": "7a253aa3950f02731e1b3221b75a61c91152e64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706725518, "uuid": "5cb31928-19f4-40f0-89e1-792e6ca71445", "comment": "Malware payload (RedLineStealer)", "value": "212d22f66fc54fb0fcfd2e93475372be59ac94e29a33f875ff3dc0ce0447ec4f475cc32f4de695a477d3cc8c1c108170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725518, "uuid": "a7b15b2d-3410-46d6-8171-0c4952096661", "value": "T1F314D5F06B98BA19D9ACDE3D687101104FB0EC469091EA474DB0FC9A1BFE7425D06DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725518, "uuid": "e057f2ed-01a8-4203-bc0b-f4377cf82993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725518, "uuid": "276417c3-221d-4b55-86e2-3bfd61dfaec8", "value": "1536:JqsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2B3teulgS6pxCPHu:nAMOY3+zi0ZbYe1g0ujyzd5x/DHiJv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706725518, "uuid": "b5e8f935-8259-4092-98d8-3df44c8158b8", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706725518, "uuid": "08935193-c225-434b-9885-a68821e9bf91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706725518, "uuid": "d4807760-2589-44c7-b9fa-abea729d7fd5", "value": "1D48811644EB4AC06661B85FA5A9BC98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3342d27-bff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706678510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678510, "uuid": "4912de6f-8c96-4323-913d-4d1f15da8ec0", "comment": "Malware payload (Gafgyt)", "value": "c8114e98c5f7c00df32b810731e95912", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678510, "uuid": "8977e403-52f9-4625-8f0b-4121f01b9149", "comment": "Malware payload (Gafgyt)", "value": "fabcd804cc243b73e0264aba29acf6dfb352b8a1d284c5e2b649deb417beefaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678510, "uuid": "14bd12cb-85d6-4551-931a-334daf011bb9", "comment": "Malware payload (Gafgyt)", "value": "126a73111bb8ddbb68613b3f4a33f24d28790477", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706678510, "uuid": "f3d00432-47b9-4052-81b2-daf0ad360f35", "comment": "Malware payload (Gafgyt)", "value": "761640092fb849cb41ed8daa2e69a62ca3fbd8c329d05a0e070318fd651d40781cd6ee2ad7b59f182cebb4e9f36e91de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678510, "uuid": "4f24ef63-26fb-4ff6-8142-9d05fc8f43fb", "value": "T1B063028B9721FEB0D4E23072FE4349536F542628FBFE60295A40C16CEF7A55A92E7016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678510, "uuid": "89cb20c9-fc96-4880-86b8-ffc2433619cd", "value": "1536:BDCnt40Iz/tu2KR8kSE+lgmUPkOkAeLzAY9FW/IJjIa:Bmt4DK2kS3lgmUPkO5eLzApIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706678510, "uuid": "21b379f1-b9b2-4bf5-bf30-b6831acc4355", "value": 70188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706678510, "uuid": "7af54fb2-cb6d-47e0-bc18-4129d332df06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706678510, "uuid": "f1c40bea-76f6-477a-9ea8-a940067cf3c9", "value": "c8114e98c5f7c00df32b810731e95912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e59c10-c037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706705417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705417, "uuid": "d60e2391-9047-439c-a939-ddcfb9dc95d6", "comment": "Malware payload", "value": "b7796f62789b21cc93452ed1b107f1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705417, "uuid": "b2f6a0a7-8bd5-4981-bec2-fd8d46b6ce71", "comment": "Malware payload", "value": "fb271ea3bab8547869fec815396c389ace130cc6d8942d7098b9a6a9a3826a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705417, "uuid": "e650c84a-bb78-4369-ba7d-8ee659b43f3c", "comment": "Malware payload", "value": "461f2de0f5168c8083d514c29611d3fbf9e3d646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706705417, "uuid": "4fe4a940-7f92-4d0e-9e52-4111a8e4a62a", "comment": "Malware