{ "Event": { "published": true, "date": "2024-03-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-28", "timestamp": 1711670581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2d01f73f-1b9e-426f-9f9e-c193f6c5bf0d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8332f711-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711609508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609508, "uuid": "407a1715-a23e-41c8-94c8-4f5d95b06f39", "comment": "Malware payload (DCRat)", "value": "33c53419f5450d013fd20a76468d43d2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609508, "uuid": "f28f75ba-5095-49df-94b5-d525c527e354", "comment": "Malware payload (DCRat)", "value": "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609508, "uuid": "eda016d4-f132-4ac1-87bf-659e63197a17", "comment": "Malware payload (DCRat)", "value": "40b6d4224504f1f0dfea827c8c853dce79a77287", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609508, "uuid": "b41f5fdc-5757-404d-8e72-259510795dd5", "comment": "Malware payload (DCRat)", "value": "39646f661554c83d0d6cc48b82ee65e0549d4932f7ea09ee94a7df08199b3c3061a58f796733ba0d5733b79e50f4782f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609508, "uuid": "1a238664-e44f-43c1-94ee-72023ec2dcf5", "value": "T197063340FDE7E4B2D4B628318719AB10493EBD212FA18EFB73A4660DC932695CD31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609508, "uuid": "e932b925-d63a-45b3-a0d3-dd0849983f30", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609508, "uuid": "15dbdea0-a18a-4b1f-8b26-f5ab3d51707c", "value": "98304:ypcjyoyOglp/VanCJgUEIvX8jMrbL7589kE9PQqP:8s7glp/VaCJAIQs7m9kERQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609508, "uuid": "dffac042-0407-48b1-8b0c-161faab3c687", "value": 3866011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609508, "uuid": "1a595506-35d7-4a67-b90c-48a19a55a40a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609508, "uuid": "e119aa17-26f7-4d2c-b0d2-4c5ae350b837", "value": "33c53419f5450d013fd20a76468d43d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a480b30f-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609994, "uuid": "60966c43-fcf4-41e2-9178-ffa1a2cf3011", "comment": "Malware payload", "value": "5d288eb2fe75da7ab3902170c5192151", "object_relation": "md5", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609994, "uuid": "ca56091d-9070-4ecd-98c6-98e28311cb1b", "comment": "Malware payload", "value": "02b4211c449f6ee34f6211d5eae7fb0ec573ab304a209354111e7d2ee3a23464", "object_relation": "sha256", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609994, "uuid": "7224cb8e-5393-44d5-9b6b-433f1205aeca", "comment": "Malware payload", "value": "964072b36ca0ccce8faa86c6cefd198a9e576a89", "object_relation": "sha1", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609994, "uuid": "9efb17fa-a9ce-4100-9f64-097f7f52f3c9", "comment": "Malware payload", "value": "9f0f70cff5143b4cc9f5693429647d1ea25e8a78d2426112535e3bde10699ecb912b2ee607691b32a63162ac5ef63c61", "object_relation": "sha3-384", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609994, "uuid": "fe74e1ab-7ba6-451e-810f-2c12cc4d242c", "value": "T14A116590150E42A4ED8D66B1716FD246A2F434AAA11EF107B99D24A749500F9B321E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609994, "uuid": "81cb4683-68de-40a3-8d5a-b99a08a17c06", "value": "24:9vIhHieAwhaf6Ds8PKgvqTadd/jhI2pSboc27FtTEl:9vcHieTDKgi+ddtt734", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609994, "uuid": "f84479ad-a09d-4ed5-9619-7d395f2c3563", "value": 1070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609994, "uuid": "2e8de0d3-57ca-4f52-a822-4e7eafd2517e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609994, "uuid": "876bdf98-8a2d-4f22-b641-51fe8182b4a8", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c7024d-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1711617829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617829, "uuid": "2f40c927-0b62-49ba-a3c0-2f58a22f8c0a", "comment": "Malware payload (CoinMiner)", "value": "71ee7a0d612a6530ccfd22c79bbf0695", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617829, "uuid": "68f53415-cacd-4c9f-8c6d-36f550b97510", "comment": "Malware payload (CoinMiner)", "value": "0412820e4dacf521808629f37fff8e32aa554c0d9096b7800921c8ae1cfcb0c5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617829, "uuid": "a7a05d94-f7a4-41a9-911b-26123c6351cd", "comment": "Malware payload (CoinMiner)", "value": "0e7413e80de750d661c132a0dd88c014dbfd2398", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617829, "uuid": "debee5a3-fec2-4817-b96e-cc95641a075c", "comment": "Malware payload (CoinMiner)", "value": "59c02837e4c908dc005474399a5175bdc34b0f4854f61dcc30272c2f2ebff4776b49b315eaeb3ed9f0340c5faf345a90", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617829, "uuid": "42a465db-ab0e-44cb-9eac-7dfc66ee5c20", "value": "T19636BE27F67AA5F2C20B4733F79B4D0443B1D9412F27F64BA9CA235905423AE9DE910B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617829, "uuid": "f67dd7c1-77ee-4520-825a-f4879c261ac6", "value": "98304:2rHq3FSVIErWayHeVd0q2rVMPMKhV83eZe/LFx:2jqVSVKH0d0q2rfP3lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617829, "uuid": "967581a5-a0f5-4c94-afdd-44685a852272", "value": 5299712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617829, "uuid": "48aed894-3cd3-41a5-aa69-cc7316a00e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617829, "uuid": "b80eda6a-df73-4c3e-92c0-0cbf3a2e7d0a", "value": "SecuriteInfo.com.Win64.CrypterX-gen.24907.17990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19be725b-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638967, "uuid": "d9a37f0d-d505-4b91-86d3-c37d2aa00fbb", "comment": "Malware payload (Mirai)", "value": "102a115eb455115db34b24705691cad7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638967, "uuid": "63b03680-72ec-47e0-83d7-e28a5773b63d", "comment": "Malware payload (Mirai)", "value": "07625703e3df5e93eaf72fb9f8921c7821918133453e05b8ac077cc6187ae6f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638967, "uuid": "dd3231a7-e908-4a03-879b-18dc6af0dc14", "comment": "Malware payload (Mirai)", "value": "ebd9d80be3ed7d17c70332730f19a458f48ade9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638967, "uuid": "1dfc880d-e88f-4f67-a7b7-721e27c6e07a", "comment": "Malware payload (Mirai)", "value": "6f78a0287b964f81835db490d3e207f7eab4497d4967ff62c1a967fe791c53a485e86f61afcd3311d5a0054bc6e4ef5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638967, "uuid": "aa38b466-d0fe-4623-9b2e-bdcdfb287335", "value": "T1C3C33B08EB004B5BC1E227BAEB9F424E33335B8477EB331A5A3856B43FC5BA94D25515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638967, "uuid": "e22bca93-1f8b-4ce7-ad07-e76d480a8e52", "value": "3072:D5HFrLCo1QHXYZ+NN/uwpmQb/YkM/9eug:DjrLC8IYZ+NNWwxb/rM/9eug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638967, "uuid": "5b55b47e-a228-4281-b9a4-87e451e872db", "value": 127183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638967, "uuid": "8885acd2-d977-4745-a03e-4e60d4f9cbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638967, "uuid": "f67306a5-64b6-4cc1-badc-1130abdd04b6", "value": "102a115eb455115db34b24705691cad7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bb2e1f-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616628, "uuid": "da699043-f07e-4a88-9612-c90d2c4f6ae0", "comment": "Malware payload (Gafgyt)", "value": "934217b353dbbf7a1a583de2c07ed902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616628, "uuid": "0e41e041-9e8a-410d-976b-385ea402c6e5", "comment": "Malware payload (Gafgyt)", "value": "0771e81c61e56d9406aee5823e5af1c50ef6f4465fc5bc63f9b0923feea13619", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616628, "uuid": "db3987d6-6aaf-4b7a-8065-80b5074d9401", "comment": "Malware payload (Gafgyt)", "value": "b95d984494ba5a7184f2a9332b0798301a7ec52f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616628, "uuid": "7c65cc6a-d1ff-4b79-87fe-0c74fcbc84fd", "comment": "Malware payload (Gafgyt)", "value": "dca802265c3305f955c7cab7aa133a78759e87e8fac6e5f336d045250cb67830b28eab955ebd7fccdef691ca4f73d9e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616628, "uuid": "5cf3c978-909a-4dda-83e0-be8df6a82e22", "value": "T1D8830A41FD418B57C2C327BAFB9F435D37356A5497D733026A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616628, "uuid": "0b6b4812-73cb-421f-882b-ee92c72013a7", "value": "1536:GDN+IBSIzNENYx5OklUrpB3ndL4Oj+cmZhBQ4Kb3RXFFj:KBXoY5U73d4OjNmZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616628, "uuid": "cb4e26bb-f46a-4bba-9003-f8e164a02c67", "value": 85241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616628, "uuid": "84e15f64-05c5-4db2-963d-056b7b441f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616628, "uuid": "c0d1b5c9-4da3-4561-bd80-45b1cd5c58e3", "value": "934217b353dbbf7a1a583de2c07ed902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5efb49-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1711617820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617820, "uuid": "d988de68-60f4-4c34-82e2-6601f4a5434b", "comment": "Malware payload (PureLogStealer)", "value": "13595ca5d5503aee4b4c67cd2ed5730c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617820, "uuid": "ec9f53bd-6de6-4963-85a9-93e1d6ff5df4", "comment": "Malware payload (PureLogStealer)", "value": "0a3c781e42db27377f9790a4cd0c5f73f33c93255ba51dd2e5e517fa7482e2de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617820, "uuid": "e5e7d004-37a5-4b45-83e4-68479b85eb37", "comment": "Malware payload (PureLogStealer)", "value": "64a9bcc3e14191f5a9c3fe658c3dbd99e179d001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617820, "uuid": "0913ef9c-1c36-4731-a4e1-8d6352f3f1c5", "comment": "Malware payload (PureLogStealer)", "value": "34f3294869d74e5ed3e461d61b7943646c7b56ce9f6bd1a26089138e7d2c60f4d4b7ac78423c09c284aae539c79293f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617820, "uuid": "12c1bf83-4de5-4148-8e3e-24d10964af09", "value": "T15804E192B39B5A71C45D9934C1E2DA571731D3822D03EF8B768E62220E437C6AB05F8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617820, "uuid": "d96d695b-fb43-4aa4-8189-e3973d9f0da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617820, "uuid": "46186cd3-dc75-4f52-9995-0236d09a57dc", "value": "3072:bv4C5qhzZdgq7CeRZlTQCAKNq6b8iiQytEdezhQp4aOjPxED:bNoEq/j96KNbdiNEde6p4aOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617820, "uuid": "e5abee79-8f49-4087-89ce-57b1f1dbf9da", "value": 175240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617820, "uuid": "a6e356c1-9bde-4e26-bcb4-2bd61b0b0c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617820, "uuid": "19f36b1a-d9f3-4646-87ef-99d2b855c25e", "value": "SecuriteInfo.com.Win32.CrypterX-gen.9933.28197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4abc66-ecda-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711613444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613444, "uuid": "a44dd8f1-0533-4f4a-9bec-321451423301", "comment": "Malware payload", "value": "e66fb39c07d4e01d713fbac743f4ced7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613444, "uuid": "740e6c99-7913-4b99-8552-cc30a000f278", "comment": "Malware payload", "value": "0aed87372c8b6418f78abe020549e227175cae65f01713357afdbb7f7a839a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613444, "uuid": "e5aadfae-d976-465b-9c31-0e0b755ead94", "comment": "Malware payload", "value": "6dec3465aef1404f63e939cbb03104bf1d476e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613444, "uuid": "083b6e01-2cfc-44ce-acb4-9eb724b37a38", "comment": "Malware payload", "value": "128e8ae10f9d02832834c87ad7c4f0becae12d903ca67b312f446719b5902dd806d47c1cdcf39fa9fd200fd1b3beeef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613444, "uuid": "14016803-b603-48dc-84b4-e8ff9445825d", "value": "T18508334CF3876A21E519F8FABEB56560DD96B68332B0D0777B911E413498B03B63A0C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613444, "uuid": "52a2e724-d7ac-4fce-9bff-52e52195c84f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613444, "uuid": "7765ed00-b51d-4474-8731-34f8a35d72fc", "value": "1572864:NpJ39KpdjiXz9MXWA5B8ceyIS7nqYdd6hIEhSmnJZxRByufXFPW:NwpdM9MGI/vP7nMhJnzxRB5fXdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711613444, "uuid": "10c52c0c-0f7d-49df-9941-dbde5d00482e", "value": 84118788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711613444, "uuid": "7823da6c-1853-4b44-bc34-2b79963bb049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613444, "uuid": "c7c0af68-de8c-4585-81db-2178dafb71ed", "value": "SongOfVikings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3394281e-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616676, "uuid": "31f49dec-0e4a-46f5-9d1e-326e2dfe568c", "comment": "Malware payload (Mirai)", "value": "1b30471878360e89f56343f91d1af71d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616676, "uuid": "1d5c6548-7181-4547-a0ca-44ac74d22baf", "comment": "Malware payload (Mirai)", "value": "0b65f9f7d9ca98b41a6c9dea47beb16118d34277ee5738ebce0ce475d0057c56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616676, "uuid": "86b9465d-5c05-4de6-a378-e93c60b134ee", "comment": "Malware payload (Mirai)", "value": "934267e4bc753b84220bfd01ba53347b142b1748", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616676, "uuid": "730c69e2-1220-41e4-a5eb-90fce1f65456", "comment": "Malware payload (Mirai)", "value": "af8f30bb9d57f8d1ea0b8dabfd66edcf23795de10d0e4c692b3797f3ececf4297269c43991acc9d84b21b3fb3c0ff69d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616676, "uuid": "2121198c-770b-48be-b421-33b2c6399cc2", "value": "T116539EB2C87E7D94C9450134682149305F53F20892A7AEB79DC587A6804FEFCFA197E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616676, "uuid": "104c859c-8fc8-4aa4-8acb-36df35be06e0", "value": "1536:oydwVl6v4wtUL42MmdhMD+2Lt/i4VACk0l1dXd42+F:oyUl6v4eKGD++/i4VACDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616676, "uuid": "397e60a3-8b4c-4e62-af11-9698bad264e2", "value": 64476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616676, "uuid": "2d5e257c-cdff-47c9-bc8f-fbbf14a06779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616676, "uuid": "6fc29a84-5719-4703-96f6-7d26912ea2ee", "value": "1b30471878360e89f56343f91d1af71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5993b9ae-ecfd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711628336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628336, "uuid": "96a4580c-b1c5-4f1c-9fb6-31fc85ebd424", "comment": "Malware payload", "value": "e62429208555cf13bd13daa51d233783", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628336, "uuid": "e7cb7aee-f31d-4438-b3cb-73ec6274cf30", "comment": "Malware payload", "value": "0c0ad15272b0408791d55e9700965cc05efe387850fbb2a7749f4ff08a886b8a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628336, "uuid": "735fbe04-5e9e-499e-ab39-ec281b7418d9", "comment": "Malware payload", "value": "2bc72af63361ee8923139b4e094a41a2da9c283d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628336, "uuid": "ce3bba9f-735a-4d82-9c99-cdc410bc8bad", "comment": "Malware payload", "value": "6ceb1084fcee32de80435d7507080d129e68fbbc1f63bee3faf49281acf099b194fca4ba3bd2ffa094c410f5387a369c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711628336, "uuid": "88e7fa86-8dcc-4a4c-9279-46339fc064d3", "value": "T14522E739AE08D86121B22666EB27DB45FB25411F41298F0AB99DD1CC2F3C05EC1F6DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711628336, "uuid": "577b7d2b-e24f-4f86-b6bf-e5b8dec954a1", "value": "192:B/OJvMKlT0WUCF55fKRH1FcWpa+C2faTombimi/sjq/1Puc0NVzPlw9MQ:6UyT0mfKcWc12STombiOY70N9Plw9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711628336, "uuid": "cbb48e30-505c-4a3b-9c0e-e3ee5a310f73", "value": 10033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711628336, "uuid": "19dcfe91-bc63-44d1-8f27-69efe9803f7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711628336, "uuid": "c2890090-8715-43ca-8654-c84be4b13ff6", "value": "biden.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd2a26c-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711609691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609691, "uuid": "b80cc798-227a-4055-a1d7-15891616243d", "comment": "Malware payload (Formbook)", "value": "847bf4ff34d621e5c01b919c0e63621d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609691, "uuid": "e0a6e78e-ae7d-4d7b-93ca-68abed0254cc", "comment": "Malware payload (Formbook)", "value": "0c37804bab8e0a7989e85c5ad1a917e9daf2d9e10c96af9e4f0e5449bfb527aa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609691, "uuid": "7445b972-d138-443a-bbdc-996c104e380f", "comment": "Malware payload (Formbook)", "value": "c8540089067d721c3a0b9cad59535b819199bca4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609691, "uuid": "66f863b3-e86a-4fc7-905c-42e08aa41d49", "comment": "Malware payload (Formbook)", "value": "1774db6b49854d45e4559f98a72b1874c0dee30e07625ee49dfe93519bed59d4dadca8f85234db6d88e6911359852dbd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609691, "uuid": "2de43335-5f50-4954-94c6-6522734e548c", "value": "T10135BF027381C062FFAB92334F5AF65157BC6A260123E61F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609691, "uuid": "74b30e15-ec94-45c7-a2df-d3bf2cbecb70", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609691, "uuid": "a48de683-367f-42c2-9d5b-77400e343752", "value": "24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aKuIhcQNWWWYV:kTvC/MTQYxsWR7aK5/NWWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609691, "uuid": "5dc8c7e4-e1e2-4faf-a6fb-abdcc59c3f30", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609691, "uuid": "9e1ca4b8-2f3a-450c-8e96-a8398e8b4f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609691, "uuid": "4ef3d665-bd19-4893-b012-99e40c783f74", "value": "DHL AWB_5934_5682.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a3ee8c-ed37-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711653299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653299, "uuid": "899299f8-798d-41b7-9e39-fd98a84d2f5c", "comment": "Malware payload (Mirai)", "value": "cf879b6b805c877ff2ad4bb73e39b71b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653299, "uuid": "c1438932-c560-46cb-8ff9-0edb37c0e871", "comment": "Malware payload (Mirai)", "value": "0cb59210d3888df745d3073a40903c9ee7efea4e5b9b479aa54326b0ae996e01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653299, "uuid": "1ad38cec-9d8c-43d1-991f-9c7d1172ca2d", "comment": "Malware payload (Mirai)", "value": "4a1322ddc4b05f43e175adad28aed674a6623701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653299, "uuid": "9a76ad31-450e-4471-ae91-7ae235b4b74b", "comment": "Malware payload (Mirai)", "value": "a9b448ee1678df79dce4cf3541d457e53c1f6dd9edfebcea3044ca0ea1df53237713eedfa5017180172629ddbd0dc85b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653299, "uuid": "bdcc16f7-a41d-46ff-98cc-27e35ca7c087", "value": "T1CF3339D5E543DEB0D81605702076EF338E32F0FE2119ED87E7A5D633B866A429907A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653299, "uuid": "555efc25-1a52-4e28-853f-f6352ab011a2", "value": "1536:9E/u0GGS0cgD1hrLSvB6xex2P7E9KonFr9iaieqjeeeeeeeeeeeex7fW:9AurGS0fD1IvB6kx2EKoFhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711653299, "uuid": "96191fd3-c653-40c5-9a32-858584fba17e", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711653299, "uuid": "6fbadc73-33e9-465e-adb0-8152b8c50850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653299, "uuid": "2f56ed77-3fcf-43a5-8e68-5fd544014e06", "value": "cf879b6b805c877ff2ad4bb73e39b71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc302ce-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652533, "uuid": "7b9df571-5019-4f6a-bcd4-8c93727fee73", "comment": "Malware payload", "value": "fa43437c345eb2d0c3e189d443f07919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652533, "uuid": "37fb0e89-c01f-46d8-a4e1-e33e4db57894", "comment": "Malware payload", "value": "0d4b2c5e5daed5efdfa39ae8c49ced527cecfb4c10fb45142bd23259457cef52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652533, "uuid": "2fb0078f-03f4-423d-becb-bd43480f44ee", "comment": "Malware payload", "value": "9effbddc99214b0ab224e577e96cef689b56b9ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652533, "uuid": "8586d044-f958-4b6c-b8a4-ab1a9d5600f1", "comment": "Malware payload", "value": "55b8c30560b0ff72fb329fe988431aff1cf9dd8233c575f66d318e4c3168fc0494aa093597c3c2c193d30b5f5b23cbed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652533, "uuid": "1ad699fa-26f0-4329-a310-1c40593db30a", "value": "T13C56E757E8E540E8C0EED578C776E227BEA13449473837E76FA09A501F26FE0A5B8710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652533, "uuid": "a3d2cdcb-889b-46c3-9a3e-cce08e06b87a", "value": "49152:fyUPtcScr52U32umfdMwdhNUrb5s6sF+1usrngRA0C321IkRoC7/VAWI9MX0i4Bj:KCct2UGzXwi3sUsrgbIk7AWIo0tvbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652533, "uuid": "b1c3fd8c-fa0e-4ac7-ad8f-24d92a116831", "value": 5904953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652533, "uuid": "4be1d083-f481-4547-9687-305c85e7c408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652533, "uuid": "8dc9f7e6-2df1-498b-a46a-e345bc7a1da6", "value": "fa43437c345eb2d0c3e189d443f07919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78857149-ed03-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711630965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630965, "uuid": "a1276c98-5f8b-4d2f-a28f-a42cebe1d800", "comment": "Malware payload", "value": "e19f4e6b564e7263ed43f16cf8a3cc1f", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630965, "uuid": "37ba40a9-989c-4300-8fe4-2b5fc25ebad3", "comment": "Malware payload", "value": "0f2d3389eb39c2755e9c67ffd886f9a7efdfe59065d9fa13d8874ce87693fa93", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630965, "uuid": "58478804-950b-4501-8bf8-2c50ef434846", "comment": "Malware payload", "value": "4b2be82fc607da087c4f8c1369b04c6795f02b31", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630965, "uuid": "376eecc1-e482-422e-ab81-7036c1e86e07", "comment": "Malware payload", "value": "a977618ef9e855d5575d21497a97c57dcd17a3c4e5ebbdc5215ce2c8532f48cd056271a5b0aca5e5d09b35d586f5a2c1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630965, "uuid": "5bcafa11-ab3e-432d-b6ff-9d30d690c7e0", "value": "T1BE555D72B6A15533D2235978CE4BD6A8B811BE211D1868867FFE4E8CDF3E7C13529093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630965, "uuid": "f367d211-5bbe-4994-a528-43001a09ba9a", "value": "3072:2mdqpevG/s52cCRHfsEvNi1REIMtS1klUwqKaz8Kb2Gd7SER+zrIw0BVWsfiNoNz:2m8evGkzCRHfsci4cA9Mp7SHkCoNzIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630965, "uuid": "a811dcbd-2cc2-4459-9d02-70d4bae97397", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630965, "uuid": "95530d70-3f2b-45f9-8320-7d41057339a1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630965, "uuid": "0797fe64-cc3e-4ef5-9167-55c6be04c2fa", "value": "midyear_statement.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9eae62-eced-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711621656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621656, "uuid": "7354a95b-45a9-4c32-89eb-f3fe2e4b5cab", "comment": "Malware payload (Formbook)", "value": "ccd8b87b97fae65f768be8e4649562a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621656, "uuid": "cba3c999-acaa-4bd8-9bed-4f307b0e3e42", "comment": "Malware payload (Formbook)", "value": "106f7db89f2f660262cab7c367d2174e2bc1cd1f3dffaa984ebe5ae21d2834d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621656, "uuid": "855da203-abc9-49e2-b9bf-879bf344c8c9", "comment": "Malware payload (Formbook)", "value": "2aacb1bd79d8b732b6a072e92e6fe635da341b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621656, "uuid": "69687a3f-d0d3-41e3-beee-ac9d6eea86dd", "comment": "Malware payload (Formbook)", "value": "af78c5b7f65b34ea6bce4f8f38c9754fb16226870d7e0d2dd3568ddd20088d459637320f9cedc20be345f975e5c6b0d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621656, "uuid": "e17befac-f48a-4378-8d13-34332e188894", "value": "T12BF4121436E99B2CF2BA4BFA01708006177BB7752951C62D0E8431DF2CB6B51CB9AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621656, "uuid": "849db53d-1814-46fd-880c-24966c377b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621656, "uuid": "0107f57f-5ece-4f68-9058-7deee1dc98cd", "value": "12288:I/2M0YOwqOp4UXtx4MW6qY5184nXs/PQ9MhVxC1/kZro6bjf+gEz5y5jkD:cO7lKtdG4n8IMhy6K6v+zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711621656, "uuid": "ae842bb0-7270-4a8b-a183-87b822cb94a9", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711621656, "uuid": "1e8fa928-12b7-44d4-9de0-e49d1b4c9b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621656, "uuid": "7fdd1efd-3ebc-43db-8574-1e6ccd36e816", "value": "SecuriteInfo.com.Win32.PWSX-gen.5935.26892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17cd646-ed0f-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711636215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636215, "uuid": "90c71123-fc31-4110-a50b-9a185cccb884", "comment": "Malware payload (DCRat)", "value": "0fa3cdb868bd4619a4146d8593bfff79", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636215, "uuid": "a0ff75b1-a120-4304-9335-cb988810b880", "comment": "Malware payload (DCRat)", "value": "124b0e5e84492c91ce2382751083691b7f3dda71546374289130f730e1349202", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636215, "uuid": "0e74e753-bb3e-46cf-970a-2346b7fba0b8", "comment": "Malware payload (DCRat)", "value": "2dfa62bd92603d06d1735bedce6dffa7759b6692", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636215, "uuid": "4c7ea4f9-80b1-4785-b7b7-2fc4c555502a", "comment": "Malware payload (DCRat)", "value": "54604fd2a11825abf628dd807791aa8efc27137f668d5a725e5783348ea7205f43704039176cff1bc3b0d428fe5be0fe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636215, "uuid": "e4bfc7c8-73f1-4a17-aba8-6b323cc25d45", "value": "T139B512A2BED198B2D01220333A256B3877FD7D205F6148EBD396A95EBD321D06235F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636215, "uuid": "04cdf0eb-f95a-4455-98d6-c2221951cc3f", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636215, "uuid": "70512442-ee70-4297-ac67-c723decc9c06", "value": "49152:YI4eI1hOVLklEgbQcGBdfX2xyqxc3YkU4pkbxIf6WG3:YMpVLklRGjfuxYYsOm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711636215, "uuid": "b667295f-792b-4af5-9176-6616391c9f4f", "value": 2320194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711636215, "uuid": "2e5d82e5-c02f-4dc4-ae5b-7830b4dee305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636215, "uuid": "bc09b4b0-2993-4fa3-90ec-687159496c61", "value": "0FA3CDB868BD4619A4146D8593BFFF79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6c4230-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609822, "uuid": "76d763ef-e6e0-4bb5-805e-201482a83cb2", "comment": "Malware payload", "value": "012e56e44c5a4d6665ff7ba9b678d84e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "USPS", "colour": "#B6B498", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609822, "uuid": "a24237fd-bb88-4502-8de8-2489b255bfbd", "comment": "Malware payload", "value": "132deca6566be45f3fd809510ba73e1220c55c4711e944b1a85cd7bb07e5cf58", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "USPS", "colour": "#B6B498", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609822, "uuid": "cc4c5e04-5987-4897-ba6c-7ede228c9c2c", "comment": "Malware payload", "value": "f5d3d38e8fc7d5f4bde3a22e657d1bc88ec6db5c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "USPS", "colour": "#B6B498", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609822, "uuid": "8fce2ff7-2437-4562-9cd9-7a0e5d879098", "comment": "Malware payload", "value": "f3fca97109e6603b3e071af35bfd34c7c541be7b19ae3d657feaf0507428511ceb401bbb9ebc42c237f4dcbeef2708c7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "USPS", "colour": "#B6B498", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609822, "uuid": "c56caec5-e84f-4bd7-8c0d-0d477ffbed12", "value": "T1F32140267AEC5B11F2B7063F05FA5082EB2AB2D2F810A31D4092434C0D39E06ACF5B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609822, "uuid": "b4d41ac4-fcbe-4959-8451-55632425fe15", "value": "24:8+jK5v+Eo4+Bs+3h4+Hx4I0CxP/p4+fbNWft+h4+Qm:81B3+2+uIN3W+hWVp+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609822, "uuid": "b66c949f-96fa-481e-b010-48bc13a2f030", "value": 1149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609822, "uuid": "54a94ba3-6b75-42a9-b240-8ae70964d7ef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609822, "uuid": "0a99a63b-06c9-487c-b274-85b66300acbd", "value": "receipt_usps_809002765.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e748e3-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616623, "uuid": "c5d558ca-45f0-4835-a755-9e68329517a6", "comment": "Malware payload (Gafgyt)", "value": "3d4fc1f8f5392a0e8e29cb95c39ab136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616623, "uuid": "1bb0d02b-d827-4651-ada2-d7591a54c908", "comment": "Malware payload (Gafgyt)", "value": "132e6a5d5d7d00ad55cbd15edfed12baaef762e442e590f0ae57913ed8b55e1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616623, "uuid": "fc403ea1-ff09-438b-8c30-41a1206ef283", "comment": "Malware payload (Gafgyt)", "value": "e47f0ffdd2e9a4358ccaffbf4b031fa91c5b1c9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616623, "uuid": "60765c59-5cfd-4313-99b3-356404ecb28f", "comment": "Malware payload (Gafgyt)", "value": "7de7f7d615b0cb637b5afb6290fd35b636af57d914fc31f833ba32525c996d6e4d458d4d011bd2c87ed854cfc6f7ed70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616623, "uuid": "a3a21a41-d6c7-4eb0-914c-1efecc5e30ba", "value": "T18D933A277B230E23C0CA547112E30331B7B5D75938FA4797BAD16EAC2F16A8439167E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616623, "uuid": "be5bb609-5a24-416a-a59d-200e65aafa1c", "value": "1536:D5JHzqN8qKmtxa5Fet1NdcdsH33mX0Gq4/cOf3Tj:aNbKm7qFINad633mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616623, "uuid": "12ce4dd9-5f3e-4e55-a54d-0ae0b08beb07", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616623, "uuid": "d5afa49f-3ffc-47c9-9205-741ceb596706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616623, "uuid": "d35a889f-2368-4d60-bdb7-5cff3bf69367", "value": "3d4fc1f8f5392a0e8e29cb95c39ab136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634880ff-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711630500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630500, "uuid": "e2fa9633-9fa4-42dc-a676-f8c4f4762f00", "comment": "Malware payload (AgentTesla)", "value": "34e65ca275e94eb01fa9bff73b1a4f99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630500, "uuid": "bc84e4b9-f818-4fb0-884f-2657e1f614ed", "comment": "Malware payload (AgentTesla)", "value": "13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630500, "uuid": "6a1a6b93-2dbb-4989-a770-65f6b71f95f2", "comment": "Malware payload (AgentTesla)", "value": "243e7e34ada4e5993c836980e899664a85eaa14b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630500, "uuid": "44b1e83b-9e86-4183-a61e-8ebf0deb54f5", "comment": "Malware payload (AgentTesla)", "value": "c5279b0fc63d4eeef43a1c7fbd84b5017adddf17f370b9251fa183e3f46ac2292ef278465a475eeb9d2ed782ebf161ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630500, "uuid": "939a142d-102d-404c-94b7-bf3cfa4050b9", "value": "T109E412033A6D8A27C4B509F5D9D8C1521733C2F91E5DE7CA1FC522EE28D67E08622767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630500, "uuid": "d6a5563c-b61f-40ba-868e-0b6add2aaa1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630500, "uuid": "9dc2d2dd-fd5d-48fa-a9d8-2edded242208", "value": "12288:ig0YOwq+phFjZyzFXvQnUpo0ddzpYIkNbKGQx6GqLBjLH1MtlWlmRvWzfwI:JO7e8F/7NjKIkNbKGwr6WtglWvWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630500, "uuid": "3f9d1b8a-ff9d-4915-9b5a-6cd486f6daaf", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630500, "uuid": "7f8b831b-76c9-4b76-b3de-85d48b93a92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630500, "uuid": "ce8311a7-b81c-4021-bf2c-0aaf40a45194", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d015ff60-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1711652587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652587, "uuid": "ae11787d-bcf0-4eb7-bd30-dac22e406334", "comment": "Malware payload (GCleaner)", "value": "9544821ed3db4db3c54f0d795bbc1ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652587, "uuid": "64d754ba-affa-4394-b64e-678fbd40be09", "comment": "Malware payload (GCleaner)", "value": "151ef2d3caa9606e6aa1531750361b3e413433c1f884f4d700304f1c6501978a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652587, "uuid": "840f3b14-fd43-40eb-a2e0-cdaa12f2bd35", "comment": "Malware payload (GCleaner)", "value": "3dd2d16955d4e6db85051e9f368407a9d9b6870e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652587, "uuid": "bdeca6c4-9420-4d36-a231-748fac7e2c43", "comment": "Malware payload (GCleaner)", "value": "e58c9a15e44f7ed4adc408f6a0845ba7d220de9337e480d16a1e1bb89fb330515c01c51a22b16a3d7ca0b30cd37ad5ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652587, "uuid": "5f287320-f87e-48c1-9373-13c0ccc7929a", "value": "T195648E23B2E1BC60FB734733DE29C694266EF9618E69675B33185E0F04701A1C66BB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652587, "uuid": "dfe3a628-bf08-4206-909e-4ba4c205d687", "value": "6c253ab46183cf59b107fd8e97e1073e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652587, "uuid": "114f1d29-bbff-41bc-bf37-80897d9ec35c", "value": "6144:7f4ZKa9IPz9hmiXK8+JjdYX+VpU/UB9Xi:r4gKIPz7mid+Jj6X+YcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652587, "uuid": "064a7198-5c1c-4f40-af62-0007194aa581", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652587, "uuid": "ce5e329d-68cd-4a8b-a947-d02f1cda4b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652587, "uuid": "c0c52beb-f157-4a97-85db-618a06890b0c", "value": "9544821ed3db4db3c54f0d795bbc1ab6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9bb084-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711630648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630648, "uuid": "7eaeba3a-fc1c-4c14-903c-f25d56a01f40", "comment": "Malware payload (RemcosRAT)", "value": "dd8e3f6ac5c24960b3a69490082c60e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630648, "uuid": "d68d86dd-022d-484f-b502-84516643f957", "comment": "Malware payload (RemcosRAT)", "value": "15db18392d7bbf15b30e528db05ec306e00ac3227277d0639064ec3e2bc98c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630648, "uuid": "0de85665-8ecb-43b1-88d0-c175984cfb01", "comment": "Malware payload (RemcosRAT)", "value": "c5f8aaec5baa571791789dd5fac53e27938dbc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630648, "uuid": "847d0bf7-f109-4a3c-a715-19a794ad74e8", "comment": "Malware payload (RemcosRAT)", "value": "b91d945a80092192a53c220ffaa4e3b763b9b6c41f3b814a32765d0d15d26f045399557493db3313ddc9ac6b54b52241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630648, "uuid": "6af6e4e5-83f1-4b7f-8b55-e0de793af149", "value": "T12E45AE6EE2ACC4B2D32305F9FA7EE2A454177F9D35D5A87628E05B4C8F24E442B18D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630648, "uuid": "fa082c47-ea32-4433-8384-b10c78f1537f", "value": "95e6ff319c3c0cad8b9eba5a52b7f0bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630648, "uuid": "14646eea-7527-4cb2-bea5-b128a14dbeed", "value": "12288:evGkW/sci4Vup7XNihvMHH59TpfLFhLme7iEEEblTHQE1ZEQrfvAcEH+DwxTe8g:e+Rg+up7XNiyHZ994eHQEQahz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630648, "uuid": "d7f1c5fc-f477-4f75-80ee-a71f9801c286", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630648, "uuid": "c494acf6-df08-46b5-9333-6efbc9e95612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630648, "uuid": "1a024242-72fd-4c7a-af80-6c5807475c2d", "value": "midyear_statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b225b10-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616662, "uuid": "c0493a17-258f-4c66-bbe5-c5f472303d9e", "comment": "Malware payload (Gafgyt)", "value": "00b89779cae698d724ce2147b45539e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616662, "uuid": "3ac91066-e780-4d4c-8b70-a6ccf3836a3d", "comment": "Malware payload (Gafgyt)", "value": "15ddffede64677d727fc6a4eebbe24d660253c2b782205aeb05d679d3335216f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616662, "uuid": "c0a9ad55-83b4-41f0-9a0c-78c638f1eafb", "comment": "Malware payload (Gafgyt)", "value": "b2a96766d6073506cf5ac97bad3408a5fc8a6004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616662, "uuid": "a4bc4201-6e88-4fa4-8df2-289a0c486738", "comment": "Malware payload (Gafgyt)", "value": "f7c9be616115e895cea9d7d1f0610544716bbd59803c67581e5eb268dc8fa6518e158b5b0f706c75b73535ffec7bb300", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616662, "uuid": "382d54cc-ba3d-49c3-840e-7b81bb483981", "value": "T185633A4399629FB7C0866EB565F70A304753FC211F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616662, "uuid": "1bdced33-90cb-41ce-b02b-f963e975b934", "value": "1536:F1BOKQIQO6TaxQQ7Krt071p6CXG2WrXDJLi+wmk02q5vc6fBnj:FnOKbQO6wt+ra6gmrXDpi+wmk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616662, "uuid": "9bf8ea2e-2c16-491c-9d33-26205fe51f7b", "value": 72101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616662, "uuid": "25d7919a-9f28-43ae-b953-4070421a995e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616662, "uuid": "fdc5c461-bf45-4a49-a3e0-8411293b6ea2", "value": "00b89779cae698d724ce2147b45539e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a0c462-ed0b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711634363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634363, "uuid": "f5d2a569-97d6-4996-8588-0ef493d53859", "comment": "Malware payload (AgentTesla)", "value": "62ed0ee9372f04bd637e3995624dbc0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634363, "uuid": "4e849f2f-6d0c-4475-92bb-f74814223fcd", "comment": "Malware payload (AgentTesla)", "value": "17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634363, "uuid": "a150b156-1afb-47be-93d2-49af0ecd6424", "comment": "Malware payload (AgentTesla)", "value": "96e4d381325b9c0a0581993529baf0cb38050faf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634363, "uuid": "134e2582-b831-4cdf-8d4d-a7f5c252fd8e", "comment": "Malware payload (AgentTesla)", "value": "ff691cd6f5b0e3729f9aa762a7b4efc5d81575fa0bf11bc063e6f7d52f16187d657452d373b184d5c294154abe45e00b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634363, "uuid": "aa1cd584-4a9c-4d2b-b2be-564720aa15ea", "value": "T1EBE412203AA98B15F4FB8BF6413080504737E6A67852DB1D1FC630DE1CB6F528B66B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634363, "uuid": "55da3362-5e4c-4df3-8056-e11b79f26ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634363, "uuid": "b7f2b535-40fe-4ed4-8b23-a592ff174c83", "value": "12288:4/K0YOwqOpWXqqfNg3Hsgtwmq+MzaMl7+fpfKIIP9HJYxbd:DO7rXHNg3HsgtwD+MzplCfxKzHJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634363, "uuid": "4d15ddd3-d01e-46d3-b028-e5532fcf4f17", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634363, "uuid": "b4f8e874-d5ac-4947-8631-e85e307cd70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634363, "uuid": "b9c0a8e2-fbc0-4594-8c05-b169a5499634", "value": "KhT.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b376e7-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616671, "uuid": "f39427ff-a76c-4358-8602-0cff2448ccce", "comment": "Malware payload (Gafgyt)", "value": "b4ce96c00cae25825ba069cbd28c351a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616671, "uuid": "9a7a3b0b-0020-485c-b8be-f4e662a5e87d", "comment": "Malware payload (Gafgyt)", "value": "18578357ed70e2378c598c88cdd617f1aaf0661ab8109025f3b388d77714d134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616671, "uuid": "3017e328-9a68-42f3-945d-3fd400680d4a", "comment": "Malware payload (Gafgyt)", "value": "31028f8118ccf357835cc13c9afe5fbeb258b436", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616671, "uuid": "6e6b0d97-96b6-4c5f-8c2a-86b23241a8db", "comment": "Malware payload (Gafgyt)", "value": "e411eb4cf96ed964192bc5207da06d2de75d49458b911bffb741de48859d094c7906fc1feb6e2921c2e3ee5dbd2d913f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616671, "uuid": "83186557-6205-40b3-a2d2-eb59bb01e2f2", "value": "T111E34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616671, "uuid": "142d9eff-9c03-441e-b502-a2b986b339be", "value": "3072:1b2NQvfSUWKL2BaE3P0q9CaJQM/9ISGJomhwfCHQC2W:92NQv6UxL2BaSp9CaqM/9YJomhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616671, "uuid": "0fef2871-7162-4064-95a3-5813add5a40d", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616671, "uuid": "c67e29c5-8db0-4c00-858c-6db58fa00623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616671, "uuid": "b54755c2-e8da-4d77-9bf3-006548f26d1b", "value": "b4ce96c00cae25825ba069cbd28c351a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29b7eeb-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652591, "uuid": "0c922f6a-ee85-43e7-8ac2-fbe66fb5f65e", "comment": "Malware payload", "value": "ff259a0962edf65cff61238cfc36c94a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652591, "uuid": "4d92e1a2-4ff1-46a5-aaad-40dce5036590", "comment": "Malware payload", "value": "1951bd730a7c6b7dc4ef03ca3700ee0403e109913f83bbd2d154a24947c166ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652591, "uuid": "9b652b65-de5e-4f59-91b0-e1e620079a10", "comment": "Malware payload", "value": "9d138c1a6e8f205a80cd0935119b612dc164d458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652591, "uuid": "d13848d1-257c-4121-8989-52a6fcd5a3b6", "comment": "Malware payload", "value": "be50fd81d0fb1c361e2f3a80602ec12090134a761500973f314b70a9459bb6913762386467d409b8454f6c46812d3a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652591, "uuid": "1ed65c7d-b358-4328-bc14-f23731dd2649", "value": "T121F5AEC7AC9140E5C4EDE33A856699967A31BC080F3477D73A50BE292F7ABD09E75308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652591, "uuid": "f939445d-091e-4eb9-8f63-8538c1a4523b", "value": "49152:fjIJ/Kg6NGN+V+efZCM8jr/dWQciyvFTaFAtfP322EcERaw:0FtKk3eSJ8T4cHgYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652591, "uuid": "8aaf138e-6997-40b0-b981-4487eb825bf1", "value": 3473408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652591, "uuid": "3a03b2ab-c29a-426c-900f-d9cc373c5c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652591, "uuid": "741704e3-535e-46b6-b304-ec22ca4a82fe", "value": "ff259a0962edf65cff61238cfc36c94a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455d4516-ed2a-11ee-a120-42010a9c002e", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1711647630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647630, "uuid": "940a983c-53f5-4b19-a6d2-91524f6bca1c", "comment": "Malware payload (YellowCockatoo)", "value": "4befc07c9e0c2d120a2b82319aa4fa30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647630, "uuid": "00de01ea-5215-4d63-a507-14b681cb27cf", "comment": "Malware payload (YellowCockatoo)", "value": "1c5cf7130d85a0350c1e152d64cda0d5e6cf8c7013810b8d0c9ef8da8d20ce6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647630, "uuid": "67f92c74-881a-495b-b23c-13aed50f8e35", "comment": "Malware payload (YellowCockatoo)", "value": "9cee2c423f7a7981ace327ce8c42c19c8d814d7b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647630, "uuid": "aeca87ca-a703-4d79-9388-80f603da6572", "comment": "Malware payload (YellowCockatoo)", "value": "e33bf559d547ac92c921aa5baa88b131415740456e43cd9ac41c3bf78d7c4851336bad944adcc1b8c1a8ea19978a62b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647630, "uuid": "2f3ba365-7b3b-4f02-9632-dd47afe60362", "value": "T15B35380737E1C988CBEC5AF468AB57D7EB2093F3D2C2C7499AAE51F1076A92574C80C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647630, "uuid": "3cc3e86d-d482-4dab-8e47-948395ce3236", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647630, "uuid": "fce4532e-2fe4-4528-b0e2-1574683eb91e", "value": "12288:EZ2t8ckk3KfIsoP/txJYZEalCarO7VOYXBvYjNa4nfkEF3qtWL/oxQ:E3fjoPlzYJS7ajo4M23qtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711647630, "uuid": "5e00bed9-f4ee-4332-841a-93798ae0c669", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711647630, "uuid": "166d9a7a-3c6e-49ce-a6c6-165a00e01b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647630, "uuid": "80bd1e44-f73d-4d93-b771-06ad9fc263a6", "value": "cABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZVEQHR_8fXkKXWPAGKGxDIDS4ecHu7OEOFapBAVfIASDJfWjN00LMS9L.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89246ad-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609705, "uuid": "f24e6466-338c-4632-9c90-d596e50f1646", "comment": "Malware payload (AgentTesla)", "value": "3c9cc76ad5198f10936b6046df83e938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609705, "uuid": "d65b5318-6a47-4fdb-a189-fa04835d98c1", "comment": "Malware payload (AgentTesla)", "value": "1d4c77db2631d25a6fa5355f7bbf1254936c675a9618f35ecdd96fed46d113af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609705, "uuid": "3b8f4a88-fed6-454d-b283-6fdab63f818c", "comment": "Malware payload (AgentTesla)", "value": "737bc49c8350974cecbf59f7c8517460eb59dd6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609705, "uuid": "064a3883-07c1-4cf6-9cd2-0771513f45f7", "comment": "Malware payload (AgentTesla)", "value": "69159a002f378b0cf73dce4e8ffeeacb5bcbfe1b02f5791e67fbc6103ce8783d7c3d7e87c11405b366c3df6473bde180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609705, "uuid": "4715c49b-b52e-4d3e-a83b-b26c25e88fc2", "value": "T19DF4015233A8B95BE93CAAF5257065E847B6393B3521E3D80CCA64DE09F5F024360F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609705, "uuid": "be4c217f-0569-4110-a358-5d9513c1187e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609705, "uuid": "c72a382b-9347-41c8-b11c-44b2786becb7", "value": "12288:sd1JsJ6SjV1Sh2iNwR+8hh/v//w1/+FJC9IwyuUItwGKjrCAXQiaex8S20k0nz3r:sdmw1GRHhtvABgC9IUtwGKjrCkQTMj2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609705, "uuid": "da396966-bc6d-4aab-8f46-52044d7894cc", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609705, "uuid": "5da83968-94b3-4700-9a7c-4c370fde6fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609705, "uuid": "954a1f46-a50e-4fc1-90c1-452c27fb9350", "value": "DHL AWB 4677349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e79232-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711651100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651100, "uuid": "45388cc3-8b3c-4475-8cd9-ab8ec25e7dec", "comment": "Malware payload (GuLoader)", "value": "c9fde985e204ab8c5cc11bd5eb6b066a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651100, "uuid": "7d35591e-b371-4ddd-abb4-b8da934cecbd", "comment": "Malware payload (GuLoader)", "value": "1ddc8ff0f9112dcea781d3b3e86b4ee4ed4b67e1bfd2fc71d8ef78eb2be06f1b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651100, "uuid": "d191c398-1868-45b4-9b61-41118454c431", "comment": "Malware payload (GuLoader)", "value": "f946ddd241de5a6a2601e8d052263b84d7c2a5f7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651100, "uuid": "0540cf35-80ce-42e4-bbed-7b973f357f47", "comment": "Malware payload (GuLoader)", "value": "6a0b516f374864f3380502b87f1d287548a7ea2fab7b925f2369790a6af986742ca13a653036aa170704dfa946f7ed08", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651100, "uuid": "02db646c-a6bc-46b6-aaa4-d4bed748ac2d", "value": "T15A342AF0CFCA26394F4B2FDAAD24445289F98199021228BDE6D917AD7243D6CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651100, "uuid": "89611b80-d317-4b29-8be1-be4d3fa6b842", "value": "6144:PthQMLtOBxJrv5lttSP4KuK8jWwoipSRUiGT9rS2fTicm7NIc+MAan:FkVBpan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651100, "uuid": "9a8d1fa4-8278-494d-9952-7cbd5805e4aa", "value": 243495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651100, "uuid": "6dd0e2ef-08fb-4f54-ba22-a2ffcd8e0719", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651100, "uuid": "dd0d1856-ff4c-49c5-9394-7a166419b557", "value": "awb_shipping_documents_bl_28_03_2024_0000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655d7d0c-ecdd-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711614612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711614612, "uuid": "483ada1e-8b93-46ad-b948-55bd2ed2ab00", "comment": "Malware payload (DCRat)", "value": "bdf110e30158c8edbc6f15cd0aff3576", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711614612, "uuid": "2ae0e04a-d167-4257-ad8a-2a541d20f5e6", "comment": "Malware payload (DCRat)", "value": "1e1d285a41469ec9a7a356475e4c9040fc54a088862b6ca5caf91f71fa986925", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711614612, "uuid": "f8878e25-4f8b-45c9-b450-2eba9137cbd1", "comment": "Malware payload (DCRat)", "value": "3546d2ceb3745787480b111c9059c31456f868ac", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711614612, "uuid": "177ed9c2-2e25-488d-b50d-353382154687", "comment": "Malware payload (DCRat)", "value": "716387221d2ba08fe88016eed7d6e83670cdde075dd3c00b4da891cc939b55c8edffa91f5a0ce0a92afa1ddd2e1a3e32", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711614612, "uuid": "537546ce-c0c1-468d-a753-26586b67e626", "value": "T14A2633307AE0E8B4C4B2193A19F58FB4193939610A718AFB37A46C1FCD796C54727B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711614612, "uuid": "b02c397a-89a8-4b71-bb80-8cc50ce87b78", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711614612, "uuid": "46ed1cc6-84ab-4332-8c66-2e6900219e69", "value": "98304:ys9m1vSTpMBdS2SybLeSPawO1Uy0cXGX8c9lHIsJWCYfk/gqmx6:yKC6tMZSy/TjOOZ2GsoHIaox6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711614612, "uuid": "72e8c738-a243-41e6-a142-ebbac4f3c0bb", "value": 4633996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711614612, "uuid": "585a9e69-b2d5-489a-9ca1-5f0b118ec7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711614612, "uuid": "12c182c7-471d-4d88-9e52-436ba635b530", "value": "bdf110e30158c8edbc6f15cd0aff3576.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6855b685-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609893, "uuid": "7d72a837-e2dd-43cc-93ad-dfacab67708c", "comment": "Malware payload", "value": "5467ec9b8bdd831c7c0561319a44749d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609893, "uuid": "5613ad42-31e9-469b-bd06-70587a8d5bb5", "comment": "Malware payload", "value": "1e41fcfdd08a87138fe7b43422a802b5fd227578a5bcca03ccab6f71b5b0356a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609893, "uuid": "8c387e62-fee1-45c8-8086-716368e042c2", "comment": "Malware payload", "value": "c88ac4c07f3e9f5aae6391b83f3833390f2a7ba0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609893, "uuid": "151189d2-4c92-42c1-9883-1de8d4cc1b63", "comment": "Malware payload", "value": "f4d8f3116e5d1543be682f7a403456b9719fe9f78823a03e4922b0a1c271523cd405797b804bb76f271b86964e09c7cc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609893, "uuid": "51d7ab0d-5cdd-4772-85d4-2b0ee5f098b6", "value": "T1420321E2C5C95B94A95A1B7BDD2357334C74007A7B7B0A305BFD8B0C201B5E85A7EAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609893, "uuid": "3d76ff2b-aea5-420a-bbf9-7578f14ea8f7", "value": "768:u08gBXcWAZGc8NnKwiQppXi/gHA5F7g0YTGSF3:fYqNnKwZCSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609893, "uuid": "e390b93f-7a4a-43f3-b385-412e442e121c", "value": 39070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609893, "uuid": "d35a506b-6dd0-4fbc-a175-2f35ba1c3135", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609893, "uuid": "6f7aa216-640b-4b30-92ff-74fd79016c13", "value": "TRANSFERENCIA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee1ffa0-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711651082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651082, "uuid": "e3d130dd-4b48-42d6-bcd1-e59151d3fc64", "comment": "Malware payload (GuLoader)", "value": "79021e344431dfff5aa6547f543b4337", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651082, "uuid": "ec9ab398-d9d5-4b75-8df0-8f5eb6a2eb99", "comment": "Malware payload (GuLoader)", "value": "1ec154ccf64f1c1e760c22f1884e6cb2af9a7c73f80cb3eb1ef04902ddcf4a3c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651082, "uuid": "ac28697e-8c98-487d-ab18-2b2c28f02b07", "comment": "Malware payload (GuLoader)", "value": "75f6cad7afe2ba456fb3413d68d79257d798ba07", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651082, "uuid": "bfeeb0b8-02f6-4545-b03b-f858283e00bb", "comment": "Malware payload (GuLoader)", "value": "edf699a463e2ed6156fec13566c37b14d2bd21f841bef483a94877d3176cefe46ad6ab27543e98d9db23269518d1dcd0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651082, "uuid": "d38fb1cf-f7e5-4c89-9b49-8b7f8b45cc67", "value": "T1F4F41228E29614DCEDCBA29208FD7DB814A24DA751C626E903B83DC62F24F771F85C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651082, "uuid": "5e7228eb-d55e-4253-8fcb-51352222f3d4", "value": "12288:1opI6Gm4TM8Nju/GZ34DGltz2BRJON0eIC8vHAX5TtL+i1GFRz6u:1opIOn/GZUGKhfAXNtDkFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651082, "uuid": "b8b8b6ea-e1aa-4e4f-9d5c-7f2eb24ca22e", "value": 726561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651082, "uuid": "620f1352-ca3b-4a29-8d34-2f199dc99fac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651082, "uuid": "c2960f04-692c-4378-87b0-ef639c531537", "value": "Signed PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513ed9f0-ed0f-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1711636053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636053, "uuid": "d701809b-5a9e-43c3-9051-a1eb4b80644c", "comment": "Malware payload (GCleaner)", "value": "eeeda33b6561043c0e331eadc2fae28c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636053, "uuid": "95036550-7026-4190-ac37-9208f16734a4", "comment": "Malware payload (GCleaner)", "value": "1f4db635b14e316532f5c29e3c03a52459ce43df9517adf81c7b2057450ab037", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636053, "uuid": "9f6bce3a-6acd-4c22-92ba-a89629b40353", "comment": "Malware payload (GCleaner)", "value": "1e41aef8f31573cf174f12d923d451988ac88dd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636053, "uuid": "fd0a33a9-a235-4e7b-bb26-dfa35b49edb0", "comment": "Malware payload (GCleaner)", "value": "1d433a5b1f59dc8197dd6d418dc3e78b16679cb0ea8e0d4b2104990f745cfa87834d6799eac5167bbb5133193313be0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636053, "uuid": "96e8c349-52bc-46f1-9646-b453bf4526a1", "value": "T12854CF0176F1D071F6F70A329874AA515A3FFCB39D654A8F3398220F29752D09B26B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636053, "uuid": "bb20a20b-6136-497f-ad57-9f896d9dab33", "value": "1b67119179f8385f294929b38dacfd5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636053, "uuid": "beef4c5f-39a2-46cb-ab10-2a7d639d4d3e", "value": "6144:3zWZwVZqDrqxUG8Vqtj0W5akevzLZ83e:DWuHqDuSjVMj02/S/O3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711636053, "uuid": "caeb7d72-8729-4a9e-83c9-d429e1a46937", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711636053, "uuid": "70915afa-8911-4393-8ab7-2de36001884d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636053, "uuid": "b5e95d04-1be8-4481-a3d0-1c6675bf167e", "value": "eeeda33b6561043c0e331eadc2fae28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b81c5d-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMatter)", "timestamp": 1711642629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642629, "uuid": "ecfe68ae-7a0e-4a0b-99ad-9249eabb07e5", "comment": "Malware payload (BlackMatter)", "value": "a2bc2785420b0c6f685d8692d813fbbc", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642629, "uuid": "b10d8344-1f37-4f4b-9142-bb425f8fa00b", "comment": "Malware payload (BlackMatter)", "value": "1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642629, "uuid": "c7fe5c32-66f9-4d89-a7c4-bc6c121602b1", "comment": "Malware payload (BlackMatter)", "value": "b118551289c9398a339cd1161b2c101571d4b5fd", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642629, "uuid": "969f95a0-93d4-4538-98c8-688976bb4860", "comment": "Malware payload (BlackMatter)", "value": "b112782311ee9e194843653d4300d0e2cea4619a8fb598c68c6b6c34846b1d2012d113d079a1b32b64dba5bacc5f65f5", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642629, "uuid": "daa5cefc-574b-4bda-9a26-12043fe8b847", "value": "T1E0F36C227152D177C4A239F1B32A76A1B39D8E2C16A8A453FAF8DF0538778237F11947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642629, "uuid": "adce40af-5b88-49f9-b6c8-0faa10b6af86", "value": "a50a0d82b9120fc73965c28fea79e1f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642629, "uuid": "ec3e2850-5c39-4a24-890f-8591cba80655", "value": "3072:W5uyulsHwDV1gFnTwn7zwJGJ+at5kCI5Gzei3N2VzRmK:W5uZ1DPgFnk7EJwJI5gDN2VVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642629, "uuid": "46b2e609-1aa0-479e-9432-05f65c382a28", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642629, "uuid": "e71525a5-1486-49ec-86f7-22342dad83f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642629, "uuid": "7e9b67c6-15d2-40b0-957e-bc3a5c024b61", "value": "lockbit_unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf0e122-ecbf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711601874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711601874, "uuid": "0def3054-c0cb-45cf-b86e-f8ffb223bc55", "comment": "Malware payload (AgentTesla)", "value": "c45c19b5790cf57045ce3f8222c412f2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711601874, "uuid": "322f7230-e676-4860-9335-45fb4c53ff93", "comment": "Malware payload (AgentTesla)", "value": "206b4b5ab8a00697a7161de7822d5235e4f9d913e57e503673cc0437c2ddceb0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711601874, "uuid": "4a006f24-6d7b-43be-852a-74c42ee32ba4", "comment": "Malware payload (AgentTesla)", "value": "818996bc52b3ff2d17620bb8d4902d80e7643ab6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711601874, "uuid": "73f3305f-0eef-43a5-b9dd-3d9f52da7c96", "comment": "Malware payload (AgentTesla)", "value": "7ac2e0594cde3dfecf0b41075935883dce47ad829d64926416faa41a6a4d8c8586f7de9a2e62d9e126470f7f942223b5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711601874, "uuid": "fb8da605-7089-433f-88e9-b448c68b93c2", "value": "T131E422517E16C63AD1C914B00C52D6BE91397E82AA20A61F3CE47F6FBC7ABD1366005F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711601874, "uuid": "3f05b02b-b916-4937-9bf6-d4e32433e7c8", "value": "12288:wY5qjl5sV3opXxW603Hioen6ZH6i4bgc6ZLXgf4Kx6IF0TGLqk98h:wY5mvXUH30n656iXD6GIFlrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711601874, "uuid": "31dbc9fe-b753-42b7-93da-480deaa00e5f", "value": 659304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711601874, "uuid": "d4b9ae7b-8787-4ae1-83e8-236e47f69974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711601874, "uuid": "323fd262-e10e-4bed-aff7-5a52b00f8b5d", "value": "c45c19b5790cf57045ce3f8222c412f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae78225-ece3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711617172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617172, "uuid": "23c34b1a-6c96-40a6-a30b-57a3b6648a62", "comment": "Malware payload (AgentTesla)", "value": "2c520c9db37e16343941bbba36fc22ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617172, "uuid": "2c803e24-0c54-4bbd-9d47-2b8fe94d7fcb", "comment": "Malware payload (AgentTesla)", "value": "222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617172, "uuid": "f1bf4365-80a2-492f-b391-f38891c8bb56", "comment": "Malware payload (AgentTesla)", "value": "b168bb726e9ec94166e60cc3d502843058ede5a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617172, "uuid": "ea761805-6379-4e81-8b9e-42a98f7bd2b6", "comment": "Malware payload (AgentTesla)", "value": "933ea3e4a7368363a68e78d44917c59b9987d272eb6e38bf78d93bb3506cc6c1fe9f8933be4b8b07c8a1dd26c68b4c00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617172, "uuid": "8fa9f088-cd65-435a-80b2-3cb18ae97d1a", "value": "T172152A9BB599523AE5C9EBF2E3679CF39D6432FB593602385D1C2E803B0D70D4B52224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617172, "uuid": "2c2e45d4-8e18-4f79-a0bc-f073b1009091", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617172, "uuid": "cdd9e5a8-f2e3-4741-ac73-1ba9db15b08f", "value": "12288:Z6Wq4aaE6KwyF5L0Y2D1PqL/2p7v95HcYuHfWpKbyiJZUHKA4b5:vthEVaPqLOp7v954uMbyiJWHKAK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617172, "uuid": "e7d7107f-0268-4ae8-a71a-d19eec56e46f", "value": 888787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617172, "uuid": "3a955435-c80d-4a28-8529-ba57790d3cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617172, "uuid": "9cddff34-282c-4ebf-96d3-742e920279fe", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fb573e-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload (Miuref)", "timestamp": 1711642586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642586, "uuid": "554a7680-1cc8-4308-9c2f-3fa27db6942b", "comment": "Malware payload (Miuref)", "value": "97f55264c8760830b70ffcc058cda63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Miuref", "colour": "#99E433", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642586, "uuid": "cc8adc93-c198-48e4-be9d-6667ddf8506e", "comment": "Malware payload (Miuref)", "value": "22463d93ff44d3e221c9f8ec5b9f0fb561c1f9fd2c797bbc17b35b2d77282d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Miuref", "colour": "#99E433", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642586, "uuid": "af410868-f7fa-4624-8dd4-401d2933040b", "comment": "Malware payload (Miuref)", "value": "a20a982a730098f73880f20032a26e496b93437b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Miuref", "colour": "#99E433", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642586, "uuid": "6a3731b8-bac6-4fcc-afc3-0f33e32d9a11", "comment": "Malware payload (Miuref)", "value": "caae364bfe46d205edb0538978d0229b6e5400075e8e0079933074e292dbd8793275629d8c2b5b6d211f7265cedde2e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Miuref", "colour": "#99E433", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642586, "uuid": "adb3acf6-93e4-4682-b86d-b582cd722ea9", "value": "T11B54BE293A7CC623F1E604B4956DF760B67CBC700915416FBA98378E3EB52E15D2A20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642586, "uuid": "2f0c128a-339c-498f-80a1-326fcb9647db", "value": "f7c2fa537c5dff63023bb69a30f642ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642586, "uuid": "c48a40ed-20a0-45af-a67d-76d2e9480b1c", "value": "3072:cQbLeju6zRMIsvHU4mJ5i0lk7/Pu+9eIV67MEMFvNyDgH+AIUiJDNL2V2kEN3Q3/:2juGs/U4mu0gPl/6p6AgtXSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642586, "uuid": "ced44d1e-735b-46ff-bfc5-e33c2bbeefbf", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642586, "uuid": "4c7c7d8a-5f3e-4ba7-b835-3e79f0b2906d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642586, "uuid": "347b4ec2-2914-4e27-9116-fec2ef3c81f2", "value": "SecuriteInfo.com.Trojan.Siggen6.38594.5893.10844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b7acf5-ed54-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711665671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711665671, "uuid": "41c9212c-be4d-46b0-9127-256f7a2069ed", "comment": "Malware payload", "value": "1779627dd7d0b5f1f153c86310e19e38", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711665671, "uuid": "3ff59fa1-71f1-49bc-952e-8b960a8b3754", "comment": "Malware payload", "value": "2667daaca947aacad72b75be1eac26e68e971c5dd54db86cb74c2832b5dad245", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711665671, "uuid": "1cc545ac-0da0-41af-aafc-99900f031dfa", "comment": "Malware payload", "value": "d67a94b0418aa74c8e0d366df33eb6464a770460", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711665671, "uuid": "973e768f-4b5a-4a3e-b8f0-8c62916074b7", "comment": "Malware payload", "value": "902143948e5c9dd39d468caa59096ee53d77d74fd7311475bc59bd36af110dc9a45fc776903cdb931fc1ffcb05569ff5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711665671, "uuid": "23390231-e07b-420d-8b63-ce1699dd0457", "value": "T10516BEDBF7D4A95BC8F35332C17A56A502474C228B83DFC36A54723C29BB6D40E59AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711665671, "uuid": "23e15c6a-106b-415f-b9e6-f403a50b37da", "value": "98304:K1/vSuz+ozEakLU1vPMoTwr5qBTvSPy5699i3evjXNnmR7:rapDq9KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711665671, "uuid": "1ebc78b8-8df9-4e9a-8ccf-9dd8c02145da", "value": 4258116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711665671, "uuid": "76c1a2c3-69d5-4a7a-9e75-2d0705a35f46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711665671, "uuid": "fe5da983-eb6c-4fdf-815e-793bb5d07cf3", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89704e0-ed0b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711634616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634616, "uuid": "76b667c6-5ee5-4023-ad32-5640f6f3c573", "comment": "Malware payload (AgentTesla)", "value": "6b34dd84ec9e3dbce901315c739181a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634616, "uuid": "db8c403f-213e-491e-b639-3ca73de794c0", "comment": "Malware payload (AgentTesla)", "value": "266bbc855f7bfabdb34ff1c9a53d567f1edc98640e160dcef7539d1e0b24796c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634616, "uuid": "81274779-6e18-449a-87d5-4892107877c2", "comment": "Malware payload (AgentTesla)", "value": "a7b22899ffb4ad16e6e2849a982e51e4e2bb6c6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634616, "uuid": "0c9d0b48-83dc-4db1-82d7-193322d60c90", "comment": "Malware payload (AgentTesla)", "value": "90fc2a06ee3cc76c5cd72db20fc33d8198394cd55900bdb9e278ae88dfd86d9a0760df1cd8edcbd52b7328bac1b72785", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634616, "uuid": "409a0778-1201-4f61-8858-8c2057685e18", "value": "T1F6D423D19DD8F9A3C478FB1616A7799CEBBD9F78E9C493C253DEE210990612D80100E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634616, "uuid": "69f0cf87-90a7-4f0a-a1ce-4fb0dea298b2", "value": "12288:e49dbJOC2NO/tRrogVsMdKrET4n9gq6IjsongjeXyfxK3+4Az7iXf/WKxASZH:xFrPVsbrEo6regjWiv9i5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634616, "uuid": "a4ecf631-6371-4b8e-ab07-39bc905a068f", "value": 651834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634616, "uuid": "41ebbaa6-0ddb-47fb-9f49-2cd507335ea6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634616, "uuid": "7dd03985-aadb-40fa-978e-fcf7295175d3", "value": "BL-SHIPPING INVOICE.