payload", "value": "3d108cb72a09c4a9518e9da052f48a4d570381d857c2c52c89b142849a71fc8a58907cf696b780a1ee1e1d6363832f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705417, "uuid": "8b3f01ba-9423-4f2b-ae8e-dfb0cc8f8946", "value": "T147D633E4C5B138F1E4AA5036F484953C67F378274B64D66F87A7D24A1F03AE26C79B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705417, "uuid": "693f9b42-9646-49af-acf2-a02e63a0699d", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705417, "uuid": "9f960020-edcc-4c62-aea2-6b60a9c9d330", "value": "393216:xY3ayszf490yDfDxMpfaMPANaA5smg526:xY3dszfm0ybtuf9PAhGmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706705417, "uuid": "8196b3b9-ef6a-4606-9a0b-9c2a36f5f58f", "value": 12624872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706705417, "uuid": "21cb33af-f429-4e4a-99fb-39e71e582a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706705417, "uuid": "3b9ea1ad-8bfe-4e45-9211-8b78746eba73", "value": "SecuriteInfo.com.Win64.Evo-gen.25988.30409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be2d9f2-bfdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1706666365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666365, "uuid": "41581bf4-1630-4d80-b87b-14044c489792", "comment": "Malware payload (Mirai)", "value": "e5c96dce2c30288fe07bc87f17223b42", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666365, "uuid": "d5460899-8d48-4969-a1b7-60005b85b8f2", "comment": "Malware payload (Mirai)", "value": "fb5813dc5225a821110585fd4368b3998fb22f5c8aef709f3d38b9eeac75c405", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666365, "uuid": "4b387934-f147-42fb-a6b2-3b261a189410", "comment": "Malware payload (Mirai)", "value": "5b3579e4456a4ff23c31e216db7076c4548fba78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706666365, "uuid": "3fcb12a1-d36a-4138-9f2a-9d774637f60a", "comment": "Malware payload (Mirai)", "value": "e0399e6648fd7defd7d8a120c63adc42fbe5e2496a8bfbc85fbb629d5d8eea2cb4ac84148bb7827642c5476e463dbf56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666365, "uuid": "9f5ae02c-d47b-4ec4-8e79-072b285eaa64", "value": "T138E30A56F8818B12D5D111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666365, "uuid": "fb10606a-1213-45fd-8119-2153690bd001", "value": "3072:QD7RUgDUtTX5tgDgRaY2fOk/bfPC22I5mRzd:ORTOTXPgDUaH2mv2I5mRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706666365, "uuid": "ce7c292a-90db-4eb1-abf9-c98393957f51", "value": 147548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706666365, "uuid": "e2848680-97ba-4b12-bde7-5b1b856fd6bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706666365, "uuid": "3faef7bd-fe98-4373-b00b-607e9af8ebe3", "value": "bulu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd92e59-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706698605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698605, "uuid": "3a1df8ef-f5e6-4db0-a10b-7ab6d06b5430", "comment": "Malware payload (GuLoader)", "value": "6c30be7def6fcaa3da5b604566edebc3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698605, "uuid": "64d202c4-58dc-4df8-be48-f9e6de0e43dc", "comment": "Malware payload (GuLoader)", "value": "fb58fe91fb373060ab4e3a1105fba0bbb674fbfab3dbbc221e6a582b0e1a0ada", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698605, "uuid": "b21fb89c-209a-4a03-8788-a927abe41359", "comment": "Malware payload (GuLoader)", "value": "eba56f95cb050caf6b001a25b48696462c8faad2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698605, "uuid": "551ef5a2-323d-4723-9b8f-117bde65a634", "comment": "Malware payload (GuLoader)", "value": "5de1c9ac617385b5ff52ebf3958a286bae6ff8fd23a48eba042261a1fb355649f9d8e5641535cd18f78198cfb90d99bd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698605, "uuid": "9745e102-8afe-41a2-92fe-f0f995c30f9e", "value": "T15CA25BA1893EDFE57E772BF5B40864F3BD294E01CD311A50AEA71158F032C984E29ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698605, "uuid": "6ddadd57-7ddf-4779-9393-37419ff5c71a", "value": "384:0XmlS3fmpth+Iy5IHK/KZXug6dzQ68PVisyu+Lk/m+YX0ZV3/i:M4AO6xFgwzz89ivhGKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698605, "uuid": "7b6765e8-357c-41dd-8581-42cd5bd0ac01", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698605, "uuid": "77851513-a961-4dc1-b8bc-6b6e55143e8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698605, "uuid": "5e93b412-d4fe-4c63-92a4-a2a3193950bb", "value": "CamScanner0091.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea6b643-c027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1706698608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698608, "uuid": "f1a7a059-6f24-48b8-bd99-0519f0e3c570", "comment": "Malware payload (GuLoader)", "value": "bb536b093987692a9cf59fb6cba71fe1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698608, "uuid": "c573eaa3-775a-4fbe-9d66-103914f33e14", "comment": "Malware payload (GuLoader)", "value": "fbb28d7daf3b8abe35e04b8af460b8a5789c1d7ba1e81c5dcf1a50774df17d5a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698608, "uuid": "089ee8df-04d2-4298-99ee-98aaeb7f6739", "comment": "Malware payload (GuLoader)", "value": "f2dec5025b5a36e8c7cd00f96d323a68151f4994", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698608, "uuid": "e83fc8ad-13f5-4240-9bac-e5c6302bd5da", "comment": "Malware payload (GuLoader)", "value": "17d04d6514e416153a543b2bf86a32565eb7c35cb8ea04524491b209da361bd345dc964fe5a7ba878f3f752b9aad2157", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698608, "uuid": "51c61b60-a8a0-4f5e-9ce4-27db8a3b76da", "value": "T189928EA1D64E0FE6BE5FAB71B80FA740B4680105513F30547E694249F0324B9BF69BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698608, "uuid": "af3ec1a4-66db-4cef-aee4-2163a49f0469", "value": "384:6tSbknvwtt2NyIgN/0a/Qj/ioeWpTpngNcNnVDCUiHgwRIZB39b:ipnvs2uOpTpgNcNVobWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698608, "uuid": "0ba05eff-0c3f-46a7-9a09-8f494a5bdad0", "value": 19389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698608, "uuid": "ce9b0d7c-4474-4949-88fb-21df123d9bb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698608, "uuid": "a0ff6898-2983-4393-b054-76f0d78b79c8", "value": "PF-019-TECHNODENTAL-B&H-16-11-2024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d722cfe-c04a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706713504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713504, "uuid": "b23ebc6a-1c68-46a1-826e-47ea2033c3aa", "comment": "Malware payload (AgentTesla)", "value": "537dfaa087180ce7b6f73d4491ddd2a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713504, "uuid": "bb724002-a5f0-467d-b96a-d7e582507f69", "comment": "Malware payload (AgentTesla)", "value": "fc25ad86b8fbcf3ef16589806009d2025b9849a0af085e7848daa5543bdabab1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713504, "uuid": "12e50505-cf0b-4951-9b5c-6f4f714c7702", "comment": "Malware payload (AgentTesla)", "value": "3b918c1736b190b5f746e1f198afa8568a898b6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706713504, "uuid": "eb8d32c4-b2cb-4ea6-9029-34e146819e03", "comment": "Malware payload (AgentTesla)", "value": "58b7f1e4c34945c20881e82ed6b39a2517b22c4698ca5bfd0e2fd1069d2ef6961fe9d63f58a2d2860461096cac0597d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713504, "uuid": "fde1d201-5421-4f01-8b65-7255b9fa0616", "value": "T1EFF4D0C674422486D59B26F9ED0EED9078265C2DBCB2611F6233BD5EF773293046A20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713504, "uuid": "a6a1e698-b7b9-4d8d-8d77-0c105fe747e6", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713504, "uuid": "85f43b3f-7699-4bfc-9233-d4cdf09e2f46", "value": "12288:sYV6MorX7qzuC3QHO9FQVHPF51jgcaBA1T+l1iJX+uhV4/8qwr91SCQ9dh:LBXu9HGaVHaBCU1WhV4uDSn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706713504, "uuid": "aa94e819-c919-4a3d-8a68-3b701a336000", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706713504, "uuid": "4fb8d178-e7cd-48e7-9d93-c3ec08e9bd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706713504, "uuid": "7936da0e-3c4f-46a0-976b-15d216b49de3", "value": "solicitud de cotizaci\u00f3n0089.