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b73a914-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651103, "uuid": "dce8c088-e753-498a-9e19-75ab57081b63", "comment": "Malware payload (AgentTesla)", "value": "59200834d1f2d2e7bab5ba30673d4cfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651103, "uuid": "4890ad03-da61-466a-a913-9adf10ae9604", "comment": "Malware payload (AgentTesla)", "value": "27246335d057b1f5bcaafd4655ad328b24400b2337801ae27695558484695419", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651103, "uuid": "18ba30a2-cb48-4d74-ae48-0a1ce936dc7b", "comment": "Malware payload (AgentTesla)", "value": "b6bbf692dd8d9be2e3a0aff8ebee2cc45c072c50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651103, "uuid": "7a67a395-cbaf-4e45-87fa-56717e03423e", "comment": "Malware payload (AgentTesla)", "value": "4e1c7404774e8e60782250ef856ae0f31643da2ef55b687ea8cbde5be697b53dc91aad745909cea2db37e0f0832c3b41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651103, "uuid": "52d9d667-af69-4a7d-bcbc-13d520bbbed8", "value": "T18003EBC6ED8AAF944D869E7BDD0217324CB6123873370A30A7B9C24D627355859FFAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651103, "uuid": "3e71e6f1-675f-4593-9e93-d656e1cd7c32", "value": "768:u01gBqQWAZGc8NnKwiQFNof+OmTXP9aTaSkFs:enqNnKw1OEXP92ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651103, "uuid": "15eb2a66-272e-492e-94f9-5bdb4cf20c07", "value": 38497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651103, "uuid": "cdf80161-ea4d-407c-b829-05cba80fd87a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651103, "uuid": "a221843e-d2e1-436d-9bba-ff2b455da56c", "value": "Transaction Advice_280324-WS-394-1247.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d021cccd-ecdb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711613932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613932, "uuid": "f0c0a3f5-1db1-4c82-b533-440b394f1af0", "comment": "Malware payload", "value": "67890fcc5a391a8914e9ffaf209abecd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FAKEOFFICE", "colour": "#015CC6", "exportable": true, "hide_tag": false }, { "name": "TROJANSCRIPTAGENT", "colour": "#AE3C56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613932, "uuid": "4a9eee4d-ed30-476e-8aad-24d1dff895e0", "comment": "Malware payload", "value": "27be6ed296617b8b4fe5cf1e9a4c0e4547c81d3cbf4bce524792d8e971fb290f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FAKEOFFICE", "colour": "#015CC6", "exportable": true, "hide_tag": false }, { "name": "TROJANSCRIPTAGENT", "colour": "#AE3C56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613932, "uuid": "edb06ff2-4c9b-40cc-a34a-aa7cc7698274", "comment": "Malware payload", "value": "d7f8448dee9b8f76a4b007bfe0da83f52eac674e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FAKEOFFICE", "colour": "#015CC6", "exportable": true, "hide_tag": false }, { "name": "TROJANSCRIPTAGENT", "colour": "#AE3C56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613932, "uuid": "737dbb2e-0127-4b9a-9572-81d4df8b9b9f", "comment": "Malware payload", "value": "02cf7727d5365d26e4833afc13bf069f27fdcdd72a2b7be3a2a9bc7983a91ab77785ef6540ba2364bb389e387332523a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FAKEOFFICE", "colour": "#015CC6", "exportable": true, "hide_tag": false }, { "name": "TROJANSCRIPTAGENT", "colour": "#AE3C56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613932, "uuid": "b36d4424-c162-4cfe-a5e9-09e465c538b8", "value": "T1E3555A0633A1C0B8DA6690B2C625922ED7717414C72B8EDB64E05EDEFFD2A905F36731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613932, "uuid": "5744c8a7-8a5e-4b31-aae2-f9e5350b7862", "value": "b66b962f1654841b6655c9e59651771a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613932, "uuid": "f185428b-4895-451b-b756-b927453d2d27", "value": "24576:5EqYy2vg041qFrGsZPUaEI7n3eWbn8/XXQGGH8BTLxeX1fiYM4Qe6fqwo:5EqFcg041qFrGsZPUaEI7n3eWbn8vAfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711613932, "uuid": "9fc344f9-a99d-4da7-b2c7-fa332488c9f5", "value": 1371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711613932, "uuid": "4f3df604-a945-4031-88e8-67093fb1351a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613932, "uuid": "75fb574d-5dcc-4f10-855d-5564925bb959", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7ab9be-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1711617817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617817, "uuid": "34fb8930-d766-42d9-b8a4-8b3e35129401", "comment": "Malware payload (CoinMiner)", "value": "6614077c77a8182f0307a720071f2197", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617817, "uuid": "2557ce49-1922-4ea9-ac48-f84205b4f185", "comment": "Malware payload (CoinMiner)", "value": "2935daeddeb1f505cea4ad368f598ab029942d91d831b71bbe4de5284c7a3132", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617817, "uuid": "76535c55-b7ac-49e4-ae44-3e7f85c225dc", "comment": "Malware payload (CoinMiner)", "value": "06a06a6d02ad281942ed8b6890f099be54275bb2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617817, "uuid": "39b6c3c9-7345-409f-8a5a-1cfa722f2b50", "comment": "Malware payload (CoinMiner)", "value": "57b97e10f3c9734d470a948a12eb900e292d90ff621fabc31356bef309d1242839ce5144276c5ceac0b4bcf5b84257db", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617817, "uuid": "348aedd6-c6ba-4aed-bbd6-e8670f6b03b4", "value": "T1F3A48D05E7E909F8E0B7E678D9664902E7773C4A0370968F13AC166B1F63790DE3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617817, "uuid": "f08c0781-a717-4f81-807f-c05eacbeb813", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617817, "uuid": "89a3fe30-5627-4366-9520-873a7107a0c2", "value": "12288:QLMEalqxXblqoRX5qbfphLxaO3qX+t4SJ:cqaXNabfphLxa4w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617817, "uuid": "d7b2ef82-6339-4e73-ba23-4774bd9bc33e", "value": 462769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617817, "uuid": "67dea06b-ae53-4f72-b8d7-b77bfa07f111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617817, "uuid": "d7368d2f-ef9f-42a3-8fe8-0fd69077285a", "value": "SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5f4ed2-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711652017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652017, "uuid": "dff3ef49-0c6d-439c-be23-39da9d7ca5b2", "comment": "Malware payload (Smoke Loader)", "value": "26ce123ca4fb973543d48c2da9ece87e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652017, "uuid": "29e39d95-b274-4f5f-ad0a-f16bfa90547d", "comment": "Malware payload (Smoke Loader)", "value": "2952319efa611dd3cd0704bd8bf3f6bce423cd88aace8e28e51b19c672d209cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652017, "uuid": "ddf8fd90-51a8-4f0a-b28d-82e3f334af4b", "comment": "Malware payload (Smoke Loader)", "value": "ab474a3c06831b4f673f400f912f77cd3fd154fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652017, "uuid": "a2f97372-c62e-4843-bf5f-17279e7a208d", "comment": "Malware payload (Smoke Loader)", "value": "03cb8480ff074955e9efd6f8bccfbe96872005580d2c1e2b634814b13903df8699f5150ae4085b16e6c40c207a643f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652017, "uuid": "e7639ffe-fe1f-4cb0-ab49-5c8ae0b82f3a", "value": "T180648D1372D2FC60E66247F28D2DCAE8223EF9628E556B6733586F0F34711A1E263751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652017, "uuid": "b72dffec-7d3a-4688-a0b8-a973a7bf95ab", "value": "72e186f4643d828245a9b4274ecaa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652017, "uuid": "22678a48-5fb0-4608-9a84-18b8a08ce7f1", "value": "6144:0L8EEnOV4QFDXk44lMZzx+dzj8aYI0FjT:0BEn+FDXXZVKzgQ0F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652017, "uuid": "d6232fdb-0c08-4a5c-8837-3da95dfb1441", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652017, "uuid": "d670f148-b930-4531-a06a-119b77d8419a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652017, "uuid": "1423c39b-c360-4ae7-b103-b8e1783b6b08", "value": "26ce123ca4fb973543d48c2da9ece87e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346d601e-ed24-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711645024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711645024, "uuid": "58ba4884-30a8-452d-a074-9d635e73bf4b", "comment": "Malware payload", "value": "e18482a72547a0f7e382804d8aabebc0", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711645024, "uuid": "fe938dab-6cf2-4ab6-a0ac-6a3b2d5ebe7c", "comment": "Malware payload", "value": "2bad2d85270057cf0f76a09e59c5b9912bfeb559985c5dfd97647c2c484c30d5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711645024, "uuid": "c02922ba-6bd0-4d14-8638-d2c05f0b17ed", "comment": "Malware payload", "value": "b5e095aece7b7926694f5bcf92a628d4845b3f2d", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711645024, "uuid": "f770cba0-8604-46e8-974d-b220595e4a00", "comment": "Malware payload", "value": "fac68a2715ea6237361cb8fbc7814a504ade9a57b64bda9d5ef81a3990b14e05ea7bd586e59a9af7b8d3d446923585bf", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711645024, "uuid": "85849737-6754-4f5f-b91c-f4634e885f06", "value": "T10CD6DD4A59B7C7D097B34213DFDA86CEBB2BBF2D2477181D2A48E3DFE545001062A8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711645024, "uuid": "07d5f6ef-a5c8-4620-9960-fd31c00bc73f", "value": "196608:8UIeBWUzapBn68PHtqNOK1cBhDO0t+pButE5c0SswLefmvw/KI:8UI86r68PwNf1cLO0t+pB0E+0SlL3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711645024, "uuid": "592f2584-6f9d-4ed8-bd0f-85e23dea3811", "value": 12846160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711645024, "uuid": "f6d533ae-b738-46f0-b0c1-96ee3e6a4220", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711645024, "uuid": "29681071-6527-4023-9fee-bf4facad065e", "value": "2db7438e5b4298ce068006ef96f729fd0bb4863e856425215ad9e77f807562e0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3560b2e7-ece8-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1711619256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619256, "uuid": "8491e7d2-6f92-479d-bcbd-67a4ff7d1984", "comment": "Malware payload (Neshta)", "value": "e77f0d830d8353f748f97ea6c692b7f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619256, "uuid": "9763a6a8-2c9a-454f-8b18-b80725d5197b", "comment": "Malware payload (Neshta)", "value": "2c39793aee8f8966937d52468306f422151978e4b43d665a09f78e5c91fe5401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619256, "uuid": "39237469-95e9-45df-8409-cf299801334d", "comment": "Malware payload (Neshta)", "value": "7202eec3edccf41aa004e542c1956533b9ac8c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619256, "uuid": "24316185-79db-40be-b69f-4bec14435bad", "comment": "Malware payload (Neshta)", "value": "33a7210f658c8b8575d6c253f431f75075e84dd3874128e540c1b9a80ffd6397e33c76508e05ac7e1227b4d547fb476b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619256, "uuid": "a7abfa42-b05b-47eb-b7f1-7a88f8dd825f", "value": "T155F4E09C3660B6DEC857CC72DEA86C64AA617477830BD203905716ECAA0DADBCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619256, "uuid": "9f37b862-b121-4bd5-a389-d3ee1af2bf63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619256, "uuid": "15a673cc-0c14-4982-91e5-c37284dd1c21", "value": "12288:2I0YOwqO8Dx1q3oIGkuFsxwkG7+qF2UA6zlH+AfS4NtT9gnjs5SJd7DrXZAmDk1M:nO7O8Dx1qRuFsxwke9HpV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711619256, "uuid": "f6d4ac90-05a7-4084-9e62-4df58f33e714", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711619256, "uuid": "f1869fb1-9391-4313-b3b2-d2b7bbe2e6b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619256, "uuid": "2ed46154-6249-48b6-b9e1-5e212ae21659", "value": "Order 24007219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c40a49b-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616637, "uuid": "ab4f18ad-749c-4f86-af6d-c33c9a8f46ac", "comment": "Malware payload (Mirai)", "value": "32834c0ea0f969124d812344d37b5dfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616637, "uuid": "fee1f0cc-25cf-4da3-a4d5-34e0456000b7", "comment": "Malware payload (Mirai)", "value": "2c6fd4b1ee23d0985390bedc9ed0441ccd91326c8f506b3798ba8205faa97565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616637, "uuid": "56c4f2c8-1d8c-412f-abfc-e71e8be26498", "comment": "Malware payload (Mirai)", "value": "09046c3de45e91ae8c8daf7fb75b574774da857e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616637, "uuid": "9e862f45-530f-4027-8141-207c35cdfd34", "comment": "Malware payload (Mirai)", "value": "448e854c5fc40e6b16cdfd39398f40b7371b6a6ee96d7da27345ef17b99c60b918a6ed51f03b700e8eb69c02e9dfb05c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616637, "uuid": "09dbe788-7c53-46ce-bc34-4e023791062a", "value": "T115634D9AA801AD3CFC5BD5FE40620B09F921326495A30F1B9F9BFDD36C720E65D16E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616637, "uuid": "5b662cad-20f2-44f8-a748-99937fbb4e1f", "value": "1536:J0ev8/WQ9txHgUHuir5W6QIIlnw8TZiZAjp3x3g4QsTe:JBv8+QnxHgUHuir5hQ3FDVth3vBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616637, "uuid": "49e8139b-d01f-41dc-b513-9acc02ba15fc", "value": 70832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616637, "uuid": "68e46b37-d3ea-4f56-97b5-10d00a7b0348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616637, "uuid": "362f1f3e-a463-4e78-8dac-3c0fe8ee5fe5", "value": "32834c0ea0f969124d812344d37b5dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f87e35-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711651115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651115, "uuid": "e0b47060-b598-40db-92ce-943ebd663626", "comment": "Malware payload (Formbook)", "value": "f676b2e399bb66aff93ea75e288cc77a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651115, "uuid": "aa9308f0-76c7-425a-b535-00dbbd52f183", "comment": "Malware payload (Formbook)", "value": "2cc218a62d049d31355e7976c899c8dc1054a6adfc82ab27497b08f780644f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651115, "uuid": "1c1fbe09-f98f-49b8-be2c-ed32d765a587", "comment": "Malware payload (Formbook)", "value": "c070d9d7f4209197a1de3863d3931c793de2f600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651115, "uuid": "b794dce3-fe2f-45ae-ad68-117855c4abc6", "comment": "Malware payload (Formbook)", "value": "efe5e8b5cd90c5ffbcbd95fee70852825754e85a45a19535016199fee13e359a4b8cb5a4c64245c92887de1412b24f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651115, "uuid": "d05b629a-a5f7-4ee5-b16e-087580f2b2ba", "value": "T146D59D21B85B8E98D34EC733CDAB8404BF6DD7806513C30FA9C9B744E143BAA5D4966B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651115, "uuid": "52a6e9b0-fec6-43ec-ada0-eec10a4d7086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651115, "uuid": "a61273ed-beea-4464-8071-6f8b28b01ea9", "value": "49152:6hIFVTE9ox8jJbzMM8HBKTRyjylyT0naL374neHJwZ/nK:2IKghKNgsywa77bHJwtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651115, "uuid": "8a1a67ac-79bd-4873-a5c5-56a55ff4b4c8", "value": 2986496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651115, "uuid": "76b2bf3e-3bf9-4638-801e-748108a24ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651115, "uuid": "bad9a819-20e3-4d36-bba2-52037861d634", "value": "QUOTATION_MARQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8480b02a-ece8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711619389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619389, "uuid": "59d2928c-2526-42df-abbc-1aa33e9af194", "comment": "Malware payload", "value": "846f23e2f150188cd815afcd6fc85440", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619389, "uuid": "0e8553da-b735-40ee-ae74-a7724cbcd6be", "comment": "Malware payload", "value": "307815ae8a2bd9a920668ce893ef1b3be775065d414162763368efbebbe85d88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619389, "uuid": "33e25107-1bb4-4dc9-a17a-7e6df10705b9", "comment": "Malware payload", "value": "f73a69c4505aef8bccf299e2840e9660122e36cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619389, "uuid": "543cff7c-07e2-420b-b27a-3999b3a90fcb", "comment": "Malware payload", "value": "4db0b529554aeaeefa2c31cb29f4e5f24945b0fb3cc3ec11c0d3f5e320a9cce87fbc332d072eab24de87fac0bb9bc62b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619389, "uuid": "8ca64537-0e6b-4cdc-a34c-cd1605695195", "value": "T12104F72DFFC2AF8AEBB93E7445B23B200A74F1CB1D82D71B4116457B3D122C959E5292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619389, "uuid": "91583038-ca6f-4d75-9755-c31505eb8c97", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619389, "uuid": "0aaa260a-0076-4a3a-88d1-bf0a07930f91", "value": "1536:0tq3fMmbFv/I7rXb3/+HDUQDxiari3aYdYIrYgPf2jzRD/dSRQltGt:FfMmbp/IP+DUQ6b12jtD/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711619389, "uuid": "a27769f4-72da-4ed3-a548-0fa05250f561", "value": 182088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711619389, "uuid": "9a2a730b-9d1f-410c-ae0a-0285f5e5cf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619389, "uuid": "8fa51b78-7f6c-4910-9af1-c2654084e00f", "value": "49758b8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cea4346-ed52-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711664715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664715, "uuid": "cfcb0388-38e3-47a0-bbd3-320aba156a5a", "comment": "Malware payload", "value": "99e6eb18c870372dd39f1f3e491f91b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664715, "uuid": "f8afa3ef-5f99-44a9-bb6e-e70af3664e20", "comment": "Malware payload", "value": "34a1b86d7355b5effffa36faa80c432a86f4ba6b3164cb35f5abe0d65cfbfa4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664715, "uuid": "12076d5d-93cb-40fa-8860-742be4230b2f", "comment": "Malware payload", "value": "3248418514e5a21f66cb43b8eef1be5925177bde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664715, "uuid": "4ebda8d3-da46-4b38-bc56-2989202529f7", "comment": "Malware payload", "value": "e30a2b5ee0d40a12349c0bc7ba8081ff88ca71f513f0779cd50986df35f55961f835fb7cd881609d7f0b6136fcc46a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664715, "uuid": "91cba727-96fb-4f8f-a69c-eb90f63590e8", "value": "T103132959BE254CFBE652533E84E7C7762B3CF1814A235B73BB30B7305B236922099256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664715, "uuid": "b01ab5fc-81a6-409a-a9e2-ac4c000456ee", "value": "56c331205a2e6363b4ccdec1da40351f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664715, "uuid": "bd83c9a1-1f81-4bef-a84f-5611c93863d3", "value": "768:3YOEz+OJApuvBkBsMPP3lLuzZPKqhLJrMb9Lqp1m:33OQ0MPP3lLuBZh94bMp1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711664715, "uuid": "feece0fe-85e0-4b72-a46a-c2cd4e0d8773", "value": 42131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711664715, "uuid": "070ebc50-75a9-46f9-9ff7-99ac905ec660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664715, "uuid": "ea1cafa2-9263-4431-9397-02516fc7b849", "value": "SecuriteInfo.com.Trojan-Downloader.8862.17468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a43b08-ed40-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711657213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711657213, "uuid": "2048434b-f379-4f97-bc1a-b5f1fd84923a", "comment": "Malware payload (Stealc)", "value": "6fa4f14d89259a3ddd6fafeee57c0d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711657213, "uuid": "94822ace-b88d-4557-ac48-80cfa6e1223a", "comment": "Malware payload (Stealc)", "value": "34c57850f9f97fca511bb2c3716008f9ea18b22f9eb1ec7fdae0d47ab8f97eae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711657213, "uuid": "5200dac5-77e1-4b38-a204-6a0481058e34", "comment": "Malware payload (Stealc)", "value": "b04f4b4c712a0b95b570e4c1b3bab26500a42eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711657213, "uuid": "ebefc03e-eec3-46db-948a-1ca01753adda", "comment": "Malware payload (Stealc)", "value": "2d6efa6161a27528b97c734fa6eeda9a8062a9787e92087328c5fbf223e59fe71e88700b9b58acc7c0a1233bf11741bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711657213, "uuid": "583b2a24-60e8-433f-8c10-792d8713f304", "value": "T1A944BE1276E1D675F6F306324C749A840A3FFCB39AB5968B33992A4E1D712C04F25B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711657213, "uuid": "96954d6e-a017-4576-a9c0-dec5d51dd49d", "value": "e87c9c66e32f791de60bd46f1df17fc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711657213, "uuid": "9e25eee7-d1de-4df0-93e5-1c9a5997b7ac", "value": "6144:ADb2OudtR+Ekpr625czhXfKZo9cKovAkOYqQ:ad+tR+NQoczhiUczvALYqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711657213, "uuid": "07999c38-e278-4483-ac4e-2c2ed05b1f45", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711657213, "uuid": "bf6aeda8-c2a0-4936-8a2c-6379782feb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711657213, "uuid": "4c91f6c5-d85b-43dc-b046-5f80a8cfa32c", "value": "6fa4f14d89259a3ddd6fafeee57c0d64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc944cf-ed37-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711653305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653305, "uuid": "c3c8821a-14a4-4c36-a111-8736cbe32316", "comment": "Malware payload (GuLoader)", "value": "46bbacb63c2f6c440be347e99210c3a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653305, "uuid": "7ffdc7f8-5672-412c-94d5-3d0eca423a14", "comment": "Malware payload (GuLoader)", "value": "3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653305, "uuid": "bbbca338-24b7-4150-a677-66ba00acf145", "comment": "Malware payload (GuLoader)", "value": "8b3f6920bf657fd1973069540ec5990b2033e69a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711653305, "uuid": "134d3e8a-1d54-4026-ba48-35c49341fca5", "comment": "Malware payload (GuLoader)", "value": "50711af8c3f2cd5323b2bc9c1dc6794832aaf31ef8c2683d6a988bb95fc4e502983715b9b24ac8ad3ee18d267a474674", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653305, "uuid": "7c234b75-42c0-480f-96df-6347088bf683", "value": "T16CA4CF522376D863E39447B48555F77DCA71EA8A2C32C23B2AF1ED5FB108F767818211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653305, "uuid": "5c72ede5-0339-4e7e-858b-d88b36ed7295", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653305, "uuid": "1adda895-b4a1-4592-85b5-0db950b4ac0e", "value": "6144:olJZfHKsHfGCZ71Cn3R1E1+hf6VkTJluAMHQaMWDLdzsaX4O6zTbw6hE4F0FDgCJ:oluqauAMeWm5OKU6O4eFFpd6MvV/lzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711653305, "uuid": "bb8686c3-2cc9-42b3-906e-a8e37dc6a3f2", "value": 481006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711653305, "uuid": "264c9617-d595-4b44-ad1f-c091fd04ee77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711653305, "uuid": "c0b6792b-1350-401d-82d4-8649ab2b6862", "value": "46bbacb63c2f6c440be347e99210c3a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3f785b-ece1-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616315, "uuid": "81362e8b-2257-4b5c-be49-4afd1bf2058e", "comment": "Malware payload (Gafgyt)", "value": "c70f06943d2d6c69b922b11e6ff90b7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616315, "uuid": "b43fc574-7e96-479f-bfff-ec3268e7b1db", "comment": "Malware payload (Gafgyt)", "value": "3b2d2687228295752641b05b2a4d340c16fad7c52d93d3e959e6b31e3145ad10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616315, "uuid": "7b60ae43-5956-4e2d-aca8-dddde811a309", "comment": "Malware payload (Gafgyt)", "value": "29a48a3cf80854dd12586bd45c583d44e7029dc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616315, "uuid": "d1cb3a85-d119-406e-a594-dd64906dcdd3", "comment": "Malware payload (Gafgyt)", "value": "1592ab4ede25c170bf841be5f4359e3f575d9256ca6aa868a101bfe213cd007c25c2c2be32bf1a198b424592a688e5da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616315, "uuid": "1b4bc495-1154-4d3c-af39-d73c9846c8c4", "value": "T133932B41F9418B17C2C327BAF7DF439D37366A5897D733016A297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616315, "uuid": "ae4a01ee-ea0e-4d05-93a8-47181373bca7", "value": "1536:7TqOIBM9ItFCzx5O8nsMyYP+CvXAOStVNLb2pqmkgmQAE+dAXDfj:iB+zTscRXAOKKkmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616315, "uuid": "7f3e042a-cde8-4474-86a7-6f85db2c249e", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616315, "uuid": "89024478-92ae-44f6-91e2-6af3c2d4d90f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616315, "uuid": "631eb8b2-3dd3-44c4-8a68-4f4928a76791", "value": "c70f06943d2d6c69b922b11e6ff90b7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e764d4-ecf5-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711624778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624778, "uuid": "6ab6d507-4a89-408b-a051-1937246ded18", "comment": "Malware payload (LummaStealer)", "value": "2bc45853aeaa522cd77ef0f534acdd9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624778, "uuid": "b19d8a8a-cb40-49b9-a422-141d457c01a7", "comment": "Malware payload (LummaStealer)", "value": "3bd35fb24ae69b7d8d706d563fd42f012face0a21ff163b99b0f9574414134fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624778, "uuid": "3b92749a-4289-4ca3-9687-7be2289d812e", "comment": "Malware payload (LummaStealer)", "value": "4927baf2b5eca7918947ca060f5f63c343441af9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624778, "uuid": "fe6f5386-5373-4a27-8e24-09f37663893c", "comment": "Malware payload (LummaStealer)", "value": "865cdd87b7f395b161c63a0f5a1f1d215d0aa5b616382f4a4e5c7077fa77158b64b17a4923401136e861766b2aae88e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624778, "uuid": "d96cc344-4bf3-42b2-9701-6e80d1cc3819", "value": "T15B0633ACCCD4C159FA9188716B36C6F32BA9C3D60545110BF3AFBA6537B7098DDC9888", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624778, "uuid": "42bd3ed6-7d90-4f07-bd2d-ae55cf32f85c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624778, "uuid": "d30348ff-9506-422e-ab4a-70ffc89bcb3f", "value": "98304:XDC36pQhVv5OiRTIduATGzB8YA3CYCDGBBCD7U9XbcT:XDC36OhVvPuuA6+YAr6KBCvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711624778, "uuid": "0c7a7e56-0dd8-4525-922b-09d519c5dcaa", "value": 3919893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711624778, "uuid": "047d26c5-2027-4032-9766-6f1a4341dc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624778, "uuid": "afc518b4-69e0-48ca-9a4c-3221064bb863", "value": "2bc45853aeaa522cd77ef0f534acdd9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1581db82-eca1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711588708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588708, "uuid": "9a8a8067-e1d5-4fad-baf7-21deae784fc9", "comment": "Malware payload", "value": "79e34b7d529027618e884c469f22cd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588708, "uuid": "e9b49758-e5d4-45d4-8d11-a378ab598fd3", "comment": "Malware payload", "value": "3caff627ab1d5e73a6c099627bdbfdea963eefed1a763c63139fb74d095a167c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588708, "uuid": "bb2af55b-dc78-4acd-9027-3412cfd4903f", "comment": "Malware payload", "value": "57a84cf103e2bcd0a0ffe8db30f7a202184502bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588708, "uuid": "3a69d8bc-e4cb-4dd7-8096-5b17af7a8129", "comment": "Malware payload", "value": "8b2ebbc44d4c0f07a68a7822f6f80b7b53a14991024f676a19dd6f8ceb1daf65be8cb19d8c004cf5d52afebda24bc036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711588708, "uuid": "4abebcf0-44ea-4f83-a404-cdeb277e0042", "value": "T14AB56C76B949656EC45B1635243B8898AD3FBB7626078C4796F00A0CCF3C9816F3E74B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711588708, "uuid": "a7921c5c-b22a-4c8f-9520-9d2700cd7e22", "value": "24576:2jLvlpR8LiBoytUK6OiNSzprBoSTwNTuEEB76ulrvqNt2N5a:WtTrCScZw6uiK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711588708, "uuid": "85dfedcb-9a88-46a6-9191-2a67fd30cff2", "value": 2326528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711588708, "uuid": "0cb13c1c-e1b6-46c0-b458-da0b48509394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711588708, "uuid": "a9fa93b0-6906-4ef1-8129-45424577ae7c", "value": "SecuriteInfo.com.Win32.Evo-gen.21387.28853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd1e8f8-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609848, "uuid": "5781e678-47b5-4886-873c-e48c23ad6bb9", "comment": "Malware payload (AgentTesla)", "value": "a0da95541dfbfd1905c72a3555ba93dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609848, "uuid": "a58a6528-3d0c-4447-9516-853247081491", "comment": "Malware payload (AgentTesla)", "value": "3dbc792eb3f7e277c14cad19411a1fca45dbc6d27f21a2a84384f080eb776f6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609848, "uuid": "0a4824ef-b88d-4c7d-aee7-7ab7d9c07a2c", "comment": "Malware payload (AgentTesla)", "value": "3a33a3227b862f45f476c999c807527c1f24131b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609848, "uuid": "dcb3212d-53d2-4854-9bc2-017ee3a965ab", "comment": "Malware payload (AgentTesla)", "value": "058150871829b6b839fbd931e803638356d336aecdcaf8e33471957d251b015859b5e16deb36445441d1680b7977500e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609848, "uuid": "265c104e-3269-497d-afc5-b8331e595481", "value": "T178030EC2D9892BA64946DBB3DC131BB34CB48558733B0EF2B77DC24D600355869BEAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609848, "uuid": "625706ea-ad1b-44ba-9e16-344d97254679", "value": "768:u0agBidWAZGc8NnKwiQM8e4uPvCu69JgjzSP:huqNnKw3rvgH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609848, "uuid": "99adab81-246d-425b-8572-347107aacd17", "value": 39234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609848, "uuid": "99c6ab9a-4567-48e6-8f57-c9a74358234e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609848, "uuid": "23ed8592-7044-4ab5-a79d-b110af125ee6", "value": "IMCA Nowe zam\u00f3wienie.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110e980f-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616618, "uuid": "5533f212-1818-474c-97f6-038458854ab1", "comment": "Malware payload (Mirai)", "value": "f5c4b9cbbdcd0103b37242e889f710cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616618, "uuid": "8774cafa-0bc0-43a2-a440-9e574d2278b7", "comment": "Malware payload (Mirai)", "value": "3fa70c2b5fa33aa9e3f52bdc090f7b7969f8fcbdaba22a5563ce223d27d61c37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616618, "uuid": "2b9a032f-99e7-41c0-9380-49bceed7665f", "comment": "Malware payload (Mirai)", "value": "9adcbf8b9eab43dd1bcb3bcb97d2be48f33887cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616618, "uuid": "d6dd2c40-989f-4e8c-81cd-b65af9a2ae73", "comment": "Malware payload (Mirai)", "value": "65971933565bd89689d90a9f455710d3ca0bcdb06fc9dec2a21311215f3fac67497b533649ffd9b9141b8995dbd1505e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616618, "uuid": "15fdb9be-b17b-45dc-9508-6f414046974d", "value": "T1CEE34C46FA408A13C4D517BAFAAF42493332D7A493DB7306D9185FB43F86B6E0D63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616618, "uuid": "dd0d0e55-4b95-4c08-bbe7-cd3612b6a15a", "value": "3072:yskZXeAYEnUz1EwjFRVdORcokb6v9ROJKoS/usM/97qGEzXomKwc8fiB:xkZXhYEnUz1EwDVdORc3b6yS/JM/9u52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616618, "uuid": "fb14ded9-12cd-4214-9dcd-3d3c9b1e0489", "value": 149261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616618, "uuid": "0209d94e-0a2a-46f3-9d58-21d8555019f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616618, "uuid": "2d5e453b-829b-42b8-9fd4-4a8819de2872", "value": "f5c4b9cbbdcd0103b37242e889f710cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256d4b1d-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616652, "uuid": "575f8e5b-f56b-4ab8-94eb-4fabcce725a9", "comment": "Malware payload (Gafgyt)", "value": "6516e83487fb5cf5b50c4809d9cfab5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616652, "uuid": "f5cf7a01-658f-4bc3-aafc-04506478c994", "comment": "Malware payload (Gafgyt)", "value": "40509db2a84511988109b7742364446c1028efb32a61fe1adf30290edb3c5025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616652, "uuid": "f6d5d87f-6b10-48c8-965d-9a89d354ca85", "comment": "Malware payload (Gafgyt)", "value": "08bcd1febc75b175a36256f657abbb1c1c28022c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616652, "uuid": "499e09ca-7045-4675-b485-0874b1bd47ab", "comment": "Malware payload (Gafgyt)", "value": "7ff643f32c664083912e852e32bd7e1ded65fb2c691c02f833441ec103c8904bb7aa720c7a61fbf692dabe9d397420a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616652, "uuid": "dca0ba4f-12fe-4caf-97d5-df4d81f40a75", "value": "T1D383F793B901EEB7F40ED67644D34B247230FB624E931A32731779A6AE362D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616652, "uuid": "4c2eb01b-8742-4bae-b3c7-c711d849676f", "value": "1536:2v8A0UlZxWb5f584AqOwL4YMVMKxnT0yH5l1NC9Ob+xknVOBGHbHImzS02q2/cOG:cbHAbBryVrxnT0yH5lrC9GOBrmu02q2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616652, "uuid": "d787d806-eae3-4e04-814b-d47f52a7dd98", "value": 86515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616652, "uuid": "cf917998-7dd6-4de0-afb5-40ebb64b4478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616652, "uuid": "de3446ca-30b2-4276-b10f-e22dff273155", "value": "6516e83487fb5cf5b50c4809d9cfab5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f4f5de-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651074, "uuid": "cb5fcd1a-c670-4afd-ae93-562db51e6307", "comment": "Malware payload (AgentTesla)", "value": "1af5b16224f32acdb6f6b6ec72f8bbe4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651074, "uuid": "bec6e392-b2a9-48bd-8365-bbca0e448c33", "comment": "Malware payload (AgentTesla)", "value": "42507b45f4cc3ac0dd1bc6ba841fee90c67a8617a740b1f7a0725b55ce99c49d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651074, "uuid": "e2d3e40c-d6b7-4c02-8864-313fd22665a8", "comment": "Malware payload (AgentTesla)", "value": "4e8005f6484d1aa34e737cddf167a6d9f3a36ecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651074, "uuid": "be0c3486-d9cb-4984-8be8-81059f019352", "comment": "Malware payload (AgentTesla)", "value": "b0d5a5f62a0ed1942a1234c04e20e4f3ab7ecdc6ef3ca74ed3748fadee71bce6dce5e7f4169b7d448bc26487fe7896c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651074, "uuid": "ebd2439e-8cbd-4e40-8ad1-a9bc09ea0830", "value": "T19EE4121033FA5364D2F94BFD69B1806813377D2A6C74EB5C488822DD5773F8A8A6076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651074, "uuid": "cbadf46e-8664-43ef-bd23-7a66e59b8a2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651074, "uuid": "e4c2aac3-f875-4272-a66b-8f8b0b7de94d", "value": "12288:Ui0YOwqpKtIEWNKO/ZYcNYAVMZ70OPtCHme2oNGHKqoylx9:tO7p42WcJed7CHvlMqxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651074, "uuid": "c3b13131-806d-4515-a067-0917b09ae89c", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651074, "uuid": "2d2274e3-4c6b-4552-9442-6d5eb5021d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651074, "uuid": "ea535e3d-0999-4434-8eae-fff574867bbe", "value": "DHL Shipping notification-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566de03e-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711651094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651094, "uuid": "17eae24e-0ead-4977-919e-dc5ba1c71a21", "comment": "Malware payload (Loki)", "value": "194dde165c8011d301784d1ddaced170", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651094, "uuid": "f7fa6cf6-8c26-47d9-953d-96b5cd34b8ba", "comment": "Malware payload (Loki)", "value": "4310bf502a623205fed084012e87eec8b6a6f5803695b3f27367cdb5b7dd1b45", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651094, "uuid": "abef246c-cbd0-4f4e-bc6e-996bc6f2859c", "comment": "Malware payload (Loki)", "value": "f9ee1b100dd1fe983685c1750b5c0e0bf1482fa1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651094, "uuid": "b3678ebe-a728-42a0-9f5f-a9587fd90a1e", "comment": "Malware payload (Loki)", "value": "da47b269829f901d105c138c0e8870461595a6c497f20208b494d1b4c82e029b44202b46b18f5362a6dc529997a38c8b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651094, "uuid": "1e145c69-5f6a-48f3-9705-e73a95c9db5b", "value": "T1630491E3DAC626288A892AB3DD134B734DB1409C73131F3897BDD65D6043A5896BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651094, "uuid": "c7380c1c-2d5d-4614-9c28-2bf5f32a51b8", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyK:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651094, "uuid": "9bef6cc6-bea7-48de-ad87-48cb39500103", "value": 183822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651094, "uuid": "ee8b7bb3-23aa-4881-b276-4c7c5c0eec81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651094, "uuid": "e7804e66-5b11-4b6c-9554-008d3e27235f", "value": "TOMBIG - 9004898 - Ponuka\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b9a706-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711651090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651090, "uuid": "8d8dc202-1112-4e2d-bbc5-75551b8f399c", "comment": "Malware payload (Loki)", "value": "9cc4d241f55c4430d7ca7245c585253e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651090, "uuid": "4f790ff6-2639-4081-9bab-6256b8255ed6", "comment": "Malware payload (Loki)", "value": "43517d5122fb62dbfcd0e8ab99010ece43d41ed58dc024868f77bc05a0a81612", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651090, "uuid": "159c962f-40cd-4e78-91bb-b37f72ff114f", "comment": "Malware payload (Loki)", "value": "64497621d3145749d5d5b284448f8d7f90aa3e29", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651090, "uuid": "2d9d0cb9-cbca-4a24-bc4d-a6a529ec484f", "comment": "Malware payload (Loki)", "value": "b2905da1b458cdd12a470153b82861cfb66b060235f3dd54a168659715f7cd740dd16d77539cf73411e9a26bf068e5b5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651090, "uuid": "aa4cd45b-4f37-46e1-a45a-81c456d25663", "value": "T18804B4E3CAC526688A851AB3DD134B734DA040AD73136F3993BCD65DA043A5C86BFBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651090, "uuid": "91c7d2cd-eec2-4b1d-8a3c-169869245b31", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyc:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651090, "uuid": "d48ec781-4b58-4465-a16b-bad4cc59305e", "value": 183566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651090, "uuid": "18753a03-6aa6-4429-9005-0b74a5ab0eae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651090, "uuid": "a6551ffa-bed4-4e2f-86b7-fd9dda692f35", "value": "lista de cotizaciones del catalogo\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102b0328-ed2c-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711648400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648400, "uuid": "f9e2e0e1-4cb6-48a6-bf32-52f30c210612", "comment": "Malware payload (AsyncRAT)", "value": "c1ade258f05c512e98ebc4d9d1165f8a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648400, "uuid": "6c34cd5f-1f06-4750-b671-afccee2370bc", "comment": "Malware payload (AsyncRAT)", "value": "447eae52ab1979405497866c72df7ec0703085ad6946ab0127f612b1518f8759", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648400, "uuid": "f4f646e2-84b4-4ac1-becc-2b075bb12349", "comment": "Malware payload (AsyncRAT)", "value": "acf20f6a7dc7841ae06f801b887289fdc99e0488", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648400, "uuid": "a67c38ac-7c42-49a9-8c03-3ddeb36672c8", "comment": "Malware payload (AsyncRAT)", "value": "cc5ba0fdcdf2c50f5c6f90e2b877d5be1681dfe2e029ffcd28afa883bc90ba7012fca6e4a4ec1d6f0b220fdf4c6ac2df", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648400, "uuid": "4d4c00a6-daaa-4880-be59-2780ac18f6e4", "value": "T14353F8013BE9812AF3BE8F7459F7618546FAF4AB2D12C54D0C8914CF0632B869941BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648400, "uuid": "61bfa24d-71b0-4554-9e11-161f71d90e33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648400, "uuid": "bdaf3e25-c62f-49ef-86ef-caf473c523c0", "value": "1536:SaKFoNbEkySYKumUYFOy5biAPY0JG4aRjnl7RUr+TG5x:SawoNbEkAKumUYFD5biF0JejxSsCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711648400, "uuid": "042b081b-d637-4da6-8aed-3a9b45e29956", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711648400, "uuid": "fcca251a-4ab4-4362-b25d-643eade6577e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648400, "uuid": "58bd142f-64df-4312-a54e-f204857497f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75fd9f3-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609676, "uuid": "16071262-8b7e-46c5-adc5-81b5e848cc9f", "comment": "Malware payload (AgentTesla)", "value": "dc74bcce61f1a226f9169e3f3dcf8608", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609676, "uuid": "4bf9c743-2d5e-4cb4-a8c1-3b6e2c79b147", "comment": "Malware payload (AgentTesla)", "value": "46eb5c336c4f1fada81866d3c8a2d40bd6ddaa12f2b23c6543ecc03e956d01ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609676, "uuid": "7f040e1b-adee-47ce-9372-94d0a71a9d8a", "comment": "Malware payload (AgentTesla)", "value": "09453a788a822244baae5c31eba9c51ed10875cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609676, "uuid": "f258a58b-2738-499f-a867-03f16fc684d9", "comment": "Malware payload (AgentTesla)", "value": "13bb83b0a9eacb0b9b7f00de94e6b16531b6615831c93f1957b2a3c1bc04f0e39f404d71724499a7de9f3547cd2fafff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609676, "uuid": "6d857cbd-3447-4770-af61-830d26e83f06", "value": "T15F35BF0273C1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609676, "uuid": "c3e48225-b133-4063-8a13-ad63966af6e0", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609676, "uuid": "7e2d4a8d-f131-4261-add1-5d4b5663b6d7", "value": "24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8avnkqBX9ees:4TvC/MTQYxsWR7avnk8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609676, "uuid": "310e725e-83c6-4787-847e-ff0441c23ddb", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609676, "uuid": "4fac158d-aeaf-4464-9ad1-8230ab242bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609676, "uuid": "f5dde45c-4f13-45ae-a01a-80398c5c72d9", "value": "ESTADO DE CUENTA DHL -46474637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9be590b-ed1d-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1711642215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642215, "uuid": "bab98eac-74f6-459a-8c50-5d0052a50dcb", "comment": "Malware payload (njrat)", "value": "26f75dde198f77866dbc6167cc101f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642215, "uuid": "1f4e7140-ef21-48be-82d8-6640902e6b40", "comment": "Malware payload (njrat)", "value": "4a5fdda9ee07e884e1d89612b56a932acb9c812b72cccacde885da0f9b4eab31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642215, "uuid": "01873c5e-fbe1-4ece-9f0a-555544e23c71", "comment": "Malware payload (njrat)", "value": "056d49fc62c8ce9efcedf4ea3e4b8b357e3a23f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642215, "uuid": "c250a26e-27ff-4afc-9c85-fa65ccbb77fd", "comment": "Malware payload (njrat)", "value": "d1c4e36ba2f3be10abf6311bdcd7eef50fd4a07baf0320eba3893ceb8a5a026c53ef9f90a285d00aa42fe7172a953222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642215, "uuid": "0608f10d-ed4e-4fe3-a9d7-acf4dbfc1110", "value": "T1CCB22B4E3FA98856C5BC17748AA5965003B491470423EE2FCDC560CBAFB3AD92D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642215, "uuid": "31072fc7-be3d-45d7-9ef0-fd909cee8fbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642215, "uuid": "f8a823ff-90e5-4663-9017-e8ac8890b250", "value": "384:D3gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZ5Hoz:7IAKG91DP1hPRpcnukW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642215, "uuid": "cb7859a5-c9d5-4687-9708-ef82b9572d3f", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642215, "uuid": "2859f41f-ef25-4578-b399-cf993804734c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642215, "uuid": "ce05eba1-c36d-43d6-b4fd-2e5991d8d112", "value": "26F75DDE198F77866DBC6167CC101F2D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c9a87c-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1711652013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652013, "uuid": "ff1c19e0-e21b-4e15-b602-f7d5fda9e892", "comment": "Malware payload (GCleaner)", "value": "c2aab8150d3d763706fbe02fe07f8aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652013, "uuid": "619819c6-6bcd-4b07-a474-b177b8e85034", "comment": "Malware payload (GCleaner)", "value": "4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652013, "uuid": "de877410-d737-4f47-842b-0cc39a86f767", "comment": "Malware payload (GCleaner)", "value": "96f231a59c8bfb43aa78aa43501973a52919b7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652013, "uuid": "b857f194-04a1-4bd6-92b7-2482c3d70d17", "comment": "Malware payload (GCleaner)", "value": "469cc694a45f3fb3f950946ee0495cdf9137aa25cd9a53b85a1b4efa0228112159fced46cc60810137c2251e4b3f8e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652013, "uuid": "bf229063-c103-4465-a8ad-25e16ddbe359", "value": "T1F784AD13B2D2FC60E56246F28D2DC5E8262EF9628E687B2733687F0F34B11A1D563751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652013, "uuid": "51d26fc4-6fac-4bb0-9f04-e4ff76678f86", "value": "72e186f4643d828245a9b4274ecaa3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652013, "uuid": "ce0cc525-e765-4c8d-9dcc-55caf6fa48ac", "value": "6144:CAY8rOF+nQq97PgSKA9XncgrLZEeMlFjT:CR8ru+nJ7YEXcgrLZNGF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652013, "uuid": "4437c047-96a2-4cb9-9755-f04215cf6ff3", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652013, "uuid": "545eae4a-27c0-4e26-bd96-5e289c064579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652013, "uuid": "990af4fb-6dc7-4214-b6f6-d2a51896cfed", "value": "c2aab8150d3d763706fbe02fe07f8aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d466978-ed2c-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711648395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648395, "uuid": "34c1ca32-32fa-4d13-84ce-f5303374e63c", "comment": "Malware payload (RiseProStealer)", "value": "594baf3349f36a497a12a0d40c2b27a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648395, "uuid": "72568b14-82e2-4243-b125-f45f756384e6", "comment": "Malware payload (RiseProStealer)", "value": "4e706b9f8cb686e8a99477df73e2c100db282ef6fdf51cc0f6043bedeed8fe17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648395, "uuid": "f7549e4d-5d77-41f4-bcba-6902eb4e8fc6", "comment": "Malware payload (RiseProStealer)", "value": "2d0a636e0a1951cda559ee5fb55e06037c265294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648395, "uuid": "a76f16c6-cb8a-4e3f-81b3-d99cc00e3093", "comment": "Malware payload (RiseProStealer)", "value": "c13e7b75d528a240eb07889ed06b6836f7d17092cba7d838eb82e82363be9357d9b5447db2ad93ecc07f3b2b78f049fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648395, "uuid": "6a3d1df6-f124-4680-b0c4-1c9aeba779d2", "value": "T145A533F25040F271CDF35075BC14E7BA49BE1FD3A191DA51298DEA22CB8CB12199FA36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648395, "uuid": "bbb8a80b-0850-4f46-8c9e-71078dff6f42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648395, "uuid": "9bd28f15-d6ed-49b6-bdad-2d46999695fe", "value": "49152:7zCnVL68FUbN2qDQFLWhv2DTQC4kY42bVDXU1HkAG:7g6QMMqUAZ2DTJE2H9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711648395, "uuid": "87ef7e7e-1a04-493a-844f-00586524cda8", "value": 2242184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711648395, "uuid": "216c64de-cba6-4466-a22f-36a185b2f382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648395, "uuid": "e490dede-7242-4d83-b69a-abbc45a26414", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f43bed2-ece1-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616320, "uuid": "41ced53a-9085-4afe-b93d-913e2f8207a1", "comment": "Malware payload (Gafgyt)", "value": "f749802a4feb7c5e033aa54fbc5e57f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616320, "uuid": "049520c5-738b-4e5c-9b7b-0ef5330bc6a3", "comment": "Malware payload (Gafgyt)", "value": "4f6c524b83087d62d5ddae4a3440cbfb5f0b4228baa8623aca56822f70f6f971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616320, "uuid": "8ad70fb4-75d1-48ad-b5f6-d3580179f73d", "comment": "Malware payload (Gafgyt)", "value": "f05a3ba29b6943922fdf7b78b62162e834e2ad03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616320, "uuid": "43944087-1de5-4dba-9f15-33d2026764b1", "comment": "Malware payload (Gafgyt)", "value": "e1c3e5800e8b07787192ac9eb1e43edea9e24d3af183ce1f06cb7e71d36e1cca204083b3220f93c0d5bee9662844f09a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616320, "uuid": "892ae4fb-bb6f-442e-a73f-f5828fc635f9", "value": "T165734B03771D0B93C59BAEF02DF727F087AAF96112A66580A10EFFC41372AB06515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616320, "uuid": "117f15ad-d7f8-4b65-8ce3-c6393f5cb6ce", "value": "1536:lotQm32LiSNGOHtMeFmB7DIa3mJ2vQPgmJaWVFA1Q8yVmX02q2//8fBgj:lotNGLiSNGOHtAnIa37E7FbfVmX02q2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616320, "uuid": "06a5edac-c551-4dc6-bb1e-84af0460b6cd", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616320, "uuid": "71cb2a26-d0de-47c8-8775-fbf1acfe7e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616320, "uuid": "3a325f4d-212a-401f-b4fe-0672c12c6090", "value": "f749802a4feb7c5e033aa54fbc5e57f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6e31e1-ed30-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1711650350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650350, "uuid": "422e9258-1d88-468d-8863-8b28c305708f", "comment": "Malware payload (Rhadamanthys)", "value": "7b91d2784eaef8f79e4d60c1c1145d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650350, "uuid": "3f08b04a-d190-4dae-91aa-839dc2830153", "comment": "Malware payload (Rhadamanthys)", "value": "4f76cd6ec7222833969dcad5f71ab7cbddfd3714bc9adda334413c66c2826209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650350, "uuid": "3c2b7dd1-6bac-4ca1-842d-55f36af45bcb", "comment": "Malware payload (Rhadamanthys)", "value": "328224b6fc4789054c16f71172c8dd4d85a3be8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650350, "uuid": "f2afe192-0322-41a1-b2ad-39193c67c386", "comment": "Malware payload (Rhadamanthys)", "value": "193879230e79b482a5443814d76ada7be2edc9000d6fcd93da282b4d994ec112e696285ccdd58f546aec107e7f44b6a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650350, "uuid": "f8389858-6f5e-42c9-a434-40d2f501f465", "value": "T1AB56125A3691B1BBE17596B05C20B945E7E87E612C7F430F69F0736C1D3B4E00F92AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650350, "uuid": "524edc06-2171-4ddf-9be3-3331afcd50f4", "value": "d20f31098a0b3dab0560ee6731ee6405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650350, "uuid": "1da3d8ba-b629-4409-9c67-5210062f47c7", "value": "98304:zuwg7O8YO6xtedsiMV6oaNIwkmTFfYURRHbry7/bGaas3RW1PfR/yxkBfPy8Sh:ARdsiAkJQi/y7yzs3RWVfJyxafp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711650350, "uuid": "fb2d9194-8ae8-421e-ad32-f6f657ba2f03", "value": 6449464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711650350, "uuid": "27533d3a-728e-44d7-9bf0-186f6873ad8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650350, "uuid": "f243cd53-8cf3-45d1-b068-3fdfbb40638a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51947e3-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711639281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639281, "uuid": "5748a459-b9ed-4ffc-b7ca-99fab3fffae5", "comment": "Malware payload (AsyncRAT)", "value": "7f264ba8e4c519ce90c6e3b430945476", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639281, "uuid": "2678e250-d66d-402e-b59a-8ceadae72aa6", "comment": "Malware payload (AsyncRAT)", "value": "5157d8d5c583eea41772fb99793e13f9d7e3c3c2b0eb2cd876c65d1835cc8d8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639281, "uuid": "91395733-edfc-4cfc-93c1-34c46379baf9", "comment": "Malware payload (AsyncRAT)", "value": "4e18269b4c70931dcad3f7ca58e4f5db00411549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639281, "uuid": "93455446-bf6a-408b-8470-0ea89948eea8", "comment": "Malware payload (AsyncRAT)", "value": "d8f112de0a2dd61ff337560d46a59adef2e64bc1acdd5140c96ff93f46797661e97863366982fc144b07b785f1ba942d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639281, "uuid": "acff181c-d9bd-4a2a-a724-8c6c905fb5b2", "value": "T1EFB42347F631D9B4EC86C2F045DA6E716BFAB45E999B11264CA8FA372B00C4B0C18FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639281, "uuid": "47465bcb-ab13-4d21-b926-f25e00685f9a", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639281, "uuid": "8493a23e-ef9c-4277-be4e-66eec199bab9", "value": "6144:rKeacbD2RU5+csDgVortcBiWg3cPXblkqDHd16Z6Zm5rULuW1+inHsvzUHFYWg5l:r3y1/D+McxaZvkL1pHyzWPp4xje9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711639281, "uuid": "24809976-a69a-4bec-b979-8381f2089bf1", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711639281, "uuid": "46e1ca74-834f-4844-9dbe-1d8f33cc92db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639281, "uuid": "0c719d87-a238-47ac-88bd-d58edb2d4d98", "value": "7f264ba8e4c519ce90c6e3b430945476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b77008-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616687, "uuid": "7374e750-1714-40eb-8165-06a56f5b338e", "comment": "Malware payload (Gafgyt)", "value": "4865394477a9a441fb2fb36ce0ea52e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616687, "uuid": "4f4a7314-32ba-4b11-b222-8319b00d8da1", "comment": "Malware payload (Gafgyt)", "value": "51a00a85a9ebb13227f84b51a6cd3c4cf89bb1280252f023fa925a52d7af60dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616687, "uuid": "94f68f48-4b29-4172-b7c5-17f21455549d", "comment": "Malware payload (Gafgyt)", "value": "2784bc53141984e37fc6a28c927a9cff3ebfb748", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616687, "uuid": "be2e1c82-c393-45ee-ac11-d8b210176f1a", "comment": "Malware payload (Gafgyt)", "value": "6789eb204d01d0c432a735db9adf50a657c22b988fa1776fe5210d5ef3b06f103d9bea81726f6805ce4dc76f86404f0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616687, "uuid": "a300b3d5-316a-44ac-9f8d-3408c472f26d", "value": "T170632A026741CAB3D0831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B62B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616687, "uuid": "2eb9e631-3856-466d-b823-e528ffa5d88c", "value": "1536:GqVYPCfxThjUdOn4JymPWBSgSh1MtNUr/NbHBDSDmd+l2OZ/fufYEZ:GqUC5ThgdikrEHM1IGrVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616687, "uuid": "bec98548-e26e-46e3-a751-c81fa1cacd43", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616687, "uuid": "ef6ff413-3031-4724-8b23-96c9cc46f01f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616687, "uuid": "f18a89f1-0323-4628-8c52-13d70bff6f88", "value": "4865394477a9a441fb2fb36ce0ea52e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880aaf43-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711642588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642588, "uuid": "cae9100b-b14a-4262-a22b-c19810eb2d26", "comment": "Malware payload", "value": "faf2bce1b9228c738be3f86f031f9ee4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642588, "uuid": "6be0639e-3862-4e00-90f7-5f64a2fdb22f", "comment": "Malware payload", "value": "5353127308732b5a30d96259d0448c5bf92fba25ebc73bfea014f11cebb21990", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642588, "uuid": "541eca2e-97cf-4a56-b748-b5b691acdd22", "comment": "Malware payload", "value": "30ab66cbb7d2c1d9dd81ee289ead623f3f541327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642588, "uuid": "c06fbc9b-4ed0-4494-aeab-a4eb6287d84f", "comment": "Malware payload", "value": "3d29e438fd3c5ffce5462f5004f2333283cc30e6b2826fffab902d66dc0a6da46edb10f161520aad8f1d57e2272015c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642588, "uuid": "5171a2d6-38b8-4672-95f8-a65a75eb8e6f", "value": "T1DF668D51FECB90FAD5431E3044BBE2AF13316D054B24EB97EA407F2AE97B6961D36108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642588, "uuid": "7e3b9b00-45c8-4f3d-b478-bb7c69970a2a", "value": "98304:NYXFdK7il6czFhCz35lLsm/ZDk6sltBDsyhwdOkWP:NeCGsz5d9Nk1l3vhwoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642588, "uuid": "89b61df5-ba3a-4717-9f5f-823bb8f7b12f", "value": 6673946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642588, "uuid": "2439281b-1281-4a3f-b46e-69cd601ba280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642588, "uuid": "8c5327d0-a43f-4eda-ae90-dd1298d91b44", "value": "SecuriteInfo.com.Linux.BtcMine.791.1794.25936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351afac3-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1711610666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610666, "uuid": "9a135bcb-3d26-4cf5-8430-c5ceaa050aad", "comment": "Malware payload (Vidar)", "value": "8b8db4eaa6f5368eb5f64359c6197b43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610666, "uuid": "03d410e7-d4bb-422a-a525-22ce14ddbed6", "comment": "Malware payload (Vidar)", "value": "55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610666, "uuid": "02d7f95e-58c9-4aca-8a97-87e40ffa665a", "comment": "Malware payload (Vidar)", "value": "e9b51842e2d2f39fa06e466ae73af341ddffe1c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610666, "uuid": "72af055c-01a6-43ab-b49b-613cf6e1e118", "comment": "Malware payload (Vidar)", "value": "9f30f10663cc16ad1d2ca6529babbc81d99a6cf8a03ee74755d6955664fae0abbb6fd4a22b62273539804b0da1f9b59d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610666, "uuid": "f9482405-211e-421e-b69c-5cf971f1bf78", "value": "T19844E042E7655916ED28823714B93FA34729FD9D6972C3999350FE183C332826FDB322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610666, "uuid": "9d169531-01f0-4b7c-9be2-28cdddadc19c", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610666, "uuid": "b45d49ac-42bf-4704-81c5-dfe5327b6217", "value": "6144:xfL+oq+hnjsVl3dRQTLU+2bRRR17+fYHPfIMDPSBJ7Y/B4aSi3V:xfL5njsVlNuc++Rj17+fYHPfIg4Y54ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610666, "uuid": "a733488f-58e2-45c1-bc8f-7a23eeaca372", "value": 278290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610666, "uuid": "2f561175-50c7-4627-b0a8-fd145c541813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610666, "uuid": "b0c0802d-88be-4e68-8756-0f385cf1a884", "value": "8b8db4eaa6f5368eb5f64359c6197b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aac4807-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711610675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610675, "uuid": "b8418605-066f-4299-96ed-b1e767b51acc", "comment": "Malware payload (RedLineStealer)", "value": "e5bb34b508be662784bfd714241d169a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610675, "uuid": "6e759977-7c7e-42db-b21c-27c1b393cbe7", "comment": "Malware payload (RedLineStealer)", "value": "560540e3e5f5bd294423ad372af1735a67205508a9434045677cc80ea1830fe8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610675, "uuid": "2af9dc93-9468-404d-bb69-03be4e207dff", "comment": "Malware payload (RedLineStealer)", "value": "a125358133388c02fde8d8addde5222d12bdfbbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610675, "uuid": "f728da25-084a-47aa-a147-cc2140b88999", "comment": "Malware payload (RedLineStealer)", "value": "d205b663ee1a5c08323b678444fee7e86d444e05eb9c35bcb460973f12d3ce25a42209c87fdb87837cf079a391c0a688", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610675, "uuid": "680409bf-fdcb-4395-bb53-79046a0ab033", "value": "T1A0D4239293E75E22EC4C8AB9C0D295053B78C3526A93D30FB55D9124CD423CEF799ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610675, "uuid": "4079b8d0-3a0a-452b-bad2-df245b1a7e7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610675, "uuid": "96b48995-1b5f-46e5-8c4d-cc4f192b8577", "value": "12288:5HsIkyvDOCug0JN4ojQ1mVRUDbIPX80yKT80S5PV6ii2zl9d7Vi4wvf:5HLkyvyS0/4dItLS5PQDGl9d5ixX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610675, "uuid": "df666fd7-e284-491b-9c27-44678ae0d04a", "value": 637576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610675, "uuid": "f6a215fa-7492-40c9-b927-c6653391e3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610675, "uuid": "cc5fa9cf-413b-4271-88ba-da770588e24d", "value": "e5bb34b508be662784bfd714241d169a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a255e00-ecd3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711610191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610191, "uuid": "8da9cd4f-7249-4112-a439-968dbc455ed2", "comment": "Malware payload (AgentTesla)", "value": "ec7a8850d50a7493ece43a2b26a185d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610191, "uuid": "50621e76-dfc1-439f-a1b9-dfc3e1d08e9c", "comment": "Malware payload (AgentTesla)", "value": "561fec9f88459a047a4a859c68ec93743aba2c4f18d0243fba7fe514ffdf346e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610191, "uuid": "70c5694f-a238-43c2-b416-3b0daf8f3964", "comment": "Malware payload (AgentTesla)", "value": "29cd9d7c9a6003c2aef13b106087535754176c5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610191, "uuid": "1e734c64-1af4-4f5f-8fa5-f7e8af1b9f8c", "comment": "Malware payload (AgentTesla)", "value": "10cbf658a73ed66f63abf843bbd1d687bf441cff632c581946a57fe5e0830e1209964d320d4a62ddfd9a20b8600f2ef6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610191, "uuid": "e1d68551-d1ed-471e-bc9b-ce01d0db5c9e", "value": "T1006302282F6A4E15521F792A9A541CF04F90448FE9E4FD70CBE864ED5B0E4BC43B3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610191, "uuid": "50523712-a37b-406a-9841-a9ac7a3e5641", "value": "1536:CUGddsfITIWZhd+JjEJw8NhBr9pCC0d00eY+ggyL:+XsQTZ/hqSnpp70d0fgg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610191, "uuid": "a6e6b01e-f72c-4f81-a221-48b100629f7c", "value": 68430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610191, "uuid": "766154e1-9ab8-4a2d-9062-8c9fbd4a6653", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610191, "uuid": "126a714c-5247-4b93-a773-aad62d8ebbb7", "value": "Wage_plan_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a20591d-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711609869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609869, "uuid": "b62f578f-9d8b-4992-874b-feabdf02658c", "comment": "Malware payload (RemcosRAT)", "value": "8b0415326c86b2061f4d6c04c7dc1bee", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609869, "uuid": "3d43a04f-4896-42ba-bf65-05de2a9e6dd2", "comment": "Malware payload (RemcosRAT)", "value": "5665a7f674aff8bfa6c9d7562b19d4088181fcf1bc1261babed484106d437d64", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609869, "uuid": "1838f58d-ea8d-45a3-8e4e-4a77ccc33498", "comment": "Malware payload (RemcosRAT)", "value": "cb22dfb8db3acafc9652c42e1d8d7586b9a8b8fe", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609869, "uuid": "eb9a260b-9c56-478c-b1f2-016bf8795732", "comment": "Malware payload (RemcosRAT)", "value": "2dfb89739e1a89bc4a54678b306fd8b86e4b1d4184d876ce77c336926747f8d97f111f6ebfc6a723e195dcd3462f8cd1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609869, "uuid": "815aefa1-65ba-4efd-bb24-46641afcf522", "value": "T191342AF0CFCA26394F4B2FDAAD24445289F981990226287DA6DD17AD7243D2CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609869, "uuid": "3cb9274b-c67e-4822-b113-0d103bc05ae2", "value": "6144:XshQMLtOBxJrv5lttSP4KuK8jWwoipSRUiGT9rS2fTicm7CIg4WD5AS:ikVBgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609869, "uuid": "977f141e-119b-467b-8f9e-04fe7454e7e3", "value": 243156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609869, "uuid": "d5f07f1c-ac8c-4f26-84d5-cf041d6cb28b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609869, "uuid": "0538cd89-f075-437a-9141-9874b3ad38d8", "value": "awb_shipping_documents_27_03_2024_0000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f20223-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711610714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610714, "uuid": "f636e758-7845-4551-8184-d3c123d06f16", "comment": "Malware payload", "value": "68831dca1c80a965bd3ceb69254f5f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610714, "uuid": "226bfc87-f39d-491e-96f1-464dfa775e64", "comment": "Malware payload", "value": "56fc7ba7eaf36379340955e7eebc4629ca3fb153d279e75f53ae7219877de6ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610714, "uuid": "caf0a4bc-192e-446d-a2d2-14751cd491a1", "comment": "Malware payload", "value": "e64fa68246b32b95e2146f6f1c59b662daa079e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610714, "uuid": "c45c2475-e5f5-4f4b-bdd9-9e62b1c7b6b6", "comment": "Malware payload", "value": "fe6d3e1d48463a4fd21285d43719ee2830adb656c005274783a77fe948f007a53c65d0446dab7369eb7ea40497f11d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610714, "uuid": "1d52035e-60b0-4e03-9900-a6e182d77021", "value": "T19F0512062764C91BC18845B9DE511BF412E2AC0AFD42ED4BEDC43ECE39BBBE45A465C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610714, "uuid": "2214a08a-e0de-427d-9ac0-9bc9282c2b04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610714, "uuid": "72c3f065-4965-4938-8cf5-c0ebf5636caf", "value": "24576:d/kzA7+f6seC9N5izsQogvcUyLagr5NngRs:GzKsFhLgvR4agrIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610714, "uuid": "1b7d1f72-c5c5-47d6-b292-b0fc87cb48d3", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610714, "uuid": "4a180370-6134-4c63-9a4f-729b02196652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610714, "uuid": "9eb114be-bff8-42a3-a301-2909a74a3b0f", "value": "SecuriteInfo.com.Trojan.MulDropNET.68.12918.7262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408ab0c3-ed0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711635596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635596, "uuid": "b878542f-9602-4b67-acd6-5c6ea411130b", "comment": "Malware payload", "value": "17ff0bed0cc51f68974e68e6e876c74c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635596, "uuid": "f981f5bd-b412-4290-86d7-469a5e171852", "comment": "Malware payload", "value": "572ce62e817240d3ed73a0c41a693dbeaa783ded8d85f58dd6313696f18fd9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635596, "uuid": "df97e313-725f-4d6c-9d2f-cf7109035e6c", "comment": "Malware payload", "value": "dedc739fa28eb126f0422b63d88d0a46c0ff5742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635596, "uuid": "1efecd45-1e73-4f60-8be8-3916933839f1", "comment": "Malware payload", "value": "5e3c62b647571ee0e507655d4acfba63540f888c773c5c2fede917b937a107bc915351cd60a23ccdfa03a923ead5db15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635596, "uuid": "3c0bb23e-7322-45de-b414-d423d38c5db5", "value": "T1C7742208D7D18A69D9101D320C5FE8A73C2CAF1B0191CF9B97E0793678397A37E5D61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635596, "uuid": "9ad14a66-a576-46cb-a5b2-3041fe4a20a6", "value": "604d14eda74ecb05dc3fd3f2233fd004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635596, "uuid": "d886d240-7c6f-4af7-ab75-0e503e21905f", "value": "6144:mlKVIOL5mj4N3NwqgFeDn42uWiQb6ZyKbNrXoWsTfqbTPio9FJdXX2BoSavRV:mlKVIG8GN3GU421boyMBXoWkfqP5THHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711635596, "uuid": "73d489ed-c395-49fc-b182-7b33d8e0d882", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711635596, "uuid": "64ec7ead-af51-455d-a521-142c1043faf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635596, "uuid": "a9a4c838-db51-462f-a802-abd814041cb0", "value": "SecuriteInfo.com.Trojan.GenericKD.71775751.3624.4925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61591108-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609881, "uuid": "c8460c18-a9d6-4a4a-879e-73e6ae04ed60", "comment": "Malware payload (AgentTesla)", "value": "8a0530bfc9d13277e0e17d29a3332e2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609881, "uuid": "6f133856-6e07-448b-ae69-4f8a22960c8c", "comment": "Malware payload (AgentTesla)", "value": "57bda585ab46e7352a204f54d86544ff5581a1ea7448d4ef1f82b1f9b2367867", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609881, "uuid": "e53cd249-6dc9-4ebf-aa6b-436e057d6323", "comment": "Malware payload (AgentTesla)", "value": "f4b0e3d14f828966aa757efa565e7e9b718b128b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609881, "uuid": "34e40ce1-a479-4758-b978-76147de121e6", "comment": "Malware payload (AgentTesla)", "value": "0cf9b482a18019c268726675a67b71859abf69a09db16ee64940f88cffd8cfd22f49628bbcdaa8d7a603e6efdc5a2438", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609881, "uuid": "7d7d6f22-d766-4c26-8c6f-b364394ce6c3", "value": "T18C03DCD2D585AB666A8A1E77EC0216334DA8805CBB338E349B7DF14DB00395CCDBE6C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609881, "uuid": "cbfd0a40-001b-41ba-8d41-65d9561c0049", "value": "768:u0mgBX0WAZGc8NnKwiQH5TjBXloK07vxCqnkP:9EqNnKwf5R1oK07JCqnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609881, "uuid": "a4017b3a-7f6f-42da-b61b-0e64d77b00e8", "value": 39349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609881, "uuid": "bcb53589-143c-4d9c-ad52-10c834afb888", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609881, "uuid": "abc7f566-6311-40e6-b5d7-831f2a875b40", "value": "Richiesta di preventivo_RFQ03272024_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c622e78-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609873, "uuid": "1799e59a-bc33-4f8f-9040-d2d1d134222c", "comment": "Malware payload", "value": "4f3c2595c01b4be843632c216c87822d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609873, "uuid": "2cc4879c-d670-4825-bd55-e358e50c7cf2", "comment": "Malware payload", "value": "5855a6fcd1d191064c75015b7244802bdedc569dcd9d7b815f6d6038e2f49ca6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609873, "uuid": "fb5f8e9b-a6da-4854-bd13-ae850d39b8a9", "comment": "Malware payload", "value": "2addad8442190523cc1150c6d6b8e367734d856a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609873, "uuid": "e08d2e2a-5512-4ed3-8573-dec33eb96a66", "comment": "Malware payload", "value": "425aad648652df803da7d08632a2f323697c99d9de97b59bd7310181baf6997562b84504dd2c7b2f937fb8a95ec9dfa6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609873, "uuid": "03914549-f9b2-49e8-919c-29e6a87a1d85", "value": "T13DB17A5613FE5608B5F39B48993216380B37BE6A697D820C05EC2C1D1FF3A8498767B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609873, "uuid": "c2bf5667-cb3c-4512-9b30-9908bb85ab10", "value": "96:eqZTm5uYMViSnctPXo2p4QXnwD0mSGQCPz8fFGZ2krTGQEETGtC7:ZmHos4QXnP9uga2krTHTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609873, "uuid": "d4622795-f220-4e0f-b3b6-1f284de9ce02", "value": 5542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609873, "uuid": "5ed6debc-70d3-4ebb-a73e-7d62431516d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609873, "uuid": "f08d416e-084d-4d72-977a-9b8ae2053d6f", "value": "invoicee.