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e88cb0-c059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706720119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720119, "uuid": "ad3ca032-e640-432c-a1c5-661d142a15f8", "comment": "Malware payload (njrat)", "value": "2c3c40dc881095a810c4a92d505d6abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720119, "uuid": "69509114-ae25-4539-a83b-c8880428a50f", "comment": "Malware payload (njrat)", "value": "fc9fb2f4383980bda918ea2ab1fa384f8ebfd5c910fffad2d2919751682b0a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720119, "uuid": "e9c43a2e-3e78-465c-bb18-eac620fd4d50", "comment": "Malware payload (njrat)", "value": "8f143de9874e49e5ebe392600df63e3668f118f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706720119, "uuid": "8517fc1c-2617-4c31-88fb-b7200054a4e4", "comment": "Malware payload (njrat)", "value": "520a44a751df298733fffe10ec1bd1a1f4c479da06fc7628993438df355dba3cb2756eee0f4b2d678b361bb3b1f25ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720119, "uuid": "f94ba1f0-0ae1-4684-b7a6-81f58a539596", "value": "T119032A4D7FE181A8C4FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720119, "uuid": "77500726-ddbf-442d-b46c-7acc1b4624f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720119, "uuid": "362becdf-cee6-4fed-8421-05fcafc678bb", "value": "384:SmOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM34:8FdGdkrgYRwWS9rM+rMRa8Nuhvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706720119, "uuid": "b04f3204-641e-4d16-b67a-57f329ca8995", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706720119, "uuid": "8a00557d-440a-4e2c-8421-66b000743722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706720119, "uuid": "cd92e40d-35d9-4b1d-8bc0-63fd5f7cf479", "value": "2C3C40DC881095A810C4A92D505D6ABC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d9ecde-c026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1706698161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698161, "uuid": "5ed85db2-3f54-4ded-9e90-2c35efdb6e7d", "comment": "Malware payload (SnakeKeylogger)", "value": "a9c696e8139ba0cfdf3241131fff2d1e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698161, "uuid": "48a13fb5-b7ff-485a-80aa-0baadd9e9a70", "comment": "Malware payload (SnakeKeylogger)", "value": "fcb534128c207ff3e66cadc7e6400ce3987374d151aac8e7aa741aadd6a70a88", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698161, "uuid": "21fc5997-844d-42bc-a42a-160612d78297", "comment": "Malware payload (SnakeKeylogger)", "value": "0607510c26a987944ad5a7da23ebaa69a21e70ed", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706698161, "uuid": "e450a198-a8f3-47a7-9f69-145dc99f1107", "comment": "Malware payload (SnakeKeylogger)", "value": "46f53b23ad2c1e060ce61be24fd4478f09d03ebe6b9c76f41b308c3fd33c0819780222282cd5697d7f2d0bceb7b24513", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698161, "uuid": "581f560e-8807-4b21-b70d-75bcd854ce0a", "value": "T1FF51DA201EDB12DDE2B7877623F9B63742A2F4A1E96E9E7C014082D4876A600FC21F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698161, "uuid": "d3eaee6b-49e3-4e80-8a0d-6998a26a6036", "value": "48:8WAIFziSGulDmr7Hj3xSsdklxAoiYetabc:8XIt3Y/3AsmLAYet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706698161, "uuid": "a557d171-4db9-46d6-9afe-9de13318b7dc", "value": 2573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706698161, "uuid": "0de568b3-6c7c-4a17-ae6b-2517a5e836cc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706698161, "uuid": "dbee869b-cae3-4019-9a77-0ccd309ad3b5", "value": "Photo02.