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919272b2-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1711652482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652482, "uuid": "85b0ba12-4a15-42bc-986c-e34fb1648546", "comment": "Malware payload (Amadey)", "value": "98a30293d97ff1b2f0ce8daaded19581", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652482, "uuid": "ee776a02-2af5-403b-a1c8-6f11b42451c9", "comment": "Malware payload (Amadey)", "value": "58a33e0f77235b76006f2d94b21377c3c259afc612cd44df0d707d70645cc194", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652482, "uuid": "8d1be748-5090-43ef-bfcd-aa650f608f31", "comment": "Malware payload (Amadey)", "value": "1df329a7a3b12c7e3ec9a7c1906be6db82c1aa8e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652482, "uuid": "6ef2ce2e-9d3c-44df-8568-99b19163ba4f", "comment": "Malware payload (Amadey)", "value": "22c6df49f354fbbcde3752aad3ba4d3a8dba807da052e358fb60570edd4e731e19c80f4e42ae505b16ab7feefb7d233a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652482, "uuid": "33278fa3-4950-4c4e-bfb8-d3f175aeba76", "value": "T12285336B40650AF3D5BBA2B0874E3BA5B719A74B0E96E5AC0C1FFF2757086177DC2090", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652482, "uuid": "e0eef981-6b76-4be5-b55f-b899ec284632", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652482, "uuid": "9feaaba8-8b09-4dbd-81b8-ea07f2cc1303", "value": "24576:hHp1iKHep8p+qTwp07IXRMGIyOpL5aaNPGlUN1Z9cnywODwkE2fqPva:8KK8pHTw27GfIyOpNa6rSyDPE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652482, "uuid": "cae3639c-0e24-417e-b249-a512a9c0ce9d", "value": 1853952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652482, "uuid": "4449a8fe-81c0-4246-89d6-f1d4829c44f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652482, "uuid": "ba488257-0684-4ae8-ab6d-a1a14879e685", "value": "98a30293d97ff1b2f0ce8daaded19581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68826be-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652517, "uuid": "b67d6663-0d7b-4285-a57e-f657b618e7a0", "comment": "Malware payload", "value": "2f8912af892c160c1c24c9f38a60c1ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652517, "uuid": "05a35b4e-0831-4a8b-b75c-3167efb55efb", "comment": "Malware payload", "value": "59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652517, "uuid": "dbcd4895-4c96-48ea-916c-3d715b52199f", "comment": "Malware payload", "value": "d2deae508e262444a8f15c29ebcc7ebbe08a3fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652517, "uuid": "14a13549-dddb-4cd2-8cde-a3490e811953", "comment": "Malware payload", "value": "41cb11376f478f53858dc9c463c89b7c0d59c52c8fc1061a29b6f48242b3337307b4acbf4fd4d0df28280e14afaa6c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652517, "uuid": "4c359813-a404-41bf-b877-6df27ca5fbcb", "value": "T148159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652517, "uuid": "9f2d1c51-2f5e-48b2-b51c-e99fb21b61f8", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652517, "uuid": "414475d7-b4f5-47b3-8244-3c2d8f114bf8", "value": "12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TN:qqDEvCTbMWu7rQYlBQcBiT6rprG8aAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652517, "uuid": "20ff8592-433f-4387-b803-c196be61f592", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652517, "uuid": "8280b77b-e47f-40c7-a32f-85f1b430e597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652517, "uuid": "0c2cdc95-413d-47b6-8ecd-c93398f1f98f", "value": "2f8912af892c160c1c24c9f38a60c1ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7d8539-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711651108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651108, "uuid": "461faa6d-0da0-47c1-ae68-239e77c0886c", "comment": "Malware payload", "value": "29b7edb8342a199f28161b69ddc9933a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651108, "uuid": "ff373dcf-fac6-479d-8042-a240307af32e", "comment": "Malware payload", "value": "5ad0c6ecd29e86c3829f59d9a0aa7f916bb37a09f05ed0f4b51eb4d2bade794c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651108, "uuid": "2c5b8250-ce10-4abf-ac57-92d139543631", "comment": "Malware payload", "value": "47d9284cf2ebe0e0e534cb74a619ecaf74b91bc7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651108, "uuid": "2017bd12-89a2-46c3-8727-d8f77b6987cb", "comment": "Malware payload", "value": "1637867dd179f642b223327d32d72cf6fc49fdf51eb4fa3426bd763a899b8d4aa890479c877ec58332a4c47ddda2b142", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651108, "uuid": "eab01203-7da0-4788-b4c9-14d1d5ece914", "value": "T10B13BF33CD634457D39222F6A71D0D0EDA3BAAADF685BF582D8BB19016201BC1E61E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651108, "uuid": "6a112f97-f0d1-4474-8cbd-cfd1608d1427", "value": "768:5/l86ap3bmFQyawatuNokSZDsYgL6tSXXGLHpn3HKQRdbcP1:hlkbmFQwYuNokkDsYgGtwXGL1zRdb61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651108, "uuid": "2e9a7b1b-b669-40e8-9e7c-c475ca0df5d8", "value": 43485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651108, "uuid": "e72e2ff8-e9c6-444d-8b66-48859cd41681", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651108, "uuid": "3fa55e68-9ba4-461f-97e1-66f851aead79", "value": "2024\u5e74\u4e00\u5b63\u5ea6\u5458\u5de5\u8865\u52a9\u6d41\u7a0b.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ba1ccd-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711652024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652024, "uuid": "5987a298-1b46-4fd9-91f3-fab5fd6aeb31", "comment": "Malware payload (RiseProStealer)", "value": "7d9b6f9242168dc0571a8b83e50d1256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652024, "uuid": "87b19836-a4cf-4d2f-ae8e-53f8c96a0e0f", "comment": "Malware payload (RiseProStealer)", "value": "5c3c9f8ec4815cc85cc6684cfb32f285d7016c9dd8568038a71bb77714e8194b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652024, "uuid": "42a37a29-6142-4bf9-8cd7-7492749bd699", "comment": "Malware payload (RiseProStealer)", "value": "145c45bbd8b3ea17c883b96242ecf54429ab80ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652024, "uuid": "af364866-17ba-49e7-96c0-d73ab185b1b4", "comment": "Malware payload (RiseProStealer)", "value": "9086db4208266809f3b0cd157658360b16450b6650e4e0ba3fb182ebc6992472b0f8a563e78b3e1de557e6b5653d44c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652024, "uuid": "53cd35f1-e408-4aba-972c-41a9a6f3d05e", "value": "T144B533A1EE753B41DDA89232E4F9C22BBE6834024871284F284F4E77344FF694D87697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652024, "uuid": "ac544b19-308a-4450-b3e7-ff9b676c65dc", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652024, "uuid": "5dfa51ce-8d14-4e96-ad52-1c4a2fb35797", "value": "49152:DCaPaxEBOKy7M+5j6RzQbUjmNBUvsGMT+kzff1ZZoyA:DCSWEk4+URMbUSNFX1ZRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652024, "uuid": "cdf67f90-b276-4500-b073-9744edb46e9f", "value": 2308608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652024, "uuid": "3a7bd71f-a209-4bc6-ae7e-a3246a870af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652024, "uuid": "a76bb6f9-8d7b-4746-a434-a04924f31309", "value": "7d9b6f9242168dc0571a8b83e50d1256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27c66b2-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload (Metasploit)", "timestamp": 1711652511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652511, "uuid": "bb3fc6e0-0f36-4c89-98e2-05461e813d9d", "comment": "Malware payload (Metasploit)", "value": "039aebb1a469963963e34d31a42e6608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652511, "uuid": "541b2827-9888-49d2-a8b1-34cba2bc98a9", "comment": "Malware payload (Metasploit)", "value": "5cad07e8a93e151126f2668e4acd40bfb6a6c136720868e1abb88d6ce855488b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652511, "uuid": "6691e3e1-136d-459f-b03d-05e1c01adaf2", "comment": "Malware payload (Metasploit)", "value": "6a60e11aa5949ab9fd861397879e2b6649292e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652511, "uuid": "52ae59dc-b64d-4857-9e56-f8a4e4e0317f", "comment": "Malware payload (Metasploit)", "value": "be5ff9eababaeab3ac06e2899e13247c02b770922f1d6819eac19ef24e16d0d6c1a55b38b1e803e158c6564206489e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652511, "uuid": "d9705e3d-fd7b-42b4-8225-b35501525800", "value": "T12C73B042D9C42575C2B7127E26752E7A9971F2FE7301C1DA754CCDB9DBC08B0A62A3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652511, "uuid": "9f630659-73d1-4d3a-8e83-d1a18cfac518", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652511, "uuid": "0eb9101c-e416-48ad-abe1-53c1dcc4fed8", "value": "1536:Ia6vKe2IO6a0lRL82nTnWVMb+KR0Nc8QsJq39:W1xL5ue0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652511, "uuid": "6a316d8e-6793-41a3-8b7d-ee5d2e91f64c", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652511, "uuid": "1fe6e9b8-4114-4cd4-8699-7639497e8163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652511, "uuid": "bbb3b848-1284-4704-891e-73af11c6ef30", "value": "039aebb1a469963963e34d31a42e6608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d54def-ece1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616304, "uuid": "e12678bc-b11c-45b7-ac4e-2a9c7b0aa2a1", "comment": "Malware payload (Mirai)", "value": "cf2dd70eeb31342999fb17f1cf20c3bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616304, "uuid": "12768818-2d75-4fc9-aa39-c6b7b857118c", "comment": "Malware payload (Mirai)", "value": "5df24e7d84ec4de89558d7d6969f7e196627a94d08431c64f1e2990e33cccb16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616304, "uuid": "e87cd976-2ce6-4b65-b2d5-92c6e0ec92fe", "comment": "Malware payload (Mirai)", "value": "71aefa2784db540808e494b7f371863ba8eade8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616304, "uuid": "b440a4d3-68f6-4bbb-884f-bb4d40990e73", "comment": "Malware payload (Mirai)", "value": "f8957bc8af7acb8fef639509df82557641f82038b025a2f5922db48eabbeff390af6534805b021b29ec7c6815217c2b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616304, "uuid": "a09731c2-c848-4a26-b499-7eb855845e65", "value": "T123534BC99913D9F5EC1509B6203BE7368777F13A241AEA97E3CC9653AC83702D10728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616304, "uuid": "714ecb4b-85a4-4e08-9315-723a8e39003d", "value": "1536:nGzntC0hJk6buRYZv6efcj825u1g47EwT4bchEpKKihCIeiBOHF:GDtC0Jk6SRYffcjP5Kr8kERiEvOMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616304, "uuid": "6588568a-d75c-4a55-be0b-5071495c759e", "value": 63476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616304, "uuid": "233eb359-1c02-4397-813b-df15420ba2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616304, "uuid": "124eade2-1a86-4750-a5ee-858721ad5530", "value": "cf2dd70eeb31342999fb17f1cf20c3bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd4cf45-ecda-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711613284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613284, "uuid": "90f4177c-0187-48e1-9767-0219caf0b41b", "comment": "Malware payload", "value": "99d7b5a9d451869d855c0fe1de51938e", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613284, "uuid": "93ca4f24-341b-4733-8ea2-ecc51bf09d97", "comment": "Malware payload", "value": "5f19bd79b8d400dcde060cc6af8693a514e11b46760d2cd3ff522a26efe9f518", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613284, "uuid": "8ff7d41d-d9bd-403c-8b5a-6f860f9af659", "comment": "Malware payload", "value": "bb09b047c0815be1f005e4d5a40d8ba409877371", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613284, "uuid": "e1fe28bc-a2b9-4ed4-a27c-b16c6151f9a4", "comment": "Malware payload", "value": "2212bd2212601118fc4a08631fbb45537b74b1daae911f2f0031961213be3f6ff0b0f7224e4215e00138ac48b73b1cfc", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613284, "uuid": "addd789e-d1a7-42d8-9eff-a5b503442dc1", "value": "T1DCC54FE3EDAD1AC7270423BB7B0BF6140A1BCC362A826E9411D515DA751E70F2E90D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613284, "uuid": "22de84a1-8031-4c1a-90ce-94811e54f5e9", "value": "24576:M4S+foiLes+fDpflNzEGcJNydEJ3H2i2/W3LrUYX0oE8pSmgC8Wy8Q5Hl5HWdvPF:M/+foces+fiydEJX2jWtREYLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711613284, "uuid": "958ac71b-ef59-4d6b-9747-5dc0e2fbd028", "value": 2637207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711613284, "uuid": "1a5f7a15-2cfd-431d-a77f-e7e7fd3e7574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613284, "uuid": "a3e3b4bc-9e85-4358-bed2-4816c95554cf", "value": "Zam\u00f3wienie_27900045542300.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442560ff-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (DanaBot)", "timestamp": 1711609403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609403, "uuid": "48aab57e-5a27-427e-a3c2-c059b9b442e7", "comment": "Malware payload (DanaBot)", "value": "62eb033fbc2e1790ed777d3ffcd62477", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609403, "uuid": "7ac0f7f9-c869-4e22-991d-deaae69ec45c", "comment": "Malware payload (DanaBot)", "value": "5f24b7934a1981d24700049056dca1be14a19db32779a97ca19766f218e47c0f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609403, "uuid": "7d6a50f7-a3b2-4bdc-a0b5-df6047af0347", "comment": "Malware payload (DanaBot)", "value": "6983fa34883c7a2d7ea975e2323453817fc11a40", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609403, "uuid": "e498009e-f077-4b7c-8c0c-4de6abd00f8b", "comment": "Malware payload (DanaBot)", "value": "50b7ecb7e31e5a93e0dd1a4cff6b5ed99fb2e55eebf4450c6393685a21aa66881c2f8dde8a4249d87c4f08e13b331356", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609403, "uuid": "31741071-16ab-4b34-ab25-2d2431e636ab", "value": "T117367E21F384913FD0775A3B48AB95B4593E77602E258C1F2ED80E4C8F39741BA6639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609403, "uuid": "394ac090-3ea7-49fe-a973-4b3b09a685a3", "value": "88b32203d0a05a747b387c7374b2b4fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609403, "uuid": "bf2c1ef4-e63d-4b54-9a86-93a09428b579", "value": "98304:v+L8tarwg83M53jeDZPC4PD4KnQY18+6qdLl/6lZmg:v+MmwU3jC64PDhQYf6q6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609403, "uuid": "7c904a44-783c-4dbf-9764-c93966f6e0fe", "value": 5308928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609403, "uuid": "bf02e10f-a46a-4813-ab6a-6721d4d60568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609403, "uuid": "79221173-c8cd-4adf-96d4-434920f2447c", "value": "uyegwfgefwg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63eaf7a0-ece1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616328, "uuid": "2e55120d-4148-4c45-abdd-676089bda101", "comment": "Malware payload (Mirai)", "value": "2ea216f4738961abd0c036cf4eb965d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616328, "uuid": "f40dddbf-0f2f-4251-a95b-4e64cacd448a", "comment": "Malware payload (Mirai)", "value": "5f4d33aa3844f96defbe785cb2e81711f6128eb3aabc7ef8d57c55cf4db59821", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616328, "uuid": "d75d5a97-8603-4a28-b336-417289cb3c01", "comment": "Malware payload (Mirai)", "value": "e759ec9129eab0aeb4368a7bdd2e9c8bb563e110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616328, "uuid": "e19290d1-1299-4f22-ba52-bac3e2f5f709", "comment": "Malware payload (Mirai)", "value": "e01645bdaecb9ea740e44ca90cc16bcf0f1bd9d0fd449b084b2d2dd97d6ab6551d612c3d9c1aeffcc1a3b3726213c0a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616328, "uuid": "b7431267-b2fb-405f-9224-ba71eb80f5f8", "value": "T100831A52B8818A16C5D412FFFD2D018D332667F8E2DEB212DD105F647BCA92B0E77A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616328, "uuid": "09a214c5-97e3-48fe-9b57-9ce390872004", "value": "1536:Umnbl36UFoO3aWniiwbnJ9B2dy8ndrZvNPSdGn0QEMsiMZ8E5u4Yl1dsd42+j9:RB6Un3NnibjQywBU7Z8E5u44Oq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616328, "uuid": "b3b921a5-02bc-4e3c-b824-7dcce4cbc2e0", "value": 82684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616328, "uuid": "94990700-d2c9-4c66-a646-10939ba9f169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616328, "uuid": "09f5d67d-a591-4f40-8e74-6f9fb525a81a", "value": "2ea216f4738961abd0c036cf4eb965d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba25fa1-eca6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711591081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711591081, "uuid": "b4b4e67e-c6ab-48a2-9a88-83e741a93e83", "comment": "Malware payload", "value": "ba68e11010daefd0b8df7dbdfbc746e2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711591081, "uuid": "3d999070-186c-4a32-9334-065a40ccc900", "comment": "Malware payload", "value": "6036c7a66bfc662470d6cf33890a4b8921fa0cb373dedb398c11b7ebe4d35d46", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711591081, "uuid": "2b441bb9-bd4a-4f8e-ae9c-b478e9019de7", "comment": "Malware payload", "value": "247547d8163e558698b513eaf593b1b03f1fe0eb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711591081, "uuid": "9f4a7064-46df-49d0-ada7-28897df4ca8b", "comment": "Malware payload", "value": "b1b1b6bf6e0b3a82ca0cc63e803cf7eab8312fc186fc392a5b4921edf48dae50ff815a2643fa7e29c42f2376bf7a30a5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711591081, "uuid": "bd10814b-48c7-423c-807d-792e3df38196", "value": "T15EE50207E9529467D4FAD3761A72722A203A4C1407839366392C7BFF727F5D90F8AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711591081, "uuid": "969f4c89-f81b-4231-a435-7f009033a922", "value": "98304:S2wSIns/PO+4dV8pAADersXUY4HbWNJaTt3:3Ws/mFdV82ADjXK7WNJqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711591081, "uuid": "82df658a-c84d-4cb1-b31b-576c2b0fd18a", "value": 3226551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711591081, "uuid": "d5b50abf-7599-4b02-b3fd-d3c390d641ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711591081, "uuid": "20d91634-9ae7-4c6c-a6bd-0b6ae2a89670", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46ae521-ed49-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711661131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661131, "uuid": "f2755de3-67dd-4eda-bcee-80e4ac82f188", "comment": "Malware payload", "value": "b691aa17712dea8153bdcaa3ffbdaca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661131, "uuid": "2f8b559e-b305-4c92-928a-a0474221e367", "comment": "Malware payload", "value": "6235029d8dda63ac594132df856a367093c80f5a432b1b5a7c29d5601aab5af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661131, "uuid": "5a8998fd-f30b-4958-b03a-34dcc8fbb2cc", "comment": "Malware payload", "value": "6ae217a6063c7a2f8cf33a53ecac633d85f5ba36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661131, "uuid": "c75f002b-da8a-4f61-857e-86195d9378b0", "comment": "Malware payload", "value": "e8c3705fd831d387ab8c0c21ad8bfc868dbb75995eba04f42b6037cc5fd71c1797af873e293f06c37db8a08a1b1bcc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661131, "uuid": "4bc18116-8bf8-4cd4-801f-724447f130d7", "value": "T101E7336BFFD1482BDA1404FCD312D11459CC27748523B1A0E8EB58AFFC66D898D8B99E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661131, "uuid": "f56b455a-2195-48a3-914b-94d092a2ad72", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661131, "uuid": "28c90643-3310-494b-94fb-45d926603d5a", "value": "1572864:RrziNx5qzFi+TY8zy0b1hZMuX7UIEpS+wEv1tcfrMyfR0H7:8x5qzk+1j9MuXomXENtOPfR0H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711661131, "uuid": "f9ce5e8c-a1f6-42d6-bb72-85022c575cfd", "value": 69193668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711661131, "uuid": "d2e35cb5-cedd-4dda-8dee-3595c96fd12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661131, "uuid": "3f1a6b8a-a463-48ec-b87c-8552e9d17215", "value": "SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2e1299-ecdb-11ee-a120-42010a9c002e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1711613636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613636, "uuid": "b63767f0-e250-48fc-8e7a-eda60bea5ef0", "comment": "Malware payload (PrivateLoader)", "value": "4204b9d4c4df5c4b4d67922db24f342a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613636, "uuid": "9f8d4d25-4212-411f-acd1-62de09d625bc", "comment": "Malware payload (PrivateLoader)", "value": "62cd7b447bdee3ec1670c92d9585e1fddbaa5d4ee824dee8f15940005bf95414", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613636, "uuid": "539d29b4-2c25-4897-abb0-ea17f4b5c9cc", "comment": "Malware payload (PrivateLoader)", "value": "9255b5e94028f3f55adda2576d60bd39452eaf08", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613636, "uuid": "fdd1c93d-0e99-495e-ae8f-bfd0962f43f9", "comment": "Malware payload (PrivateLoader)", "value": "84ad33bc20e9a1df62e066c8bdb5183e99de039815abef55220905d4772557c220398e9e6f72058ed4551f16f6b4fc2a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613636, "uuid": "fc25618a-ac0e-46bf-9701-6e79b96d423f", "value": "T14EF5123713D55524E3BEEBB06A7A63300B22FC846CB2E61D5352DA496C7F701A973722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613636, "uuid": "af92bde0-edc6-4485-9c23-284865708390", "value": "bedb96d8a71f9004abf64308e680fcb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613636, "uuid": "72dd2fbb-ff75-47c3-8994-29cc0fd3b95d", "value": "49152:l/Ki16IscOcmroPBql2IzydQgfTzTGKr6d61YryTz3onQqHlfBrfgOtat:Ujpreg7zyWsFGd61QYoHBroO4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711613636, "uuid": "7106d9a9-1920-46e4-b248-f10ebddf1ec0", "value": 3396944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711613636, "uuid": "e7aefb9f-cb05-4d9a-bf31-63421a0455b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613636, "uuid": "3f39d637-1fcf-44a1-b919-217ba2ae3388", "value": "4204b9d4c4df5c4b4d67922db24f342a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d551153-ed3a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711654435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654435, "uuid": "b42747dd-6fde-46f0-a937-59fb1096b9e7", "comment": "Malware payload", "value": "78f23006210bda6b5e26b8cbefa9758a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654435, "uuid": "b5858df7-6c7f-4e54-846e-ab59759a8f83", "comment": "Malware payload", "value": "631acc4c860b0628e08895af0c2c9dd0c7af17f32da4cd1e2e22e85a1f534907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654435, "uuid": "d459fd97-68fd-4077-9574-49a233446663", "comment": "Malware payload", "value": "b1a191597f5a2ecdd3b9185b89072cfae06ae5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654435, "uuid": "ec32d0a0-a3af-4f4e-990a-e14dea61d5cd", "comment": "Malware payload", "value": "c1f43a9a22ad44954be3b680d614c253b1c79d6117537fefb092605e7c632c4f84f535ac0211427ce2acec87c02a1aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654435, "uuid": "30a2ae16-cfbc-4d45-b8c6-1bfcf1bb0c14", "value": "T1442412E24FBC4801D85BCA31BA91D3989E71AB480BA1D7EB204DD2145F96FD2EF45336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654435, "uuid": "ebc488a4-7321-4fe2-accf-50738dc45199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654435, "uuid": "955f93fa-0ceb-42cc-8c53-9703a49530f6", "value": "6144:No9+UOY1p3TTTFt/rIQuwkpAoVBIiNeXtd5yE:NEOAZtXtueXtdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711654435, "uuid": "d960ffcc-aa47-40ef-ad94-5cd1f3b4a846", "value": 229512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711654435, "uuid": "b586067a-6bed-40ee-9a10-e329452d85fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654435, "uuid": "0701ed41-42df-4d37-a91e-4497b0b97eac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5292d072-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711610715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610715, "uuid": "d55025f4-4468-4c36-af4c-590d753ef2d3", "comment": "Malware payload (Formbook)", "value": "172ee9c18f5ccdc214e7beebcf9d8778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610715, "uuid": "dce7910e-30b0-4db9-9154-8d11ffafe5af", "comment": "Malware payload (Formbook)", "value": "63235afcdd767af4bb5bd09488642bbdfb0124e9b4066d00b4815050faae9079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610715, "uuid": "7231b9e7-2fca-4a10-9bc8-80b37e7f0caf", "comment": "Malware payload (Formbook)", "value": "66ac5a38d22c834aa3672961d46ff111bf67e72c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610715, "uuid": "3b21e5bb-54fe-42da-bb0c-e20ac978ab19", "comment": "Malware payload (Formbook)", "value": "dde015bd0ed3e12406e94518fcd3b1bc2a46470a9af73637621838a50f97ae109ec7baa637ae8161792a3af952a0534d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610715, "uuid": "b08bbd14-88d5-488b-a3f8-e1ebe3fe56c0", "value": "T137F4D09C322475DFC467C9769A982C60EA61747B830FD203906316ADEA0DADBCF255F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610715, "uuid": "5c91c348-8faa-4f84-a924-010d640d0d9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610715, "uuid": "398449fd-d5ff-492f-81e3-d1e73ef65624", "value": "12288:bSG0YOwqyjo4Gzzsj+YuFVQMJ2FE0KBxHPhzbwxwJlCMo1FPpXPtH:OWO7yn+Yucbex9wqJlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610715, "uuid": "c99d389d-9db5-4ecb-8363-f60887c71a7e", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610715, "uuid": "d7834aab-7bb1-43f4-936f-a8f96bf9ef83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610715, "uuid": "1ce17293-52bb-4e15-804b-cd7090feb502", "value": "SecuriteInfo.com.Win32.PWSX-gen.23268.16982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ea6755-ece5-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711618267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618267, "uuid": "96aa9f02-740b-4a62-bbdb-8d01caf4200b", "comment": "Malware payload (GuLoader)", "value": "b1027e9f070b99898e0d2f30bc3e5e64", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618267, "uuid": "fe4e347b-7f14-43fe-b7aa-deec202f7e92", "comment": "Malware payload (GuLoader)", "value": "636a279a20a10b244241a0b4cf76a71139f0b8d17a6e6c7b8e7c5ff695418aab", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618267, "uuid": "39b09f00-2333-4a19-8802-1f6f80b61f5d", "comment": "Malware payload (GuLoader)", "value": "2a4c4b0da45ea999ed5dd2ec5163390343e0af15", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618267, "uuid": "355ace6e-1109-4c51-838e-2ac25f906e4b", "comment": "Malware payload (GuLoader)", "value": "059bedfc8a69a614f8cc0431f1170429e0ecab9fd8c56fae9ad577a503e7f9b17c638c20cb319a7018eb2108574e1397", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Xxe", "colour": "#28DA7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618267, "uuid": "488f2081-ec98-4978-8501-80d410484d14", "value": "T1E6727D0CD345E38E0513A6E93D669AD92CB1C6C5CDF2A0CF9969D7EB1CCD19E204EC91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618267, "uuid": "0c86fe1c-0901-44a1-9987-2b610f864d44", "value": "384:xyyhsAbAdIVwtLH6ZCY5VYdJQHP64nPRFmab38HiYtd/S523tHzDjPMw:xDhsAbAGwtLwCR+P6YPRFmE39YTwi8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711618267, "uuid": "66a20de7-67ad-404b-85fd-373ee5d31c6c", "value": 17061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711618267, "uuid": "16f7871b-d1de-4181-b3d6-8ffeb01a7815", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618267, "uuid": "3d06e46b-70f4-46f0-8f60-cde4ccbe529f", "value": "DRAFT_DOCUMENTS_SCA0033362C_184KB_REF-QUEYE-2938OJEJDHE8-PDF.xxe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0220e0-ecda-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711613340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613340, "uuid": "0737edbc-45b7-4b42-af78-bf1231a9b9fb", "comment": "Malware payload (LummaStealer)", "value": "b658976a0f5c5771fcbd0379e8a5048b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613340, "uuid": "081d2fd6-2e45-4ac4-af0f-884bb6c0879c", "comment": "Malware payload (LummaStealer)", "value": "64f518f278d1f80c480e8e96414606be3383b07ca7571b5eae64df0ee88d4074", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613340, "uuid": "0e280721-5e1b-4583-abf9-cc501e762f6f", "comment": "Malware payload (LummaStealer)", "value": "a39155f41567315511f18bdfe7d6107675b3378a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613340, "uuid": "ea2938b8-950f-4a0d-bf48-275b96b1e182", "comment": "Malware payload (LummaStealer)", "value": "5b86e4066e36fabe06828cf84324ad4486efb1b119a471e28922031694a3a8e9eebeeccd57a23f0825ea9e920f9421f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613340, "uuid": "66cce639-f2b3-472e-b828-f65aa3aa4d0c", "value": "T16984BF3372E1B820E6774B33ED2DC5A4262EF9618E797B5B33185E0F15B00A1C66A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613340, "uuid": "62eac17b-07ac-4bc2-ba96-c793d9dcd87b", "value": "d6cc7eef7e91d5b40575c3542ffc17dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613340, "uuid": "857839d9-0253-4c31-8550-c08640b11120", "value": "6144:B/mPwo/hI2Dx7m4r/kBRsREyeOAloT9Xk:RmPhDxtr/iRcEvO3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711613340, "uuid": "86046613-2cf7-414f-9285-62488c1c7a7b", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711613340, "uuid": "6b553211-2489-4d2b-ba32-88fd511d5e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613340, "uuid": "a088230c-160d-4bed-841b-9e04e5cd5ae5", "value": "b658976a0f5c5771fcbd0379e8a5048b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426bac73-ed0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711635599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635599, "uuid": "d3e2ac7c-650f-4ec5-807b-4419ebfdc7c5", "comment": "Malware payload", "value": "f3e70f68d7e2f644bcd312f1333094e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635599, "uuid": "2843524f-2073-4578-8bd6-b73db7e2c603", "comment": "Malware payload", "value": "6607d552accc951f2cd068bb394200987d7d1e90e34f8cdab3afe6e3ccedee4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635599, "uuid": "3f5fd596-16db-4926-9f94-4fbed707a09e", "comment": "Malware payload", "value": "259dd00ddb8a08fb149c37254bfb865a74bb11b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635599, "uuid": "ec500387-5246-41e4-811e-51cb48ee993e", "comment": "Malware payload", "value": "5fb69fd505898cd2f0d25bd3f1b53de726159d429629eb9a1bb1f714693b69befd5ab828ed73010d2a8ed97cad87c589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635599, "uuid": "16c9e798-bf3d-4e5c-955b-87fd3e5ed0f7", "value": "T147E53330B7FD8FADD96B4132A411E6B94630E543498152FC6EB744A41FAD38BAA1C3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635599, "uuid": "fb150999-8347-4d4d-b2be-cdd353ad190e", "value": "98304:JmZqA+iL8qKL6O30JpMQEXUNa+6wBil8Ze:Jva8tLlIEEUzyZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711635599, "uuid": "6441956c-de95-4e28-a3c3-8bc280a7345b", "value": 3249284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711635599, "uuid": "090c1245-7039-4a2b-914e-11c6a58c4dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635599, "uuid": "baf8afea-c445-4c8b-ba85-fd7aea76defa", "value": "SecuriteInfo.com.Win64.RATX-gen.30029.14447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbe9912-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711617819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617819, "uuid": "06805dad-60fc-4b6f-9aae-7d18e3473fb6", "comment": "Malware payload", "value": "e31217888b467821745770b0f9565f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617819, "uuid": "56e20c29-3f7d-4ce8-9eeb-eaa52d4d65b4", "comment": "Malware payload", "value": "664cf9b9a6c02eb803043cae1e2097d9fd1fa5c7fed6def439a969d6d5ea260b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617819, "uuid": "2938949e-f93b-47eb-ac85-7a03919a6dbb", "comment": "Malware payload", "value": "a6b7f7f96f02c2e78f6d35570948f29ee89665d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617819, "uuid": "12a312e5-54be-4e44-aee6-6d6275339c8a", "comment": "Malware payload", "value": "f7c7dfe2d4393d1355a27803167862a6f85a86d72220c6c18ee952192e8df9f851634b1b74ba01766cac902d94903101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617819, "uuid": "23f8138d-b734-4075-96cb-c824d62fd07f", "value": "T139E49D1BA7A411F8D0BBD27ACA438507E7B2BC661651D30F13F4579A2FB72616E2E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617819, "uuid": "cb5ac50a-60e7-4c81-8790-77a1267b00d2", "value": "c28a6a0512f8954dd49f67743d6c5b82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617819, "uuid": "04207628-39b8-4f8b-a69c-773fe9fb3d62", "value": "12288:kFjT8uf3TofH0ZYV4WYgeWYg955/155/9cR/DafecSUu9+sAS81mRhNmFbIesLIn:kaA3TofHEYVjg2fpHCIjCPfOtMdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617819, "uuid": "0b4595cd-ba8a-4040-a9ae-81ad0a4e4976", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617819, "uuid": "ce751b0b-a327-4677-b6d3-12dabc9e541d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617819, "uuid": "37a1a262-9d3d-45a2-bedc-5a4e7504ed51", "value": "SecuriteInfo.com.Win64.CrypterX-gen.14448.17144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e8301-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638972, "uuid": "f7b8b325-d465-49ae-8f9a-19ee494290ea", "comment": "Malware payload (Mirai)", "value": "a83bee8dd1253c731c9f7cc0261e1a93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638972, "uuid": "06dcdf3f-aea8-4758-86b0-812188060fb0", "comment": "Malware payload (Mirai)", "value": "66b005350fb06950a8387967d3d6e7fb272c73df7534d0bfba71bef46b691cde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638972, "uuid": "3a676f3e-ee22-4906-a549-1f938c2f489f", "comment": "Malware payload (Mirai)", "value": "6eea72bf76ee1f42a30c55d6666acee506ebe0ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638972, "uuid": "0475f170-e8ee-4395-b674-748d3f604593", "comment": "Malware payload (Mirai)", "value": "daab34f7d80203e70ee40280ba8fb373e1572afd4a6564d8adaf0d126eb6290bcbc193fc966f3dcaa84ac5f42d342e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638972, "uuid": "5625edf6-88df-4f48-b944-471dba05dcb9", "value": "T1D7333A05BA41E677D44313F55AA38B611630FA3A2AC64D0AF3593CB8E3671C4F2A376C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638972, "uuid": "7ddafa76-feaf-44fa-bc3c-660fdf33237f", "value": "768:03LAt1+65FRqveE+qQQDX+g/u3mVVTHZ4xRaj1IH:0EeIkWEfQQr+g/uOT54vy+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638972, "uuid": "b48250f2-8cc7-4ce3-bb16-ce357715ebca", "value": 54561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638972, "uuid": "a3fd297e-db9b-4fa3-be2d-4d94d1cf4923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638972, "uuid": "b5dede4d-413b-4546-b87b-9eb1ba4e9323", "value": "a83bee8dd1253c731c9f7cc0261e1a93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbe69ff-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609798, "uuid": "ec2dd602-7d0f-40fa-be69-25f25f50a8cb", "comment": "Malware payload", "value": "1a0ee32ff0485de741994e0834883102", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609798, "uuid": "c319f57f-07e7-4323-99e3-976e25134a79", "comment": "Malware payload", "value": "68a915b79540336f5101a1aa65c32169a39029b93a059048b92ee9679f2157f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609798, "uuid": "0f8dcc6b-ca4f-4aac-b96f-0f68a35f4224", "comment": "Malware payload", "value": "eec0ee4290c86bbfeb888603f8db3a27e07b19e2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609798, "uuid": "cfcb0009-99de-4afc-b2c4-8a46f76ed0d5", "comment": "Malware payload", "value": "05fda31a75a81153ed645008c333e2e5e50d5b3137c974f857c6863c8a44c24c245b7ba546ed8e268329d7ce8f8e7965", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609798, "uuid": "0678ca68-e5cf-4010-a88e-170322b70dee", "value": "T1D011A8503C090161D4B28AF633E792F0215085CC7E0B35325A5CA3D46C591990319B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609798, "uuid": "ecce7649-89c8-42ba-a3e4-92a36d5e9039", "value": "24:9+IhBTGr1Zlvcc41nPPu9vsX02zNSAicakSM76dMJNaOfH6EA0yEl:9+cBTglkjBOvsX02zQAnSM72MTawH6J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609798, "uuid": "131f65ef-86ee-43fe-868a-44829d721727", "value": 1070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609798, "uuid": "10ef51c3-8cbe-403c-9281-0a08dd445dc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609798, "uuid": "b7ac680b-85a5-4d3f-b11d-ed022426ae8d", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c70607a-ed00-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711629603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711629603, "uuid": "87e02f2b-0d61-4424-86dc-ac145926fb9a", "comment": "Malware payload", "value": "4f15b30cc6a579d7f7382b39419ecf0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711629603, "uuid": "ce78ca62-aa47-4495-bfeb-66823feb11fa", "comment": "Malware payload", "value": "6abe4099601f16093e0a2728fd2f4d3cd34da18177d69cc7ea0082e1f832dd6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711629603, "uuid": "cbdf4515-2a37-4736-9d8b-e997da41c688", "comment": "Malware payload", "value": "52ff04c9b1f5d6a9082d637257f850743d2e4da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711629603, "uuid": "2494d952-76ce-4b3c-9113-7e11896bec0e", "comment": "Malware payload", "value": "21035150bfa99c02c4dbe1cc99a93d88dd5152c99e2c32d3ec966ce46cd59004ef7467b4f301931a1333d5696af4bb40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711629603, "uuid": "59f12792-3b90-4541-b6c6-ed189fdf30ec", "value": "T1ADD6231193BA9EE1D59278F9916367D543E45F6E0E3A80ED9E833E4CE835A834D3D0E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711629603, "uuid": "582d1772-abcb-4bdc-b29a-3358e1628180", "value": "fc767981d9adf6aae71606ec95f5f1d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711629603, "uuid": "d3759513-6058-4af6-bec4-15885e0d66ad", "value": "196608:WEdsJ88LZfvpZOalvuCZkptDsTFgKEA/MuF/+uOHuXIsBIojcb:xdsJZhU8ODYEAEsYuYsBXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711629603, "uuid": "ab9f0674-da32-44b2-b4e2-6a67b73b030d", "value": 13167088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711629603, "uuid": "3c05cbdf-7d87-4025-ad79-21105c8b8e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711629603, "uuid": "a412a78f-2cb0-45de-860b-dd965bbba025", "value": "SecuriteInfo.com.Win32.Adware-gen.4351.30579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef685f1-ed2b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711648210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648210, "uuid": "5f15e91d-b085-453a-b846-6d0695f67250", "comment": "Malware payload", "value": "c116690424430fd6227731cca837686e", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648210, "uuid": "0ff8395c-3eff-4d0a-acf9-b5f5ca6630a2", "comment": "Malware payload", "value": "6af8bcc3298f78286f57ee3ba882c2f32111a79ad6639e0ea77e235251183bf8", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648210, "uuid": "0ad27fd7-9d6a-49f3-bbd6-f51f857539ca", "comment": "Malware payload", "value": "a62f3b9ac75e96389b2e537280d10988a2c3e08d", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711648210, "uuid": "c8997fa4-b33f-4d41-985c-c612a5a3a313", "comment": "Malware payload", "value": "92a86e1fecfebbdbf2de91d8eccb73dcec2afce3f4ecf964af3b590cd70d4569ca5f0c08956c45e93bd3fcae1a39561c", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648210, "uuid": "5587be09-fc3b-48dd-aa92-ff5ca0585439", "value": "T131C4C598764E13B0363A87926C7FA942EC8D2E5F841F4E47725CA2D10F720ADEAC7475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648210, "uuid": "7e5e14a6-92e9-4bb9-8dac-9fc43ec3aee8", "value": "3072:JvUSMtgY8UmsjbINLSvmPOqVVp7fYZ5HTMvJ3n/yRMqmPWGDRPa94QukNVZQO+TV:RGINLSvmPOof9PRsQcSQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711648210, "uuid": "8bf79b75-e040-4a77-abbc-ffd6a429aea5", "value": 596301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711648210, "uuid": "208f0313-dad8-48bb-8fa5-dfeacb7a8498", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711648210, "uuid": "37b89533-e331-494e-8e60-9dbbe77c69af", "value": "Zadevika", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2248f12e-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616647, "uuid": "20d5e948-6466-449a-837b-4de80777edb8", "comment": "Malware payload (Gafgyt)", "value": "f97f7e5c90d79682f0eebf60c0fd5a47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616647, "uuid": "bd232bee-8567-4bf4-ad76-2bca79368a78", "comment": "Malware payload (Gafgyt)", "value": "6c1b4179e85af8fe12fe072fbe5a2b5f2d1401dc01a9169ba34d6f371f0d203a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616647, "uuid": "0a864db6-816e-4916-a8bf-a962720aa64e", "comment": "Malware payload (Gafgyt)", "value": "a79ac47a86ac266cd74ae9b62c7efba742de7cfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616647, "uuid": "f55c8b8d-6559-4bd2-9a9c-d802a08e0c0b", "comment": "Malware payload (Gafgyt)", "value": "35ae8f606442c0f111f8e660f3ea8a101505cee857bf9bd2ce14ed3eb5cc975a9c336d8a7eaa32303246d7411cbeaf7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616647, "uuid": "302d61da-acd3-4107-8f88-90e44a9bfd52", "value": "T1AC632B42AA42CAB3C8930AB506EB9A260631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616647, "uuid": "d2472857-70d5-4e56-a083-bf5b77c889e4", "value": "1536:Vk8bOW0mDIdV5LTepgWncXyvolDmF+l2OZ/fufYEZ:FbOW0mDI1LeNc+YmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616647, "uuid": "8a626c15-47f3-4eb9-ad6f-fde216709a38", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616647, "uuid": "bf8f9be7-32e5-45d5-bff3-308b77432681", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616647, "uuid": "c8712ba3-5d22-4eb3-812e-67c5c24f18eb", "value": "f97f7e5c90d79682f0eebf60c0fd5a47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634c2baf-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609455, "uuid": "2764c656-fb2c-47f2-b560-40bf25369637", "comment": "Malware payload", "value": "2db3815de57631e1dbdb44ce28b912b3", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609455, "uuid": "bcaf6c9e-f388-4350-9ecc-aa543f82d689", "comment": "Malware payload", "value": "6cecd0da0f4d9f4bf8477a39755134d9bd4ec60eec7d759ee59a8365a3d8360e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609455, "uuid": "16d3463c-bbe3-4030-ad50-c56c203e2f54", "comment": "Malware payload", "value": "5b2cdfe11637986667823ecd975a9108b0a11067", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609455, "uuid": "c29211a6-3872-45b6-b0a4-a7c0698cc0ba", "comment": "Malware payload", "value": "f56dece2e54d5ec699e752157eef4ef586186b8a664f1ff0320b022a4df2ef39ef7c5341ea48ae38bb215c9b74cd2bff", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609455, "uuid": "d732943e-93f9-4074-805f-2b48fdf0db0b", "value": "T1E2D523069384EABDE706357EAD1CBBAF1778D300D3C3215F8571B4BD690897AA3395A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609455, "uuid": "7bfdcf4f-7939-4b01-898b-98162e16bd06", "value": "12288:yjzFo58GbpiM313RIwynTt+Z9MboQteAkmPjjHqdVJqwQCkEqaid9MRL8IAYzGqo:yjB+bvPMt+Z9MbWAkmLbCVJqVCki8ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609455, "uuid": "c572fd26-183c-4cd4-82c0-0babc5c56510", "value": 2807808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609455, "uuid": "a0e46fbf-95aa-4bb3-883f-fc53737c35f6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609455, "uuid": "62e3121e-2efe-4acb-917a-a03e7c3306bf", "value": "USD_Multi_Sector_Values.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f618304-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616642, "uuid": "4b1a97e7-0925-4fc9-9a2b-2e4660bbb939", "comment": "Malware payload (Gafgyt)", "value": "9f9f7b04fd64b0b24f36c09488d672df", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616642, "uuid": "48de81ce-7505-4e25-ae15-9b3480f0ad08", "comment": "Malware payload (Gafgyt)", "value": "6e818a52c50d6c896dd044c3c3ee806c16c941a5c4ba3809c7332e3fb4982350", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616642, "uuid": "e7ff9359-884d-4d20-9f84-ad768536cc0d", "comment": "Malware payload (Gafgyt)", "value": "50d126d2972469f4777a39f255bd5ebfcba056b7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616642, "uuid": "467a6110-7d9e-4929-acfe-ff7f99e6c97c", "comment": "Malware payload (Gafgyt)", "value": "1d2ad28704fd8b7915e697f42683650ac3685df701c573727ec6c9d9abf628642b7353e5750c102c4a5762ff2712fc7d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616642, "uuid": "4b6132dd-21a2-481f-997c-919fcd3ff19e", "value": "T1A4735C136991CB7BC4C747F92BDB952144A3F83E1F32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616642, "uuid": "b37fe908-e375-46ce-82fe-52b8b8bd3b24", "value": "1536:Y7IZuUaH+1iDnD+Q8bQ8O32Ls0FnswNXzvmA+JbOm/coZ3ymj:+Eae1ItqQH2LDnsEXzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616642, "uuid": "c99ec894-97d0-43c3-93a7-3222f674663d", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616642, "uuid": "de04f0af-6b10-4065-abec-c9cd956bd9cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616642, "uuid": "86914ef0-4778-4e1a-8af9-104d63374279", "value": "9f9f7b04fd64b0b24f36c09488d672df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fff0bc4-ecaa-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1711592645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711592645, "uuid": "98b1bd04-6cd9-44a3-987d-369d41185d4a", "comment": "Malware payload (Adware.InstallCore)", "value": "6a125563df3ce37fcc9fd74728577523", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711592645, "uuid": "0731c4ff-f0a8-49ef-bb43-7d925ffdf5fa", "comment": "Malware payload (Adware.InstallCore)", "value": "6ebccee754ae0066c0b1687793eb8478e90d0ce2f581ff175dc9f85cead5a8af", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711592645, "uuid": "3b73262e-23fd-4244-acaf-10bbd815ce85", "comment": "Malware payload (Adware.InstallCore)", "value": "aed0179bf2af022ca0f7ec5fc62010b5c38e0998", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711592645, "uuid": "9400b8c4-58e5-4532-9387-cde0d934478f", "comment": "Malware payload (Adware.InstallCore)", "value": "5d96a837e10947787517993af94f41bcee8762639cb7d46f4015469097ec147d850d4a754aafea86bf958810f3b0440a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711592645, "uuid": "fb71919a-2d95-40b3-b191-9441f81bea3f", "value": "T109673353E7BAC0BBE4E151BA4B9CE630C1DF735A9E814AE175C7935E2B81BC3411AB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711592645, "uuid": "5db0ef53-1376-47ad-8525-8d70c471f087", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711592645, "uuid": "93572343-8843-48e8-848c-b872c9ee64dc", "value": "393216:mEaEfX3TUOH80BMUUpKn47KKE2ZpVMjB67vfy3QjI0xfwYrMUn4sLh/OHydHPxl:mEaEP3TUSMU+KCZHMj33mrVwYQsLb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711592645, "uuid": "cc02d59a-f088-4182-96c7-c044a79b0b5b", "value": 30830726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711592645, "uuid": "d53d9a31-fd20-4eae-b1bf-8dd402e331f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711592645, "uuid": "52685399-5ed8-4486-aecb-3449f330167f", "value": "SecuriteInfo.com.BACKDOOR.Trojan.31932.269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435e284f-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609831, "uuid": "93d580f4-a8e9-42f8-bb82-3e4b4cc5b574", "comment": "Malware payload (AgentTesla)", "value": "d9c87019dfa757e2fa8068e8f7f3de1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609831, "uuid": "33527265-8e73-4be3-bcf7-83f5fa9265e5", "comment": "Malware payload (AgentTesla)", "value": "704f66686e2fda51275fca12b416d9dfd3e4aadd1319d25a053e815e77fbfd49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609831, "uuid": "5d23762e-d544-4229-aa60-37a61df83091", "comment": "Malware payload (AgentTesla)", "value": "3fa0817ab600aaf2b645d64f7d5cf71b27d8733b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609831, "uuid": "d9ecf987-e157-415c-aa9c-f24d8d08795d", "comment": "Malware payload (AgentTesla)", "value": "295c56d5a805ddd579462fb68b5cde01886c06df70edf22c342815cb560ce95d79e57d0cc0b8e6ea63a021da42292752", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609831, "uuid": "cdf92117-82b7-469d-8fb8-4e0935159a30", "value": "T1165533A1817BB881DBD821B6C45E1F158078549E82C560C8FF82EDB1BDEBF4ED98318D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609831, "uuid": "32de73ec-c061-4c69-af6e-a0e7f0317fce", "value": "24576:og4vsHpdRzNfej1M3vEGvua/fprebTQBR6OST5sVdvu6yd/IcyZ/DOySSVkEoy8Q:o3vszf21MLv5F/B8OnVbyd/IblDgPkrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609831, "uuid": "33a46ff8-f0da-4c6a-8d52-920e82ce4dab", "value": 1393973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609831, "uuid": "bdf15731-6f32-4970-bae6-daac43060e5c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609831, "uuid": "cf837243-7894-4f9b-8b7c-7b823ce45a9e", "value": "New Order 3118.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8446aff6-ed36-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652889, "uuid": "b54a78a4-be04-482a-997d-6ce61e6a740e", "comment": "Malware payload", "value": "ab5cc3a661a3ccd83c44bf77517cd525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652889, "uuid": "f61db096-e5af-4444-ade5-5fd390018136", "comment": "Malware payload", "value": "744ed761a0f877dcd3897d0b1bb05c3b3e29a27fc175760288d7f1dcc5d53e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652889, "uuid": "44684c3d-7199-4f02-a47e-701b91ffee03", "comment": "Malware payload", "value": "ec14a74050546603b3eaa8d554bb0abee62c883b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652889, "uuid": "40fb4428-d6cc-413a-8586-81f1fcc508ca", "comment": "Malware payload", "value": "9cab522d881083366dd61746f1b0d51fcf66bbe7e72ae4ffb32cb6ac457f0a380736541f7c0de19833d91cec84e40351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652889, "uuid": "9ca4715d-a83b-49d3-90e5-086d961339fa", "value": "T17514BF2138F1C072DEF75A7049F4DBA82EBBB8625B7181CF1364072E9E212D1AA74753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652889, "uuid": "5b1b1756-e332-4f5b-9a38-f5b2e98c4b5b", "value": "ed049b91044df09ae078744de738246b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652889, "uuid": "b0ae6c64-086b-4188-b6f1-35c07b9924e0", "value": "3072:7Bc+ILXJNWeeDboopH6qtspKXI23B+AQycToDuDvBR45svRvCIzUEND:9cdLZNWeeDXWpKXIwPe7vBRSOCIzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652889, "uuid": "2a29e74c-20f5-4b6d-9429-87d5ff7d1b95", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652889, "uuid": "ea9ec0b5-ec83-4d86-af6c-efb8100741a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652889, "uuid": "6a734d47-4d62-4b77-91c3-066d3352f545", "value": "ab5cc3a661a3ccd83c44bf77517cd525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8625f140-ed09-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711633565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633565, "uuid": "5aed38ee-354c-4973-b984-f32c9ac02e7c", "comment": "Malware payload (Mirai)", "value": "5a0fa8957fddb1182f9a55db61c6f6f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633565, "uuid": "632efcf4-fce0-4bee-b322-050e4550f073", "comment": "Malware payload (Mirai)", "value": "754b49b5b42a0a1ee87c498aec4eb72258f8a2b3e32f0eadf6107970c9771c44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633565, "uuid": "166f2293-9947-4085-8d37-11df29648d7d", "comment": "Malware payload (Mirai)", "value": "201767c0852de755df62c07a405f3a728f8ec1bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633565, "uuid": "d3310eba-fe06-4677-8e07-fb93b288effc", "comment": "Malware payload (Mirai)", "value": "5d10c41da91f5c0294add1a377a6ddaf18f6de7b378366549de650562903f252db50393081da733444c7d488e3e439c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633565, "uuid": "f56c5fb4-ee25-41a4-ba01-a65ce801a216", "value": "T11693742BAB61DFBBDC4ECD730AA98501108DA54913D96B2FF6A4D51CE38BD4E48E3C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633565, "uuid": "f32d5858-647f-4bc0-be1a-9f7473b55282", "value": "1536:PeTDhUlqWmwhs9OVT/obz87qUbkznCZz1V/LNSZfWAkTCG:/gwZOCLg3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711633565, "uuid": "528da5c2-dcef-49af-90c4-893adce2a4c8", "value": 92909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711633565, "uuid": "c3408ef6-58a6-4748-b8c4-da2b28f02b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633565, "uuid": "c34f8ea1-4414-4f6d-b74c-41d999354ea6", "value": "5a0fa8957fddb1182f9a55db61c6f6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768c6e39-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609917, "uuid": "3e73abd3-e8e1-4614-af78-396bb9f17150", "comment": "Malware payload (AgentTesla)", "value": "dd1745650a50384acb3e3d18f640f6ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609917, "uuid": "612b698e-a370-407c-b168-494742979f4e", "comment": "Malware payload (AgentTesla)", "value": "777ffc7e8f61be4b407f8acf15f6338d6a299c8fa89284c62528b0c00d443ae1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609917, "uuid": "ca0b0176-3199-4913-91b3-918c33c3ec60", "comment": "Malware payload (AgentTesla)", "value": "aa7c92503314baf176c6972fb0e9eb69eeac8ce7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609917, "uuid": "50f274a3-0c6c-4a21-b734-67ecdc9a710a", "comment": "Malware payload (AgentTesla)", "value": "166c2c59b80d2c12c072b4585273617a92a43b7d40a2b7269c6583f69c88ff2e4f961c542a1c9bc3a5bbe4bd5222c106", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609917, "uuid": "eae0191e-3400-4d1d-bb0e-bf5b5cbeff8e", "value": "T18EE4238810BD93B99D98CFF3CB8E7DF66052910B9B4FBC6F2215BC2ED5154E9680B058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609917, "uuid": "bf10f613-99dc-443e-b919-a8ddb819946a", "value": "12288:ninWwmPuLCPZs6cygqu3EYgH0eDpTjyLEu3oJDyIaj5LiuR:irCPkyzYgH0iwAu4J1uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609917, "uuid": "9ad0af4b-fb24-49a3-9daa-42caa928eaa9", "value": 701426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609917, "uuid": "64f5f951-17b7-438d-9ba4-f6d924a77733", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609917, "uuid": "94d0389b-b899-45ad-8b8a-bab59971d32e", "value": "302814Q.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f78d6c-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload (IcedID)", "timestamp": 1711642591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642591, "uuid": "323aaed3-293d-4ff6-a49b-892d9c2497b7", "comment": "Malware payload (IcedID)", "value": "22631afc7d9706f566995833748de97f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642591, "uuid": "1c328575-3b2c-463f-a5d1-2987c800db61", "comment": "Malware payload (IcedID)", "value": "79449670340d763f164bbda0a32e38f3d06a2a3b6cee41d92c47f448710e015a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642591, "uuid": "b9098d9d-ac08-4c9c-8366-8ed896d0caa3", "comment": "Malware payload (IcedID)", "value": "f371c5f78437db887f1717b0eaf594295b0f4969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642591, "uuid": "4e0a0539-0034-44c7-aac2-f1ad0b5fffe6", "comment": "Malware payload (IcedID)", "value": "344c49e9d824dadd30e98d4ff0fd76610e19c762712e41a49b4edd3ceee76d471e2445d80c30ee48ea0a69ac6be6c1c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642591, "uuid": "16aaa534-ece0-4292-a65a-b069c0444180", "value": "T1CF721993AD24E8B0FB8B05B00A44212EE3F36926277014F349F744DEEAA2E95746D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642591, "uuid": "cb3deeea-7b3a-4d11-8d13-07b3db7bf3e6", "value": "0e18f33408be6e4cb217f0266066c51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642591, "uuid": "76f9e255-9f86-4243-9424-de588077b793", "value": "96:MMqEESUUhDYXAybZACN3fICtECLi0/r3mvuHg3:MMqr7UhcXAybZBrWwjM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642591, "uuid": "4c299a9e-85c4-436c-a3a1-c733316819f1", "value": 17197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642591, "uuid": "30dd5b7a-03a4-4284-92a8-cdaa8968bc1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642591, "uuid": "ee2ba9be-ecda-4a55-879f-e039c023ab90", "value": "unpacked_svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254b99ac-ecc3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711603338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603338, "uuid": "a8ddba3e-85ec-4797-8986-0454e6140d57", "comment": "Malware payload", "value": "987827ce9a6c25d7558b6e6a8c51295c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603338, "uuid": "c2265262-0faa-4ad7-84ad-6fc6bcd78762", "comment": "Malware payload", "value": "7a239a87c0785429e4ac4b42b826c7157244c565b5b97f0f43272fdbc125ec9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603338, "uuid": "bad95494-917a-48d7-a374-0ff71e98c69a", "comment": "Malware payload", "value": "fce5d23f6b728e5b57a4206f957f2e484c1e1b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603338, "uuid": "92c071bb-d8e7-429c-a470-3d84cbe4bde4", "comment": "Malware payload", "value": "def1d245875be78a0542d60a143d05a43cdff99bcad57669370eb4d1cfc8f1f91a7ed70ca32f80451cf5b431d6054e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603338, "uuid": "2ef3c0eb-5ab7-4caf-b354-eac2dc30fa47", "value": "T1C2573324E2A35FB9DF17A5BCD08B44C6A65AF9A703C5023627F19AC18F543F4441FE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603338, "uuid": "9efcbc98-ad16-4ad3-9cb3-03d28b1386b5", "value": "2bf1fc659e1e270e26d98d8a21b8f037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603338, "uuid": "0a6eb9c8-623a-4ffd-9e9c-f06bf08c1210", "value": "786432:JeWhfidyHjIF5ZySaSYUNFXk269gItWA35QUAilNoSLIr:+HZySlX0249WAJQUAilSSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711603338, "uuid": "0147aea1-cf6d-4927-bc6f-7ee527b640c7", "value": 29686320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711603338, "uuid": "fb968436-d7e2-4fe1-8689-dd105245b910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603338, "uuid": "83a41149-cc62-4805-9a59-4d9fcb9e0b0e", "value": "SecuriteInfo.com.W64.Remsim.A.gen.Eldorado.26269.16542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb9fd09-ece5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711618275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618275, "uuid": "b51840db-78ed-4118-a5c8-1f546f21fb72", "comment": "Malware payload", "value": "98b1b442429c084ac8301af4638ea18d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618275, "uuid": "1d40b9d4-efed-4408-aa12-d3f3b2644c13", "comment": "Malware payload", "value": "7b741ba5f5bfe5a6045f1f19e03f412226c7edb42c6c94a5a92922515da89aa0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618275, "uuid": "c67561cd-8440-4822-81ec-bf03ff1a9041", "comment": "Malware payload", "value": "96aadee715463c50cf22c0a93b5fe1532a058d5c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618275, "uuid": "d0b1a51e-3b3d-41df-9761-b40029e59761", "comment": "Malware payload", "value": "ff99c9955ddeae23de0ebcf36c220d53db12fa1b8d6ab0680ee358bd5797dcdfbe817f0d445eefdfbcba682c4ad02865", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618275, "uuid": "273e3620-3070-4064-ade6-49fbaad27b03", "value": "T16B41D0221BC70364E2F58A399C7AE7419D657C1AEA078E5D0185D78C1C60614EC75F3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618275, "uuid": "f4ca21bd-52ba-4f53-af6f-c6e96a6483a5", "value": "24:8xfJcECTZWiAU6SyLRerUMkWI9wCc5zTS9Zm:8xi4BMyLRerHyEO9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711618275, "uuid": "bea7a38e-e1e2-4589-a44c-672a705b534c", "value": 1991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711618275, "uuid": "f7c0cdcf-7df9-4834-bc3c-f6ef64e2f442", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618275, "uuid": "b71c113a-728b-44a2-981f-d8f2aa63ab48", "value": "Document.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb98dd18-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1711609684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609684, "uuid": "d68381a7-d8b3-42a2-8e11-06027b1430b5", "comment": "Malware payload (DarkCloud)", "value": "c9d631006202c61d834aaa715ea27c21", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609684, "uuid": "aacccf71-9d77-4f5a-9843-63ac039e885c", "comment": "Malware payload (DarkCloud)", "value": "7bafa484df6ca0e7f3990eeb9d536f975568668e3053aa8e1e60d22086da0ace", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609684, "uuid": "d80d03e9-8c88-404b-8ccb-0abb20996b73", "comment": "Malware payload (DarkCloud)", "value": "f99c910569415767e3f3e45027e8dc7da254ebfb", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609684, "uuid": "9c47961a-1388-4995-b907-7e48f534dba9", "comment": "Malware payload (DarkCloud)", "value": "756027b823e89e4561614ae2fd360083230cb63e5fcc5dc67d2dd2e867ef28723ab16cb687f34fdbc730fadcd9c4ccd7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609684, "uuid": "ded1a23f-524d-456d-bd8a-a86ea87b484e", "value": "T1BAC533C77C63E2D3E774DAB1A5ABEAF383264F34C7B9599AC868286131F38600775141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609684, "uuid": "2429521d-0eda-4488-a95a-73b7aa312f73", "value": "bca6eef833a3a9c7d08eeaa3fa5b1e34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609684, "uuid": "388d20c6-6130-471a-9e76-5a1ee6efccd1", "value": "49152:p9amakIPeNL4A+ZtWUCBRLZN3oDWay1wWbchZGB8Tdgm0nOX80GL5NDXLXh:p9rI2NLv+ZtQBRLLomoUMMd0GLXzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609684, "uuid": "c772e2ae-0313-4696-9a48-aa77cfdf4c50", "value": 2621152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609684, "uuid": "55af877d-d754-45f3-9bdb-f242f154c929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609684, "uuid": "d6997f24-fdd4-4994-bf78-f5cd23b36817", "value": "DHL9407155789...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d5d0fa-ece1-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616299, "uuid": "60fd454e-5e76-4214-99ae-dd686c58ff25", "comment": "Malware payload (Gafgyt)", "value": "b6a5fc32f25be406eaea4e70c6a92297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616299, "uuid": "1a35865e-7b90-4177-a640-200830525187", "comment": "Malware payload (Gafgyt)", "value": "7c417bf9b48f7f65225f31bc6be7118b050ba51a7524872f83a0270f140d7232", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616299, "uuid": "9e6cad81-9495-47c0-b133-b0ce7bfc99b1", "comment": "Malware payload (Gafgyt)", "value": "da4de1919361615df33067d284483ce961fb3c5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616299, "uuid": "d5203438-9ca4-419f-a981-2b8fa1b6078c", "comment": "Malware payload (Gafgyt)", "value": "b49eae6c6ac0924124999af91d782815b0ea22bec43713d95563ff9110d3f3fe48dc1d4340ff80954d07cfdd8bd74aee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616299, "uuid": "8631430b-b88e-4034-8c0a-a2b45bce5e9d", "value": "T1B2A33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616299, "uuid": "c31d88d3-4eab-4853-b447-115dafc7e9a4", "value": "3072:24obK0vGayP+wIgGmWrkzMPE+mBQO/IXZFW:24o9Ga2IgGkkE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616299, "uuid": "e70a8df2-4255-4591-969b-e25d81b5d8b2", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616299, "uuid": "ff04b812-eca0-4b7b-9ee2-c29755f0cceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616299, "uuid": "cf8a302e-c4c6-4e3b-b8ef-95f039058a8b", "value": "b6a5fc32f25be406eaea4e70c6a92297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefc06a7-ed3a-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711654813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654813, "uuid": "e84562c3-0b9d-4687-901a-74bd342afa3e", "comment": "Malware payload (Stealc)", "value": "07b1d310e45847d0badea747583bc17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654813, "uuid": "de91da76-0c95-4980-8a2a-5360f29ae60d", "comment": "Malware payload (Stealc)", "value": "7c8f7e7e7ab86868b082d4c21bf4d02da7c337719c143cc606dadc2cede8c04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654813, "uuid": "84f44393-04ea-43fa-a378-653aa60c8481", "comment": "Malware payload (Stealc)", "value": "1fee7cc0be9688e24c43d11884a54f18e4b8df04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654813, "uuid": "835329c0-0868-4cd2-85c1-352765217dd3", "comment": "Malware payload (Stealc)", "value": "27d3e791dd6876b7e80dd3470cc3f7e833e89f7d4e0bce4ce2a57e88c53fe4868e2afdc2e8be69ab52565f7bb078f568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654813, "uuid": "438c1791-f4e0-45b6-8fda-6eb21ab4a5ee", "value": "T13F44BF0176F1D074F6FB063248309A555A7FFD73AAB4895B33A4278F1D702D09A26B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654813, "uuid": "b7497ed8-5073-483b-9c20-9eb5b0df5e33", "value": "1b67119179f8385f294929b38dacfd5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654813, "uuid": "af87f0f4-03d6-40d5-a00f-97ccc8e7e43e", "value": "3072:qXGdItpZ9Bu98lnO6++dd3Exg6IRLIBuXlwXDTNe8U8z8YmT/GK3Zk:xCvZ9BZHnhlwDwp689T/Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711654813, "uuid": "6c68ca85-91d3-49c9-a9c3-a772dad5f4dc", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711654813, "uuid": "7c63cbc7-2553-44de-93cd-ff0c7a198692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654813, "uuid": "fed2fdec-a28b-4109-9300-1b11338ce407", "value": "07b1d310e45847d0badea747583bc17b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27f31dd-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609668, "uuid": "b14382a7-fc95-49b5-94a2-4cb4f0af38e7", "comment": "Malware payload (AgentTesla)", "value": "f13d05cc8f19fb8d9dcf20bdadbb9958", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609668, "uuid": "64c09539-ff90-4d15-8d5b-9ee15e5aebce", "comment": "Malware payload (AgentTesla)", "value": "7cb01a819ef47af0878b8038ec24e06a2a659d9891c3b39d4a0f56a2578d21ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609668, "uuid": "29df0f94-fa61-40ba-b99c-885eefe18a0f", "comment": "Malware payload (AgentTesla)", "value": "5beecbd5390b513c84db858b9a446ced0c9b344d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609668, "uuid": "4f0eba0b-6189-4821-a134-668358f8db28", "comment": "Malware payload (AgentTesla)", "value": "71a9772696298b1b2ffa19750bc217a6d781e984b76ebcc3a4989df59cec60d7736800fe67b3d934d39a2da572fd7cee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609668, "uuid": "4ed7d95f-3a39-427d-b346-fa7b5db2cdc8", "value": "T1B935BF0273D1C062FFAB92334F5AF65157BC69260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609668, "uuid": "42273e16-f326-41d5-a592-651d89f0ef40", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609668, "uuid": "0b6f2bc7-c271-4627-9920-9c0a67e38cf8", "value": "24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8aCauTz9lCW9+b:HTvC/MTQYxsWR7aCBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609668, "uuid": "f182a51d-23e1-4642-85a4-83f503ac42a6", "value": 1135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609668, "uuid": "1b027bb3-90b0-431b-9b6b-e5ae1ebcb5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609668, "uuid": "5c89553d-08ec-4d95-a6d6-254f7d51be20", "value": "Factura Comerciale___DHL_BL#6797986766768978097644685456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e290f19-ed07-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1711632505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632505, "uuid": "dca48b97-cd3d-4532-a36f-a2e1b599af51", "comment": "Malware payload (njrat)", "value": "adcc598af7caec5a2b261c869bf784b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632505, "uuid": "a0480028-2aff-4b28-9f4b-352276ca4c07", "comment": "Malware payload (njrat)", "value": "7d623dcdebf0992732101afeb5c3821ca95e297b2992aef9c16ebb44aa6c47b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632505, "uuid": "bb69e9b5-29e5-4a56-a2de-1f0108a07092", "comment": "Malware payload (njrat)", "value": "55eb16719270a3bf2755f1d3435b09078838c49c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632505, "uuid": "77f26b28-5266-49b9-87be-aa650ef04a2d", "comment": "Malware payload (njrat)", "value": "78f9ed86dfc0f910a9d9069ee8adc6fa11f8bb8dce95792ac46b0e7760b2ad336fc2a18b82b7a6bbb90dc4946a166d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632505, "uuid": "0f542f4d-236c-4cae-8148-7ec4101c6ff2", "value": "T1F5253377F832E86ECA60CC38632764EE7F2F298055E9F0B52D607566CD725029DBAC14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632505, "uuid": "c77cc738-a346-44a5-8b75-c3bae86c4803", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632505, "uuid": "f2957bce-dab1-4325-9cc6-ecfde04d497e", "value": "24576:n3qKdgSMzbbnNEvizbKZiiwt3Tggzbsye5HMPKZ2W0gXKXJ:naKNMDNqizCeegPsye+PKOZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711632505, "uuid": "3d68a64a-7438-44c0-9c3d-5496d9dda1f8", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711632505, "uuid": "87c1dd61-a09c-41b1-a8e7-828562b4e124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632505, "uuid": "c96d4ea0-4d24-488c-b765-6955c26785af", "value": "SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8beaaa-ed0a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711634166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634166, "uuid": "41cee856-09af-41a2-bdf4-810c3d66ad4b", "comment": "Malware payload (RemcosRAT)", "value": "f8648f41d4459440acbbb0c05eb5a77a", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634166, "uuid": "a20e8bbc-f8ed-43b2-9328-5b8aa64acc0c", "comment": "Malware payload (RemcosRAT)", "value": "7fc3cc71009fe5cc07ec9991020ed252b2588b69cfebc7ae5181e39c63073da0", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634166, "uuid": "3533f36d-c444-490c-b363-0027531ca3ee", "comment": "Malware payload (RemcosRAT)", "value": "fd7b8663ea0f6fa8bb8235751cf5cb6fdbb7feeb", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634166, "uuid": "ed13edfe-c42e-48f9-a73c-1ba199ce5068", "comment": "Malware payload (RemcosRAT)", "value": "637af888bf672150c0cbbc0585916f9a7ff695fa94283942a12dd587ce0998ae8f73e35e06dc1e1717fed098b068ca26", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634166, "uuid": "020617e3-edac-4b5e-83db-e57d1a822e13", "value": "T1241533015FE4DA210ED0E1FC57C96AD170CDB7A18AFD823E4C4D64FB5891A988E17E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634166, "uuid": "064e6889-4219-4bbf-a2da-244d4bae3c1e", "value": "24576:XyzsCL9b7s++GW18y/1hmUsCBH+DCNiUuCm:XyzHbY+U18y/1hWweDCNECm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634166, "uuid": "355de154-04cf-4e27-9ae1-a80aa0347a9f", "value": 921438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634166, "uuid": "45dc856d-14c2-45e5-b59c-a7b7948901f1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634166, "uuid": "52026267-76d1-498f-b45f-38fdfb6b65ac", "value": "Document 20240327_1188908_1188909.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db18736-ed12-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1711637390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637390, "uuid": "a59c57eb-782e-4515-a1a9-c8bd3af6f1af", "comment": "Malware payload (Vidar)", "value": "aba4db269a810b878f86ffabb47ca06c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637390, "uuid": "a9281395-5bb4-4784-9316-ef102c43c949", "comment": "Malware payload (Vidar)", "value": "8322608c6f06c924458946685ff76fd1a4dc676e4cab3acf1312fb9ab5143bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637390, "uuid": "5f51c74d-84e7-4e73-a941-24510552131c", "comment": "Malware payload (Vidar)", "value": "d141ffdd0842ccbe7e471fd84d2dc0a64b4a954b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637390, "uuid": "778ac1f2-7f02-4ae9-bb47-264d05cdc270", "comment": "Malware payload (Vidar)", "value": "d1ee45a616c294d2ea7ef73035fefbf3fd946e29aae85ca506b05841435d40f7daa1baa6331513836b81c4b3df87b4a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637390, "uuid": "dcf38e15-c284-48de-ab26-0f3eb7e9dcbc", "value": "T10F2412E457E8CB12C996883125A4E751E87A434F31D0C18B355BC2A05FAA3DBDFB027B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637390, "uuid": "3120e318-9112-47c7-9088-33a0ca9512b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637390, "uuid": "2a9e751e-19a0-4ccb-9d5e-d256c953478c", "value": "3072:fx/loYA7RGHfvz9Qd8TSh3e0gc2Fk798FoCLP/SFpn4B9MgVCNu2WxyhvXED:pLA7MzSd3e0gcmg4oaW4Xdxym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711637390, "uuid": "00bd113c-e80f-4d8f-8a05-6c1ce6b6b6ea", "value": 229512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711637390, "uuid": "7de92e4f-b740-4011-be5c-144de67db86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637390, "uuid": "4a80b027-6938-4a0e-a3bf-6994f21be5ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da87de45-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1711617815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617815, "uuid": "46ad964c-1c82-48f3-a318-d8e6ebb7473f", "comment": "Malware payload (CoinMiner)", "value": "246a9ee58dee68350e99d200bcb41345", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617815, "uuid": "def899f0-c115-422d-8d65-dce07b99e41f", "comment": "Malware payload (CoinMiner)", "value": "837dffb54752ca9109578cf3037add8ae8513839fc090245c15e674687ba438f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617815, "uuid": "b71231c5-72c8-4bb5-88e7-b00c44e95511", "comment": "Malware payload (CoinMiner)", "value": "69dbab3a1238051001cb773c871c5aa9dad44641", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617815, "uuid": "f54675ff-b885-410a-a1e3-8fa48ea2315d", "comment": "Malware payload (CoinMiner)", "value": "25c6b394c91581fb8e4f8ec0e0cb7511dca62460274fd1d22befb220edec8410fb8e39b0bace9588aaa47778ad94df06", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617815, "uuid": "8e7c1fdd-c374-44cb-998e-5c2431136cfe", "value": "T1DDE52209E7E908F8E4B3E63899574906E7B73C494331968F23AC556B1F63790CE3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617815, "uuid": "d3784314-21a5-41ca-851d-b1cb59246eb3", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617815, "uuid": "c5f3e781-dd5d-4aca-bf44-6925917a0de1", "value": "49152:jaXgTLETjo8OGkZ+Hj+g0jNgIUMsxYgg5+oX0P3l2z6pdX/+44DJJAKTdo:EgTOUpvjCIftkP1k67XDYbdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617815, "uuid": "6d9b9ed6-289d-4fb3-b8b5-c0b0acb671c4", "value": 3265880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617815, "uuid": "b1cee208-a61c-4102-96f1-b844784fcf44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617815, "uuid": "db911059-6d70-4a66-8185-b512aacc40f2", "value": "SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8068d3-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711630675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630675, "uuid": "cccda10b-484e-46ea-b0ef-a52ff0465584", "comment": "Malware payload (AgentTesla)", "value": "73f2aa0989d9fcb98763fbb461422f9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630675, "uuid": "07b882a5-4623-4d2d-8f18-7982e0ad0930", "comment": "Malware payload (AgentTesla)", "value": "843fa4dd9e5d81d150e4d6cd251dc26dafc7409bb4516abebce70114c62548c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630675, "uuid": "d5dcb4f3-9dda-4464-9f8a-1217d688a979", "comment": "Malware payload (AgentTesla)", "value": "27b4d0302c43e95c19942eea9dea94d673e18578", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630675, "uuid": "7c785202-0c3d-4db7-be41-4e2f62b299b2", "comment": "Malware payload (AgentTesla)", "value": "505670ad6adf4a959062d4c34d7d0f9b215b16366f5bcc6959b0563def43f37d7e36eb6ae47bd281d0a3091c9a30a956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630675, "uuid": "e77d0409-c9bb-4bea-8443-4031ae657789", "value": "T15DD59E62668E45FCCE4A6B3AC29F66012BFDD1C10773C75F2D1A362B388335BD90549A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630675, "uuid": "21f94e04-6859-45e3-a7c3-71b4e6fd9475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630675, "uuid": "0fbc7cb3-08de-4065-bfb8-66fcc609de5c", "value": "49152:A7XLm8xI2nCY8EoVZT6JGsBp0PWInu9vxnBoqdWGJa/3HWPWar:mbmJYpoVwlpuWX9l3a/3HMWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630675, "uuid": "2103b5a8-e3f6-4542-b5ed-d31714a67ace", "value": 2987520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630675, "uuid": "bd415704-93f6-4a02-a996-388fe652366a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630675, "uuid": "06716665-0242-46aa-8eb5-297c2918a0cb", "value": "T_240369_S\u0130PAR\u0130S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de33864-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1711616667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616667, "uuid": "bf276eea-b19b-481e-90e3-8ae7b29a7245", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "8d8a71724e4a24319285ad58bf802dc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616667, "uuid": "6f5a59b6-d00b-4f66-9823-edc2ee309d5a", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "847c63e04f33c4dbd37273ef7158bc8b2570f8ba54aa008ca6aba67089d0836b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616667, "uuid": "88d9b720-ef72-4be1-a89e-f464eb014ac3", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "293eaa03b9ee692776ef692fbd3eab594b714cd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616667, "uuid": "2883cacb-a503-43b9-b92e-486fd5df147f", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "870954aa65fc110969d0dbc8bda0a00b6ef254542724d4a16398e4e446bc0e886ca34b6ab0d581734008dad0d5610811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616667, "uuid": "690a4a22-e77e-4dd6-8448-47f5558a3da9", "value": "T1FDD4F13372E1BC20E5B34B33ED3D9594263EF9528EA96B5B33145E1F14701A1C66AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616667, "uuid": "40b1c722-3229-4d0c-8869-243cc62e4dd9", "value": "d6cc7eef7e91d5b40575c3542ffc17dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616667, "uuid": "b882675b-b750-4cb4-91bc-a55d7cfde3f1", "value": "12288:4b90qFhhqVeMnVUkP4+up5UlT7JxvvZ2ve:wFvqVb4D56TlV2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616667, "uuid": "5d9205a0-8cf2-4db5-a7e9-89347ab3aea5", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616667, "uuid": "b8a24557-f430-45b0-ae78-5dfdb00dbb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616667, "uuid": "b58bbad7-d653-44ad-ae53-f233816ebaa7", "value": "8d8a71724e4a24319285ad58bf802dc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481e2e54-ed0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711635609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635609, "uuid": "7f14b2c0-8b7d-4cba-9335-930755c4a22a", "comment": "Malware payload", "value": "57181a2117ca742bedf33946fb8f0e64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635609, "uuid": "5a82a004-9609-4e1e-afd8-7144c5d3528a", "comment": "Malware payload", "value": "8585b58349f83c4a93b8c61d764a392a63283c383ce1ae6009f975b3779a140f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635609, "uuid": "0da2c605-55ea-4080-b5bd-341b36cc5918", "comment": "Malware payload", "value": "1e74053f8f6a12fb3010da80da81b1eedff6ef6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635609, "uuid": "9497ad08-1c65-45e7-b012-3acc3fc09d14", "comment": "Malware payload", "value": "bcaf87d10389ed0cfcd0920da66a21c5f9cca1d2700caca40ebccf65265558583eaf87d1c20260bc42ec6f508af5aadd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635609, "uuid": "6645c591-38f2-4eb4-9f86-36486cc01c78", "value": "T1FDC733803E1C8C83E8926D744F33F25AC410FED5A8EFA6185EA1F9405DB5593A6CFE61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635609, "uuid": "f1eb94bc-7cb6-45a1-aa87-c766a1c77d0b", "value": "30f8d55e3bbae2055b382e82a31f87b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635609, "uuid": "45683c99-6d49-43aa-814c-3ab2102767fd", "value": "1572864:GvVzw1Wt/SrzuA7XYAu+FVl3HPNXQ52syxbXSEK:G1w8t/21XYAzFVLQ52DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711635609, "uuid": "4bf6df46-acb4-4d80-899f-a934d19a4400", "value": 53014688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711635609, "uuid": "dd811d05-9b6a-4040-9e02-bf833bfd1764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635609, "uuid": "c6720c2c-7b51-4260-9e78-218d7735b0a1", "value": "SecuriteInfo.com.BScope.Adware.Hpdefender.26729.7840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745d9a22-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711639119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639119, "uuid": "7a5a6517-b2f0-4d62-a0bd-d43afb59218e", "comment": "Malware payload", "value": "b341ac1a1a31d085c9ffdfd4b83c88b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639119, "uuid": "ec428ec0-a2b2-4e39-af65-7de98337dc93", "comment": "Malware payload", "value": "85962530c71cd31c102853d64a8829f93b63bd1406bdec537b9d8c200f8f0bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639119, "uuid": "18feebeb-f62f-48cc-97b2-bfb924bb9b2c", "comment": "Malware payload", "value": "d6b65528e706585bba33060ef36b15c41c7c38db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639119, "uuid": "d5726d5e-07cd-4217-9911-83eb03b7869e", "comment": "Malware payload", "value": "4b8130dd26cf431838f77b731ecc081ebcb77b5afd59f72860ffc425bf3cc8edf241a881618222bf43c9e36f281b22ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639119, "uuid": "8656f274-7be2-4567-8b96-dd6a0f176eef", "value": "T115C59FC182280FE8F9785E3F09BA7F094990FF676931ADD5C98632871516AD3353A60F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639119, "uuid": "c6607a8a-e5ef-4d4d-b7a4-ae46c1ee8b51", "value": "26f4f67365f06634a75f1091bf385238", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639119, "uuid": "4b552813-859a-407b-b287-b88673561e20", "value": "49152:1LL6Hv9yLMogF6ksKp1YZ3nF1+m2DkqVnaIYdN:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711639119, "uuid": "95c75d7f-8848-492e-ba8f-58281171cd4a", "value": 2650112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711639119, "uuid": "f8b655ea-e4ee-4cac-b771-f25baa0c8051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639119, "uuid": "fad1d9fb-d6ec-4565-ad26-feefa88a6fd3", "value": "85962530c71cd31c102853d64a8829f93b63bd1406bdec537b9d8c200f8f0bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308ca708-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1711610658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610658, "uuid": "83fcabf3-472a-498d-aa4b-90366e36928b", "comment": "Malware payload (zgRAT)", "value": "c66b1f6942762649c44bca726995a227", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610658, "uuid": "a03a4a8b-5d2d-4bba-8a54-4eaf53a99557", "comment": "Malware payload (zgRAT)", "value": "859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610658, "uuid": "d2c0c154-2532-4e20-bf53-85d93c1a49a8", "comment": "Malware payload (zgRAT)", "value": "d22eba1dd78f3ab676afd3442a4b2a24c9342bf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610658, "uuid": "fec1ac50-877a-4eba-8f4d-cc1df8a3ebc2", "comment": "Malware payload (zgRAT)", "value": "d9574c46a44a404c6440ed3d388f69fc261d28f42095b8b8411bc7a45792e41521a72c318861131da358a53ebc686067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610658, "uuid": "7f47d8a9-8d8e-4859-82a6-26db375e5de3", "value": "T1DA269E12BBD4CE11C0AA2A7BC47225045BB0EAC7A723D30EB6A573BD1B537354D87687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610658, "uuid": "a46e8342-4ad5-467f-86dd-ddd9ad915b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610658, "uuid": "de1e3af9-6858-4f7e-a55b-df340eef84f4", "value": "98304:AaHg3Vqv+AigbRik7kZ3srMw2FX+qK60L:AaH0VqhiKj7kZ3U+FuqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610658, "uuid": "5c0abad8-4225-4fd5-b4da-b325dda82fbd", "value": 4746080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610658, "uuid": "2c5c74c7-146e-4fa6-9d16-7a7cf0941d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610658, "uuid": "21f2f708-73e2-4dfb-8501-0ed39659dc41", "value": "c66b1f6942762649c44bca726995a227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42733cc3-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711639035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639035, "uuid": "d200c68f-5734-424d-ae0e-83b23b022496", "comment": "Malware payload", "value": "f477f5fbc95bbde03a24cf42f6751afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639035, "uuid": "d7f7fbac-951a-464b-a136-427d74dc6e77", "comment": "Malware payload", "value": "85b1a980eb8ced59f87cb5dd7702e15d6ca38441c4848698d140ffd37d2b55e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639035, "uuid": "07c08965-2ae2-4c1f-84b8-63f032ab3c46", "comment": "Malware payload", "value": "ae5a1b7a21fecf571d037baf85069d5b58b107ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639035, "uuid": "94682230-9b3d-4fa9-9729-bf6bad0431b7", "comment": "Malware payload", "value": "725dcc5f7b94fb73b285f494f1fd33fec106011a451dd907269cbb592126375846615a926321fc95841635bbce8f2c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SILENTNIGHT", "colour": "#34C149", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639035, "uuid": "9037abff-9b5c-4ed3-a80d-4b58bd9be22a", "value": "T12AF3B547A16760F9D6BFD07996933626F9A134504334AF6B86408E231A33F70F63E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639035, "uuid": "1a4f6154-c93f-492e-a70b-c7bc10a8cdcd", "value": "18ecba85a4db5cb9282cb4f36e09b31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639035, "uuid": "87cfd596-6763-4560-b428-857d603ad354", "value": "3072:M3sTSNgdIE4jneWJjxzRTLwlCTYhoDWmdUD2LH0kQhHMzJ+2ZedIcgQ7exgwt:M/e46AvTkmioH0kSwOb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711639035, "uuid": "5c68993d-0214-4aef-a374-da21d63ad48f", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711639035, "uuid": "ad3e8537-1315-4af6-a31a-bf9695d010de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639035, "uuid": "86aafb5a-e76e-45b9-8935-4cf291d4f733", "value": "85b1a980eb8ced59f87cb5dd7702e15d6ca38441c4848698d140ffd37d2b55e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec369e-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638955, "uuid": "cf25283e-e166-4d47-9843-8c99959ae096", "comment": "Malware payload (Mirai)", "value": "5c40897b7807cc8039256ed5b9a55470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638955, "uuid": "db72845f-4374-4d29-aa1b-cb67a56c800d", "comment": "Malware payload (Mirai)", "value": "85ce7789945cd9e748c8fc335b90a6f9ddc17ba8062f34594140a878e4b6176b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638955, "uuid": "67a06ed9-d8b2-429e-b5e7-80e383b0de29", "comment": "Malware payload (Mirai)", "value": "224cf0afc2fe15b24527de3889c7d050dd0d4eb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638955, "uuid": "38a54a92-e8c1-423b-a1c9-d5a07a779f2d", "comment": "Malware payload (Mirai)", "value": "91c6846e35de4010868b75ce043800eea9f2a1a043363053fb32aa996e5c7f84f4609f2b3d87d7796c4a93c0fae6090d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638955, "uuid": "25c411ce-d69e-48f9-a299-529d4217aefa", "value": "T1E753099FA72C0797C4DB55F03CB737F08B6EB9A012950188A206EED50763BB4A416F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638955, "uuid": "620059bf-9c40-4616-a5fc-5b0e35f08901", "value": "1536:H81QbWSmpEAcz7ul+a3QRAopupnI0YM89WG1:HEYT7/aSAo8nI2Il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638955, "uuid": "a23aaa14-1574-41da-a3f7-9835d16cdfb6", "value": 66115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638955, "uuid": "4fdac971-673d-4862-bf16-0efc3302ace3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638955, "uuid": "adfb42da-b725-474a-9b85-92ba55fa0df0", "value": "5c40897b7807cc8039256ed5b9a55470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a961367-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609816, "uuid": "6ae9e683-90e7-4366-b708-4407ec55a7fd", "comment": "Malware payload", "value": "e958bfaef6c71323ef996bb6cd333159", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609816, "uuid": "8b60ddcd-d6d1-4664-b11d-36f60e154a1a", "comment": "Malware payload", "value": "85d66d578ec31975ab0989c082112dbab161a589cc91903efb777be8f9b7c25f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609816, "uuid": "df9a50a2-d384-4ed3-b615-09fac68c1f2d", "comment": "Malware payload", "value": "cc52f4bcd03a573c9d34506a6cfd0d122b8f3665", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609816, "uuid": "e4490929-cf64-41d1-9cdc-782ea4149578", "comment": "Malware payload", "value": "a06e665a85272ef47a87f0ed3c985ba0abde1b6291ca23811ad951d33f0825001254a1109098869a17f7e2fd6facd581", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609816, "uuid": "e64ddc71-bd36-4052-89a5-c2ece508f62a", "value": "T179010E0427F7DB72E263833B0833B726CB10B512CB209B7D414581A90CB6A08EC3AF57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609816, "uuid": "40bfe668-d5c9-4afd-bdd1-38ce4f4d8db2", "value": "12:8+6daL8ME/GjMgN3VmYjAr/b4hTClDmIfcoIcOmKC:8+6ufVz5Arb4VC4I0fmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609816, "uuid": "5f593b04-b9aa-424c-941a-698c3b6d9986", "value": 685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609816, "uuid": "d668491d-9a28-4178-b2db-783f0a5bebae", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609816, "uuid": "be104fc9-21b6-42f0-9778-482529033613", "value": "order_receipt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e9b5d6-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609907, "uuid": "f197000b-dbb0-442b-8c80-f485a65a85e4", "comment": "Malware payload (AgentTesla)", "value": "9300a9eba698df3fa841738aa1ee2153", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609907, "uuid": "18de795b-3193-450b-8af8-c1f8d503854c", "comment": "Malware payload (AgentTesla)", "value": "86e6cd3d2fb55232cbac7aedf7a0078eecddfece6dfde4e6566216a057acacfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609907, "uuid": "fe6a6893-2b03-40ad-82af-10238b447b8b", "comment": "Malware payload (AgentTesla)", "value": "cc76797e0fb68f86bfc3b509e0fb25b66e666f84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609907, "uuid": "d818ad22-93b1-4c22-84ca-cb4cf59b03d5", "comment": "Malware payload (AgentTesla)", "value": "931382f4863975624a14a415c8053b6e15ff2a844ae1421b5814233101b60efe903597802aca200162bae78ccb507f53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609907, "uuid": "14bf06e6-1b71-4447-a217-a01e146c20e9", "value": "T17603FCD3C9862B954A471BB7EC12DB334DFD015873330A72A37A8B0D680365949BEAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609907, "uuid": "adc077e9-b614-41e8-9747-ddbcba7772f8", "value": "768:u0zgB8X2WAZGc8NnKwiQwR5T1dPA1aRtg:4+QqNnKwY3BK1aRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609907, "uuid": "7fcf2f51-2300-4961-a6fa-c863f060b8ce", "value": 40286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609907, "uuid": "3faed9d6-5fb1-4ffe-a4f7-468b8da91928", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609907, "uuid": "4f5d9a58-e127-40e2-aa7e-15563a65f559", "value": "RFQ20240327_Lista commerciale.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735cdde5-ecba-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711599603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711599603, "uuid": "dd0b3972-257f-43d7-9299-370436441836", "comment": "Malware payload (Formbook)", "value": "eebb33a5375ffd40682c86deea752033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711599603, "uuid": "5656cf0a-0b4c-426c-8570-be66d948d1ab", "comment": "Malware payload (Formbook)", "value": "8859d68e69b5464a0100ca99aed26dec828ae92287ce09ce984db073c66e8e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711599603, "uuid": "a04b2f57-f21b-4e61-93e2-fa9ec5f51c06", "comment": "Malware payload (Formbook)", "value": "8ed7b849ba2829a164ee569995f2d4d8a8d90924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711599603, "uuid": "e671c0f3-bac7-4230-b637-3905fbf193ff", "comment": "Malware payload (Formbook)", "value": "4f2eede0bf5c28213321cb29afe3d87d687789c94b032d1f5328ebaeeebe6b2ed10765fce3a1e56bcbec912e9555271e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711599603, "uuid": "304f8aac-3e36-41d5-b369-526aec7afca4", "value": "T131D4230077F9A312EBF657B2396124408B37735BA5A5E71C5AE690CAA8F0F008751F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711599603, "uuid": "b8173a6b-27ae-41a3-8cba-53cfc5e9fcfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711599603, "uuid": "2c8bf09f-d508-4bbe-9146-0d81fc55563e", "value": "12288:DK0YOwqVT+BnEymdHekIrOuPhKPrbgAoOxCzSb0c6gb/wM4IKkR:DqO7VDVdDIrOusrbZoGWy0c9wM4IJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711599603, "uuid": "2ba4b834-7656-4c47-a27f-c8932766c0db", "value": 644616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711599603, "uuid": "d6e4f6d1-eae5-464d-9987-9379a5d21f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711599603, "uuid": "cdc37d1c-3cd3-480a-b944-561967378cd0", "value": "SecuriteInfo.com.Win32.PWSX-gen.21551.10154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287ddbc2-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616658, "uuid": "f95bbad4-3616-4469-b14a-f98dfa5b2bc0", "comment": "Malware payload (Gafgyt)", "value": "abf9e2f627b7433b2165a3c38c00a21c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616658, "uuid": "5cc3dab9-0bbb-4e5d-8ddf-39e81092dc6b", "comment": "Malware payload (Gafgyt)", "value": "889994d2d3e86d354d45e1afa69a916718cff9127cb609bc028336481fac37bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616658, "uuid": "114550a5-8019-4e9e-b472-7caed7570c7e", "comment": "Malware payload (Gafgyt)", "value": "49b9f49db511172002a18724219b3ea4a08e2291", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616658, "uuid": "740cba2b-5350-4fb3-b021-90ca4bb3df66", "comment": "Malware payload (Gafgyt)", "value": "68d0cf943658a70cb549cf97c91ad1f29cddc520180317fe491e4ec9b838d518a256504e6ee1fe6680da7c6e46ea4d2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616658, "uuid": "b793d870-fec6-4588-879a-ed63c2f124dc", "value": "T1D0A3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616658, "uuid": "5b0384b5-f0f6-457c-923b-0e4087143976", "value": "1536:27j+1TjCq+LzIfm2rKsnmCYy6rfV2D3ne82bS1jxlrimW+zWBSirHzai:BNHQymd2D3x2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616658, "uuid": "9deac0e2-33bb-40ac-a39f-16e361d27a9f", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616658, "uuid": "a8e6ca9f-fbd0-4d94-8b32-6c0b500d6829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616658, "uuid": "73613a4e-2791-4cbf-a97d-691bc7c8c6d4", "value": "abf9e2f627b7433b2165a3c38c00a21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4024b9-ed0b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711634354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634354, "uuid": "2c542278-638e-4aeb-b2df-87f19edef23b", "comment": "Malware payload (AgentTesla)", "value": "8d7bbdce1886333961594b60339584d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634354, "uuid": "6a0701a3-fa11-4dd4-9c5d-af306a669b73", "comment": "Malware payload (AgentTesla)", "value": "88cf42a6c3e0ee64dc8be4743b5427fb74d26c30964415e5c9921f80063b8107", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634354, "uuid": "6f8ba800-b10a-4593-86da-83c143a93d63", "comment": "Malware payload (AgentTesla)", "value": "728f2324e4bdc29801a8a93cbe113c7f11c9310c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634354, "uuid": "b078d4f8-ace6-4f24-905b-3ccd8fed6194", "comment": "Malware payload (AgentTesla)", "value": "af201427cf2b5a68860064fbd281bfadf0b05f9031648288fd70865ad53b943f151a1bcbeb33562a9a12b98e04f4e366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634354, "uuid": "0335357c-1941-4093-a621-4b991f605260", "value": "T1E4E423BD1D0E4B73ECB67111C8E9C8B14C0096E578224E530BE2979AB0F5A235F2B273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634354, "uuid": "3d0b9729-ecc4-45aa-8101-42f43e9116a1", "value": "12288:KlOhR8diQprqqZ3UDNO8kHsgtCGK+2NCM77+fffqIql9HJSzKp0hw:4xiirR3U52HsgtCx+2NR76fnqtHJURhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634354, "uuid": "267222f2-ced0-4d1c-8e48-cc78c68d4020", "value": 657765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634354, "uuid": "49ab39e5-f550-4164-9ec9-eec103d42b87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634354, "uuid": "68f1531f-8462-4633-9aa9-ebcbc441d6eb", "value": "COPY_SWIFT_$17,800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ad21c3-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651127, "uuid": "1e70d661-3d28-4561-9830-7e912445cfa1", "comment": "Malware payload (AgentTesla)", "value": "e886fc4734fee8c0445802549df61e16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651127, "uuid": "2ea6c3ec-0ee0-44ca-b3e3-8056edc97e39", "comment": "Malware payload (AgentTesla)", "value": "8a54d486d4b795af1b8f7506dfa69e2e9fc298a361521af183cb9809cdc3d68b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651127, "uuid": "3a9f1d75-0cf6-4c12-ac1e-bf640891eb91", "comment": "Malware payload (AgentTesla)", "value": "373856ccf95b0aba82a3bea3066fcc657046d78d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651127, "uuid": "8ddd370f-2623-4911-8948-2a585b2df503", "comment": "Malware payload (AgentTesla)", "value": "adee1bf67a66cd6198be458cbef4b9cdd03972a62842329e75aeb809138f19c624539a8e82f607c600c62fe287345839", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651127, "uuid": "9f981148-5cd1-4683-be31-1f5df39bccaf", "value": "T118E4122236E99B15F0BF4FF21930904513BBE5A62951E65C0DCA60CA2C77F41CB92F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651127, "uuid": "6139225b-6cb7-464d-960b-0fea98a3be44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651127, "uuid": "19d387f0-57ec-408e-b42e-965a226ae243", "value": "12288:O/H30YOwqOpJWGEDC2qlHcf1LUTEYct5gWgbrWN3DrSD0ZrTBCu7VzbxTstF8:iO7MCDA2W+JgbrWFDW0ZrTT7Vt0F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651127, "uuid": "50f9776d-2912-4c0d-9331-80e1d3adeb14", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651127, "uuid": "499467ea-5408-4365-b390-bd7becf4658c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651127, "uuid": "e5deb229-a498-412f-b256-6d2d19b26900", "value": "Dekont-2024-03-28,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a6d0b9-ece8-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1711619250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619250, "uuid": "f3361669-9b4e-41f1-b0cd-3f0c635732c6", "comment": "Malware payload (Neshta)", "value": "082d7fdbe00dd66d177576489dda7e97", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619250, "uuid": "edbec91a-385f-42f4-a69b-c9c48a5ab2a8", "comment": "Malware payload (Neshta)", "value": "8b256bc239f9b12c41017e1e0e5c97324a3b78ef9053aa0b2e892c93e64068d9", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619250, "uuid": "5d8a1f83-d71e-46c1-9d0e-0d754e38bfad", "comment": "Malware payload (Neshta)", "value": "eb28a7483a76c57097016f59d1d42cb2d54ff048", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619250, "uuid": "8ccc1c1b-a442-44a7-b51c-8e72ef702fe9", "comment": "Malware payload (Neshta)", "value": "9069faa47a7e00e5af230a0eb0ff5d73a3fa08a2c892cc5d71597d5e4affb44d3066c63fe2b08c3ec0c4759ed1ac8e37", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619250, "uuid": "2a3b0cf8-1fb8-45e2-925a-be2a3d76cabf", "value": "T151F423C2F015C22EC8C6EEE7E799C6A616639A32DBC2C746C1E074E640170CB6DA7577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619250, "uuid": "82903e34-63d7-4cac-a379-5e856e6be6c2", "value": "12288:HdLtJXw9qwEx1MvLbtkuVqxXZwTqLxH1Gz/lI2LWNCZGVjHLxa6AZB3z2mlE:Fjw9ZEx1MnSuVqxXZJmI2LW/CZBj2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711619250, "uuid": "925d61a8-5362-4561-84a0-27b39fda88fb", "value": 729387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711619250, "uuid": "ccf965f8-40f4-4499-9b8e-36182f6acb1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619250, "uuid": "fc20b69f-2aca-46ea-ac16-100973c078a4", "value": "Order 24007219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5839a0c0-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651097, "uuid": "69dac687-718d-44ff-b032-fff09ed0e1cf", "comment": "Malware payload (AgentTesla)", "value": "f502e10ed6fe68f3ae7ab8dc21d85905", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651097, "uuid": "99db69a4-9ab0-43ba-9934-229b8bcc35ac", "comment": "Malware payload (AgentTesla)", "value": "8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651097, "uuid": "055e23d3-becb-4e4f-9ffa-313a9fa87919", "comment": "Malware payload (AgentTesla)", "value": "c5f150a8ad65c02818b317202bc0b4c885d681a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651097, "uuid": "fa06afb8-171b-4ccf-a1a2-713c1bc20f8b", "comment": "Malware payload (AgentTesla)", "value": "bbe12ac9cc14d45edded9ea4cdbbda52ced5e0ca7ab807ac893c489e9d3df00197eb92c9ba1a4db5050c402f307c24f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651097, "uuid": "a1a7f80b-8352-434f-a458-26738edb4a04", "value": "T14B030CD3DA85AB949E461B7BDC021BB34DB461ACB33F0A749778C54D600365889BFBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651097, "uuid": "99ae6fb9-d208-4e0f-9cf9-4357f1f640bb", "value": "768:u0agBVh4WAZGc8NnKwiQRP1Ugmj8VeuwRwHv8:hwqNnKwJDLVmRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651097, "uuid": "53a97db0-fe95-4bc2-8b62-7171d8f74dd5", "value": 38025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651097, "uuid": "1b06832b-87e5-46b5-bb57-755e4be7104a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651097, "uuid": "06a1d736-1f07-4d01-9da2-a661825e8c7b", "value": "CANKO DMC IMPORT ENQUIRY.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d07901-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711609912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609912, "uuid": "ea86cca8-c0c8-478d-aba6-e4480fcdd32f", "comment": "Malware payload (Loki)", "value": "d44ef44a0fc4e09bb6ae5217ea4318f1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609912, "uuid": "aba6c85c-5cab-4e4a-b872-139d7c5ac828", "comment": "Malware payload (Loki)", "value": "8f1c18e33d9ae896617a6a3249a55df0f60898c168c3748cd83efe0e235b0d97", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609912, "uuid": "649e419e-79a0-4b6e-9829-f5c44b147555", "comment": "Malware payload (Loki)", "value": "3c0fd7c1c215d71b17020f7818e3b966e8bccc1b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609912, "uuid": "e8431dcc-921b-45a4-ae28-10006a17319d", "comment": "Malware payload (Loki)", "value": "73c27bf2e36091b17007341d562a74e11035cb95e2b216ac8d67f327574c16a8abbb00e38271dd78e8f9103610421c64", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609912, "uuid": "cf2b0836-2f52-4ca0-b50f-00982dad9e60", "value": "T1C204C4E3CACA26288A991AB3DD134B734DA4005D37231F3897BDD65D609395C86BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609912, "uuid": "1f029515-9710-4c75-9988-0cafae3d05ca", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyM:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609912, "uuid": "2f5f0e7b-a3db-4dd6-b848-6f922923cd4d", "value": 183337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609912, "uuid": "ed38968c-c229-418e-804b-3972f3d421ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609912, "uuid": "4bcd152e-059a-4338-991d-778e429d5d92", "value": "TOMBIG - 9004898 - Ponuka\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5959bd45-ece1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616310, "uuid": "4e782fee-7b82-4c62-bc90-460b928b544b", "comment": "Malware payload (Mirai)", "value": "06ae913d0efa0551d6dc4180ad7f0ddb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616310, "uuid": "81759d7f-f74a-4f43-a7a0-76f7719ff337", "comment": "Malware payload (Mirai)", "value": "919552eb64afdc8301c24c17995d6643528f537b98c18c39720b448b333bcd00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616310, "uuid": "7bf725b1-777f-415f-9502-7ef88aa4667f", "comment": "Malware payload (Mirai)", "value": "2eb9900294735d0fce3e9e5311c3215c584c1a54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616310, "uuid": "9834e582-8497-464b-94b2-278ea874999f", "comment": "Malware payload (Mirai)", "value": "18bb56977ecd7895d0a4021d67c3e1116253c06a50e93bc850ec61c45ab74467eee590755afb6a87e6e3c1ea9850c1aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616310, "uuid": "73dba8fa-00ab-4893-8c63-61092705a862", "value": "T1B573079178919A23C1E423BBFA2E418D373563F8D2DE3216DD116FA437CA82B0D67742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616310, "uuid": "b87cbf3c-5cef-4f0d-bea4-9a36b9c7b493", "value": "1536:6WZwaOqJONWmajnW6JoaqI3OlG9W8Fu+0Cl1dXd42+i:6WZ0tW+JIKG9PFoaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616310, "uuid": "1c0f20c9-c868-41a3-ab38-dd22412eb624", "value": 76768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616310, "uuid": "6cda3424-f99a-4ac7-9d21-9414072eaf3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616310, "uuid": "53f11779-face-417b-a8be-ae8910378af7", "value": "06ae913d0efa0551d6dc4180ad7f0ddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b875147-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652499, "uuid": "023cd31e-b7db-4b8e-84ff-46a19f373313", "comment": "Malware payload", "value": "51f7524bd99ea47bdf5f5b20f6768958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652499, "uuid": "c647c125-2190-4875-8abb-a29f2bed00de", "comment": "Malware payload", "value": "91a3e859de8695493d8de901d2bf20921bf9ee201044d110b79527fe3ea14e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652499, "uuid": "6364ad16-9c61-474c-95ce-f092113e05a0", "comment": "Malware payload", "value": "f41a143c61f0050719e0826c4505e0a8ab823f23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652499, "uuid": "272c3e7e-2cda-46bb-aa12-53392325f207", "comment": "Malware payload", "value": "f0249f5b130074074c2f3b3846081267e928c057eb399bff3eef0f15ad530a55e392faf3ffd3e1976268aa96665f6422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652499, "uuid": "7cd7a271-a693-4f14-b170-11e0a7dac91b", "value": "T13984BE21F7F5803EF3F35E3459B496D00A7BB9736970818F26A0262E6E716C18E69713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652499, "uuid": "b9521692-20ab-481c-92f1-b56de4d5a34b", "value": "0ab7184e188103f81bd780558b811c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652499, "uuid": "b681680c-9d95-4264-9213-a9ea1bcfb511", "value": "12288:Ir2ggucLBVvM/DSbDRdAKc5bXD5MoD/5QY:InQV0/ORY5/5QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652499, "uuid": "585b8325-2da5-44be-8a39-04bc387f3ea7", "value": 406529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652499, "uuid": "9f737ec6-9ec0-4175-9c7e-f4f679762d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652499, "uuid": "6fa1c200-0045-4cd3-8585-0f970eed13ff", "value": "51f7524bd99ea47bdf5f5b20f6768958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa6cdde-ed2a-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711647593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647593, "uuid": "2d09e044-730b-49fc-a570-0bf66e33ee40", "comment": "Malware payload (Smoke Loader)", "value": "e5477d6420e21e75a4bb411a3947201a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647593, "uuid": "3f4c7bb4-37ea-4ccf-abef-a9c5a9c2a2b3", "comment": "Malware payload (Smoke Loader)", "value": "91e8fd048fb5df071ba6e3d7917edcb53122d9cbd9e57dcf4b5e50c72d575c7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647593, "uuid": "baca9540-61f0-45a7-9d4a-464899e090c0", "comment": "Malware payload (Smoke Loader)", "value": "7120bf0ba0196ecc8cc04dd0c3166185ee3f7892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711647593, "uuid": "cd629008-020f-4e3b-89da-02c5a38425a0", "comment": "Malware payload (Smoke Loader)", "value": "e29dfd93df826b9b1aa755323ce259d733e967fee52e36ca1887737bd26c230b0c9cdd49fe12b88aaf796982d484724c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647593, "uuid": "8d4396ca-0835-44fd-bdc2-03771814b33a", "value": "T1BC44BE1176E1D475F6F306324C349A509A3FFCB39A758A8B33982E4E1DB02C19A66773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647593, "uuid": "1b577b3e-eee0-4851-a95f-6e02419610e5", "value": "e87c9c66e32f791de60bd46f1df17fc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647593, "uuid": "50244a2a-d763-4099-aa6c-9db20d93452d", "value": "6144:K7vq2CD3/WTO/Ukgn4olUKm4shprkwnf8/9tQ:ERM3/WTO/dgxUWshprDnatQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711647593, "uuid": "66a0de1b-c1d4-4deb-aa06-477b9ff5a5e7", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711647593, "uuid": "3fd00e02-bd9e-4175-97b5-070545a5be8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711647593, "uuid": "0b835cb0-dbcb-4b00-a04d-fb379e374d7c", "value": "e5477d6420e21e75a4bb411a3947201a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09e4546-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1711617826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617826, "uuid": "d336b297-99c1-4ff1-afaa-707d311e4e8e", "comment": "Malware payload (CoinMiner)", "value": "af9764b5224f18db51d592d641caaf28", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617826, "uuid": "59288af8-f147-4be9-810a-ddb55a089d9c", "comment": "Malware payload (CoinMiner)", "value": "95c7b62982bdcde9fe8cc12839a414a1aa2171103a133454e9de2e406f3a3012", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617826, "uuid": "c70a0a53-dca6-4f9a-b85b-d482b0ca08b5", "comment": "Malware payload (CoinMiner)", "value": "e65b9a26d541fb15f265be8caed159e365a3f6ae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617826, "uuid": "dac5f464-3d9e-4022-9893-a0ef843194bd", "comment": "Malware payload (CoinMiner)", "value": "98533a3a303ed471bd556028b7d966e4815132f284da6a473f530a60a07aac8424aaed7b6a22be56ed975507c768b758", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617826, "uuid": "41f1bd3a-d7bc-461f-9296-5c86f24a761a", "value": "T1A517339BBDAF7EF2E14DC8B3D8AB0930278626665FF240640356573A01E9E331F6B514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617826, "uuid": "dd6dd884-d111-4620-88ff-65974065d720", "value": "3819d0e725c5d7db08d68f33ce42bc0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617826, "uuid": "e5d5292e-a729-43b7-a436-5f3c78c7205e", "value": "393216:RJ0sCQ73sdQOls+9JNDqWxFi99NX7GzwYVqOz3t:osCg3sdQC9JNDqW7iTNuwMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617826, "uuid": "021952ed-4eb2-4756-8461-2bd0998973ea", "value": 20270420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617826, "uuid": "d833c816-9f58-412a-a4e7-ee25f416a18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617826, "uuid": "8527f71d-7836-46f1-8979-fe76ac44fae8", "value": "SecuriteInfo.com.FileRepMalware.20494.7181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fe9a45-ecc3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711603331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603331, "uuid": "f88561fa-1c54-4d11-97ca-06f3267d9c38", "comment": "Malware payload", "value": "32f7d5422959e20986bd7946f180991f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603331, "uuid": "8a44ff90-c31c-4a46-978b-40a2395506d1", "comment": "Malware payload", "value": "984d02433af153f06f2f7686f257d130b4cc65991e5a58838093fe23af523bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603331, "uuid": "ddd073ea-1cec-4d42-909a-6b1e46e548c0", "comment": "Malware payload", "value": "837fa50ad77cdc319a83ffb1ac22f0f8a2a99097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603331, "uuid": "0a4228c8-d1cd-498b-aec6-66153fa52a02", "comment": "Malware payload", "value": "f2fba43db7a0538f7f53cdc62a4858eda91a8264d87336d91c7059d145f7ffe98602489172d5b26b4ecf02f7144b07fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603331, "uuid": "f1922b84-986e-496d-9978-73655f8925dc", "value": "T189158D207682C43AE6B201725A7C9B6B103E7B700F75A1DB67C85B6E19B45C25F31F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603331, "uuid": "6af5b87a-a6d0-4326-a1d2-46225384a23b", "value": "84a6bf37d5a5037b8edbf379dfcb0744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603331, "uuid": "97ae4070-6cc4-4660-b4f6-76b4b1f81bc3", "value": "12288:vqgCPAR//hBRGHa7A6wuJIVQUb/s16jWYHUiN+QcvFPxtJqI8GbbNAuu7kzR:34AR//hwefXJI6UKY0lQ+jbbyuugzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711603331, "uuid": "449f9220-7253-4209-8aa3-4722efb1c03b", "value": 897056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711603331, "uuid": "da08e00c-4f35-4bab-90b3-2b0ac4a122aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603331, "uuid": "400c122b-3cc5-483f-aa66-0a35cac5c858", "value": "SecuriteInfo.com.Unwanted-Program.0056626f1.14175.11685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5e56ec-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711630566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630566, "uuid": "16baac48-ecd0-4f17-acf7-28f642a1aca3", "comment": "Malware payload (RemcosRAT)", "value": "a5116c0a496d4b011dd2afc12147d1b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630566, "uuid": "05b053d4-8508-44c1-ad0f-e37ff21e9f62", "comment": "Malware payload (RemcosRAT)", "value": "98b668f7457089866b6364c672e8dd35b12a24899eb80fdfcfc2a5aab8d9aa5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630566, "uuid": "814839ff-50f2-4b21-988b-6bf95e826947", "comment": "Malware payload (RemcosRAT)", "value": "967e37264a5e0982b21b267211f9c5ccdc1662cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630566, "uuid": "51df2dc3-22a9-4b09-bba8-668cc9a093d1", "comment": "Malware payload (RemcosRAT)", "value": "17792bb405191e873cf059d208df3c369bc9ea3404c40c605c5523c26b27c6cf64d42773632c03986c09e2efd3b27797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630566, "uuid": "dc383ed7-5248-4e44-9660-b944f330e5dc", "value": "T1EA1523935C64B017CF268A7B3A68176E123F5E9EBEE1EA5FC40E729AC7732D40113485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630566, "uuid": "725e3d35-7320-49cb-b8b4-787c75a977a9", "value": "24576:8cKhi13lO4V99LzjUdKc7dJ3iPOgrNiFj2+:NKE1hLzjA7Z8Piz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630566, "uuid": "c19d2c6a-bbfd-4fef-a2f7-ddd218278914", "value": 948868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630566, "uuid": "23cf4e81-e246-46cb-a402-fd1015335a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630566, "uuid": "eb3e5355-86e0-4864-a36e-26540c2c292d", "value": "Specification-Glycyrrhetic Acid 3-O-Glucuronide.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617f3dcf-ece7-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1711618901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618901, "uuid": "e1459820-5353-41c9-974f-c13ca2138901", "comment": "Malware payload (GCleaner)", "value": "072808f550a495b45920fa2f0f239d3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618901, "uuid": "87e9187d-178f-4a3b-a361-5d8fbb7b2f94", "comment": "Malware payload (GCleaner)", "value": "99d42ee02b2d43170796ccb36e5f05318a713fbbb2b48067024a555a58a57dc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618901, "uuid": "a1c406d2-789e-4bdf-aea9-da73d9b83a50", "comment": "Malware payload (GCleaner)", "value": "72c07f574b55f5da5d8bea8d1c87e024e5925f15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618901, "uuid": "8e190440-6046-4d4c-8ca7-14d1573d5048", "comment": "Malware payload (GCleaner)", "value": "b903287fddab00a589743168f32f42bc27c4703d4a7dd3c116abb8243bcd9e863d40fc98a8f8c06c1b6ad7d6b579db19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618901, "uuid": "ef8d5551-d045-4782-b2c0-abd0e6d6bb75", "value": "T14D649E2272E1AC64F6734B33FD3DC6A4162EF9614FA9675B33186E0F04710A1C66A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618901, "uuid": "50f2a9a2-a328-4624-ab65-a9a10cc1d5c4", "value": "d6cc7eef7e91d5b40575c3542ffc17dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618901, "uuid": "a78fe62d-abe7-4361-b9da-06b0c6323d90", "value": "3072:WOhBfC8R+bIlGXY+XKdK1QUdLUUDO3bvd+A+kYiTmxtViZmmJVjkKbzGbIXyrN9H:L8pdoxiskxe4KW+qN9Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711618901, "uuid": "25a67c16-7356-4685-bd74-7e38a74bbaf0", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711618901, "uuid": "36e13187-4da1-4b92-9363-4dc6960b0c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618901, "uuid": "1b108896-39c9-4130-abff-4802d3dfc7fb", "value": "072808f550a495b45920fa2f0f239d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9f7cfa-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616613, "uuid": "9632cc2e-9a8d-44a8-bc28-cc0d018629f3", "comment": "Malware payload (Mirai)", "value": "a5beb365d49e3839bddce34277d4b872", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616613, "uuid": "96333103-777a-4415-8c24-7c068139fc15", "comment": "Malware payload (Mirai)", "value": "99df81a8b10e6d0e41f4b7d743257422248adb949427eeba1cc146521e6b4c0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616613, "uuid": "2725c702-d0ed-49cb-9320-de7f00ab9d9b", "comment": "Malware payload (Mirai)", "value": "408a58cbcd9a7c3c92d0e8ce5c0fb6b948eb8847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616613, "uuid": "a801f436-b70f-4558-a392-48a085aadc28", "comment": "Malware payload (Mirai)", "value": "f7bbfd9f6f5d3e8d0d2eec01119735fb6c7f606983a50522f53e9b3864f910828f1e38d7e55a7d7e26f2c0abf5568efe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616613, "uuid": "7b7afb90-6a65-4fee-8779-8db18eca2baa", "value": "T12D93F70A6E258F7CFF998239C7B78E219758339622E1C545E15CFE025E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616613, "uuid": "4b903be5-766c-4816-a9ee-38b8fd54db32", "value": "1536:uSek/299T+IDqJL9G+kl8sWAAbPibGIGqxEc94cD1VB4whil1dAd42+9Swwh:uSZ29JDwS8/AyP2G4xEc94i1VB4i6WqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616613, "uuid": "f62df2cf-2772-48d3-9824-bd0144770b83", "value": 90840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616613, "uuid": "9218c53b-2162-402f-af12-956842684c5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616613, "uuid": "58182210-a413-425b-aafb-794c586f5f97", "value": "a5beb365d49e3839bddce34277d4b872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6975e4-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1711651995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651995, "uuid": "eed5e7c8-6741-419e-b576-b564c0a327c8", "comment": "Malware payload (Amadey)", "value": "31be2f115f41edc9983d957c33008b68", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651995, "uuid": "15e40407-fba1-4d0d-8a34-454751f643d5", "comment": "Malware payload (Amadey)", "value": "9a1479bac1f3c4652a9b14798f3e5d2ec2cd4839ad40415d079619d21a812c64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651995, "uuid": "2045b3ee-776d-4ac3-a38c-8804684ed7b9", "comment": "Malware payload (Amadey)", "value": "12a8ac48d6ca6917d872c1c96e5d277c4dd842b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651995, "uuid": "097e614c-3bad-47ed-b429-134d953f7871", "comment": "Malware payload (Amadey)", "value": "276207cddd8d1ede528b0c61f306102b8ead73a887faf512752dc54a7c66a6f64caf6b49b3f4096eb15581197a1c969b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651995, "uuid": "762757c5-4c36-4eb7-bf07-d0a6cd6a3e46", "value": "T12C95339184F78DB1C7764031DEC7A9103A3461C7CCBB4E161CABCF296E47F96221AB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651995, "uuid": "f1168da6-adfd-47d1-add8-0dabc0f98641", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651995, "uuid": "bb6d5a0c-d8ba-49bd-b02a-610f0c4cd794", "value": "49152:ynktmVBAjAVQLaStMDTBf0Qizoq+4Q9l80UAoxLs:k6OVupkBMQgXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651995, "uuid": "175a961c-8948-45a7-8801-f09d1de794d3", "value": 1914368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651995, "uuid": "a7a01f0a-1c9c-4d5e-86b4-c740add66e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651995, "uuid": "7c1acced-a1d5-4663-95cb-730a1e6b1b16", "value": "31be2f115f41edc9983d957c33008b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbe57de-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609845, "uuid": "a1cd1315-b70c-491f-baac-a6b7975723a6", "comment": "Malware payload (AgentTesla)", "value": "503cdfe56819696af4c1336045ff6ca7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609845, "uuid": "e9f4b650-7e9f-49b6-ac97-e335456d2c76", "comment": "Malware payload (AgentTesla)", "value": "9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609845, "uuid": "fa8fabd0-be86-4176-b382-9acb0d1ea610", "comment": "Malware payload (AgentTesla)", "value": "b44c671486cd3f5341ebe42567d9d5c7abadf079", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609845, "uuid": "75332148-9d27-4061-9c0e-e2fbf324bec6", "comment": "Malware payload (AgentTesla)", "value": "a09e3dff476ea9384df6f1b38c6bb3404b64133d87f442097aacc6b21234c67765cd962b6a632026bd2119827d8bf48c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609845, "uuid": "f4500d6e-6b50-4f73-a447-b54e81704ad2", "value": "T1D3E4F14032FC6A4BDA3EA6F6647169D487B279272612D3CD4CCA70CB19E9F514380EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609845, "uuid": "fa1c8bf4-506a-427c-bab6-076427d337cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609845, "uuid": "0e1906ce-3a4f-46c7-8b62-7c3ee14e4cfa", "value": "12288:9d1JsJ6SSR1Sh2iNwIHLgjseXBEOPETAHEP8PWuuDpqGTTrvPWZHOQ1S:9d1w1GVjseqaNkPCu4WXXAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609845, "uuid": "8dd9ff87-a0f5-4396-865d-9a9017cfb4a8", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609845, "uuid": "26fbba7f-8a32-445c-bfc8-543e00379a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609845, "uuid": "f0be719a-5b48-4340-9f40-8fcbd0a02b10", "value": "Quote\u00a0UPDATE\u00a0\u00a027-03-24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef3bddb-ed0b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711634305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634305, "uuid": "1a9f1d77-1fc1-4fcb-b077-24b22adbb0c2", "comment": "Malware payload", "value": "3ff2d12f73ce7c3f0cd64b96be5d6c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634305, "uuid": "ca9a0d31-7015-41db-87b2-980883578a6a", "comment": "Malware payload", "value": "9b32665b80cd460bba802f3c7d90f64d39124db42033696f9e0210f8ab580742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634305, "uuid": "2db3a7fe-8add-47e1-9986-5717617acbe6", "comment": "Malware payload", "value": "31d1896c9d1e5bdd5b60d845997b112f1c36ee1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634305, "uuid": "19d73477-a7ea-46e5-9eaf-535dd1dfebfb", "comment": "Malware payload", "value": "05397e944e1a0486ef35977c90ec07cca6b0a41f01ce66efc2e87856ac1031b1b204a0025d057ac7d582330f3a56feb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634305, "uuid": "b4037d4b-7ade-4043-85fd-95726c02addc", "value": "T1E1225F82F34B952AE42D993006EF8F409311EF2119A3463B2734F29C3EB6B790E56D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634305, "uuid": "f487532b-64b1-4711-85c3-b82c51657d14", "value": "192:5sI4UTJxS01+lVvrolfXibna1pbJlwVji29KRv6KmKdC7KLK/LVH:4U1xFPymbUViIKRiKmKY7KLK/LVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634305, "uuid": "0a0d0de3-252c-4dfd-9eaa-4c270e9d204c", "value": 10612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634305, "uuid": "d6d0b22e-9d14-4856-96f5-4cedc49e9713", "value": "image/wmf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634305, "uuid": "f8e11f4f-394e-48e4-b6c5-b8c7586b4d67", "value": "image006.wmz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3817f2ac-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1711610671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610671, "uuid": "ee9ab73b-9fc8-4a80-8252-6d37c6dc7eef", "comment": "Malware payload (DBatLoader)", "value": "39d904e6c63e77054bded18a089fcae2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610671, "uuid": "0ca5d26a-b1de-46a4-b673-036256b099a0", "comment": "Malware payload (DBatLoader)", "value": "9b49fa9b3be6c60c072d485d9405c1cf91129d57fb10077499fe4474ce8decb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610671, "uuid": "7d1d675e-274f-47af-a7a6-c02dbd42909c", "comment": "Malware payload (DBatLoader)", "value": "6fef0533a232ba5d807b9eb2cda1dfde28afb7af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610671, "uuid": "d92f76e7-71e9-4894-8a79-815f196f2ddf", "comment": "Malware payload (DBatLoader)", "value": "61f64f273e5d3b455029c0cf1ded5535e01887adec0a853027aecf1fb4757f353dee13cc6a8fb4ac70ea16d41573920b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610671, "uuid": "572d51a8-e4e7-4f54-a21c-819628a383b7", "value": "T19315BE3772D17435D26E38785E5AC228125DBA20FF24990BBBD42E4C1F796E2FC29253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610671, "uuid": "c453fe0a-9acf-4999-bba2-71685d93d94a", "value": "a5a687b11c6fd1a0adde6a211119755c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610671, "uuid": "6b6a2997-fc7e-4938-a40c-2c586a4fe25b", "value": "24576:/k8B8MTGN4i4S/NvBRaR6URr0GDp6e5/E:/kspURaR6URrNpT/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610671, "uuid": "7d6ad490-df53-4b68-9020-523deb2bb124", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610671, "uuid": "6fc623e6-f471-49ca-848c-87bc4c4f0d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610671, "uuid": "8523a137-ab11-4a82-a52a-1d905db4e02a", "value": "39d904e6c63e77054bded18a089fcae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f0f6c7-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload (IcedID)", "timestamp": 1711642552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642552, "uuid": "510764eb-687a-406d-83ad-2afcad1f3b49", "comment": "Malware payload (IcedID)", "value": "95e35564ed41b3eeb4db220baec91c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642552, "uuid": "71121349-c214-433a-8ef1-b9c7e82aa2fb", "comment": "Malware payload (IcedID)", "value": "9b5498c5c240818198e2eea9d9b8dce18273ea24b167882c9efc030e2643f127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642552, "uuid": "24e55812-fd3d-47ca-bba7-6d9444372c2b", "comment": "Malware payload (IcedID)", "value": "4c209f8b3c7684fc96c5d77c7b4f0ef896a40814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642552, "uuid": "fec98601-c8ef-4ec1-af41-8b79caab33f3", "comment": "Malware payload (IcedID)", "value": "aca92c94ea716885a4d2ca21250d29c1c383ff5769289c19d186ee7f58cb5cf28a98255d6c89816541facd6699535882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642552, "uuid": "7a6a90f1-c0ff-428c-8441-0ec1d01c6a95", "value": "T16042F8D7AC14A8B0FBC744B40A49216DE3F72922277014F78DB349CADAA2E95346D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642552, "uuid": "eba78b61-7927-4a41-9727-521e3086ee13", "value": "0e18f33408be6e4cb217f0266066c51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642552, "uuid": "9cd2e968-caaf-44b9-b5e7-95b0d6508ab8", "value": "96:MMqEESUUhDYXAybZACN3fICtECLi0/rxV+YVh:MMqr7UhcXAybZBrWw/+YVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642552, "uuid": "4c66d032-b849-4367-924e-8720cc014e07", "value": 13102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642552, "uuid": "1a80679e-63c7-44b8-aa75-e03c5b086f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642552, "uuid": "a9e1fe2d-78ab-42a9-aa46-63f5aba02e96", "value": "unpacked_1648556.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f7d670-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711630370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630370, "uuid": "97949ac0-6ca0-4caa-80f3-3f1881de4343", "comment": "Malware payload (Mirai)", "value": "cda9f3b9081962a0727395647f954c57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630370, "uuid": "87f52361-d52a-4335-91ec-82bd7200c1aa", "comment": "Malware payload (Mirai)", "value": "9bda2ec16a44e23313b127918f5d2f839e5fbcebfa7b31e5b4e5ee3d061bd427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630370, "uuid": "a8e37e6a-0bc2-466c-a252-76955eb79b7a", "comment": "Malware payload (Mirai)", "value": "c373bb0f49ac81406df4b8277ac6f864d5a67b63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630370, "uuid": "165c9177-3e7c-4ac0-90be-e4f0a9659d4d", "comment": "Malware payload (Mirai)", "value": "78db40bb319e5662af55cfab34b504afa8f524a1133ec0f94cf6d97e3c341a79e98d8dccf67e14d6c4bdec5e84e54189", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630370, "uuid": "56d5b781-92c0-4696-acde-b8a628807e4a", "value": "T19A9353397E61BBBEE27C82304BF76F70C34221927A919341E26DDA185FB524C1C9E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630370, "uuid": "539a46bd-e4f2-4554-a524-2e49a1d054e4", "value": "1536:aNOXO5eLVrd0s/o6P3XS0CkQCWtETefR/KcwkhXw2WghB8caQG:3X7z2Wyw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630370, "uuid": "a1393d41-16af-4cce-8dc7-643994d7f5f9", "value": 92909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630370, "uuid": "23293a88-57b9-4c18-83c5-3d88c8c6faec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630370, "uuid": "6b2c9a43-4c6a-492b-9039-14a19db3ea56", "value": "cda9f3b9081962a0727395647f954c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839982c1-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1711652459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652459, "uuid": "172f1e32-368b-41ca-a