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223b516e-c04e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706715230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715230, "uuid": "97c67e4e-7640-48fc-b2e9-72a79ec785a5", "comment": "Malware payload", "value": "2ee08639eae8b538517a6111ed155456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715230, "uuid": "19b7c396-1ee4-4290-9a26-256ff05509e4", "comment": "Malware payload", "value": "fcbad012b21d1a4d82e9e4e50938a4669ac0c7fbdbf816f0297d6b862d4e2c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715230, "uuid": "84f7ca1d-37b6-4c5c-b74f-7ba281754f81", "comment": "Malware payload", "value": "9b30d89404c019004643e7ce3be319f9acc1798a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706715230, "uuid": "34d4fd97-1894-40d5-b214-37d5bd157204", "comment": "Malware payload", "value": "1ed178f422ef3179e01b755cb66d5af8c4741290cb47b718713c18e3ca9a82d096cab6c5eeabe6dbbd1b2d279810a9eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715230, "uuid": "73c7c532-6059-484d-a0d6-511b5881f3d6", "value": "T145663301B5B5D8F6E1A111701DA4E7F618BA7D206F0155DB33A07EBDA9347C0AA32B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715230, "uuid": "cfc68dea-42ff-48ef-b8c8-d090f5005cd3", "value": "b6efc24dac69b9c632d44a0a640e5b66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715230, "uuid": "28bf2f13-aabb-429c-9a45-f3a2c81dfdd9", "value": "196608:jlOrbiks/aTD4i5x251EGN+1HRWcfbQAIxf9IK3:jWiksST82OPNkRR0AIx9IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706715230, "uuid": "f5e3859b-0c99-4cb5-bccb-e34a943f7b9f", "value": 6970928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706715230, "uuid": "65b8f6f2-7b65-4a58-a724-efe9632c9895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706715230, "uuid": "82d8de04-bc3a-457c-813f-7efc97f03f22", "value": "SecuriteInfo.com.Trojan.Siggen17.52580.4556.31718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddba909a-bfdf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706667871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667871, "uuid": "0e7e46de-b2fc-4bcf-8099-00ec4def93d7", "comment": "Malware payload", "value": "082c9b806b5f63af11a8d86d081e2731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667871, "uuid": "4f1d6776-346e-456a-9d3f-11331b386d51", "comment": "Malware payload", "value": "fd2ba0c66748c5583de63c0a79a6c602674002a7180e37c2d698c8ff2f03e4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667871, "uuid": "32d6282f-865b-4418-b5a9-baef30c4689d", "comment": "Malware payload", "value": "31cbacdd0fba7a1e354534e83cb20d42437535c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706667871, "uuid": "b2e22258-a53d-4a68-a98c-848332b81e6b", "comment": "Malware payload", "value": "9a0ec7c1869adf158185882006f42c597178a78be19261d691c1c1e9a49595efeec5da1a291701760f87164c004e999e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667871, "uuid": "c7c4cdf3-0eb4-4455-8d4b-7650325c4881", "value": "T1A3F423C670D0DD6ADAEA1FB46078CE0AC5BE62473131964B9FB07F43392F58359051AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667871, "uuid": "b38e5b0a-a89d-4bea-9a3f-bf2dec93e2e3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667871, "uuid": "5d66fa5a-3957-4f5b-bcee-11106b267476", "value": "24576:4g8O0Izb0V28ISy0jmIiVlfgepioGgtw:4o/nomIivgeTpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706667871, "uuid": "388d13d4-e085-41fc-8877-079178f9008d", "value": 790024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706667871, "uuid": "540d4b9a-3c89-4ab4-a94a-12883e1bacfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706667871, "uuid": "29c7d1a3-11d1-4321-827f-da44aba412bc", "value": "SecuriteInfo.com.Riskware.Wews87.704.12580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4165162c-c048-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706712706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712706, "uuid": "9cc8e9d7-fa67-42c4-9340-9b2ccc8b565f", "comment": "Malware payload (AgentTesla)", "value": "97bc9ba0386fb0ad7cc222db31d30e20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712706, "uuid": "70af58f9-75e0-4269-ab5c-9353f7cdf7e1", "comment": "Malware payload (AgentTesla)", "value": "fe62ac14f37813d1accc275f0c6a620571d754a53b6759e087226dd06b3c2784", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712706, "uuid": "abbe7604-bcaf-4b5d-9709-2aa9dc2eb6a7", "comment": "Malware payload (AgentTesla)", "value": "985c7e2f69132bb220a0348701408f7b3f78e8d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706712706, "uuid": "1849fcca-335a-4cfa-b9f3-7c93a6195233", "comment": "Malware payload (AgentTesla)", "value": "19968bb298477fb3503c3c5aa969ef6eae01ef07989477aab05d121a2b56f16062c009ef1815f8eb3c230467fe02f0cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712706, "uuid": "9949cdec-308a-4f16-963d-e1f343ddc2ef", "value": "T1B6E41205367C4FA5E57A57F81672698453F296AF21B0FB4DDCC2A0C91A73B048B60B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712706, "uuid": "14d69a54-6915-4217-b234-475cbca1ccf0", "value": "12288:pcD/qNZ4SCSLQGqkVoYyUk45KxDN13W4Juw0goLAFksAsuizf4:2TsW7SlqkOYyU35K3WMv0gkIAsjzf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706712706, "uuid": "218c1893-dd2e-44aa-aa2a-0775857d1686", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706712706, "uuid": "7e73c122-19c4-45b6-a416-5879fc55004f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706712706, "uuid": "cf8df069-de82-4367-9883-6a281e003f8f", "value": "PO-654893878775674389598-pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42882225-c024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1706697246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697246, "uuid": "de65f3c0-8b8f-4763-9357-6e60fa482119", "comment": "Malware payload (PureLogStealer)", "value": "176a874711edbb936b024e8083d8942d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697246, "uuid": "b1dca3b5-dc9c-4154-ae61-0ffc786c645f", "comment": "Malware payload (PureLogStealer)", "value": "ff2014c83f3acf28233005b57b41308b36a2007a3404d931e490408cd3c803dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697246, "uuid": "c4514e08-2814-4ded-9743-0dbeef8a6efb", "comment": "Malware payload (PureLogStealer)", "value": "85e0f0b62da2f10690b391472436ae5d1e1f5f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706697246, "uuid": "61933dd3-b9b3-4217-9554-e1c5abe35f10", "comment": "Malware payload (PureLogStealer)", "value": "3a93decd41bbabf1dc0470f95fdb0f3614b63dae89538677f8f42bd81065eb8877a1f4b16beaa18ede7ee59ad84ee15f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697246, "uuid": "19ec929b-5e38-443d-a4ae-bce32937ad5c", "value": "T1D225BE2718961567C4EC00BE2AAC7B48CCEFF92297A8B42F516545FD48138B66CEC35F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697246, "uuid": "5b248297-3f95-47d6-ac30-5e3dda07feb5", "value": "12288:f3Q9iMYgfiyaNeevhqzDm0a5Dz9JwnmT8JQxD7ffRc/FGLl3I1Xq:/KiHkifM+8zi0a5cncxBc9AOXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706697246, "uuid": "792ca8c1-8235-4838-a45f-c95f7b63b798", "value": 1019952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706697246, "uuid": "ebd6a183-3f7c-4a07-b0bb-03899ad8ae41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706697246, "uuid": "af9b9e0f-8c99-401b-a9e7-5f5970a26842", "value": "176a874711edbb936b024e8083d8942d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }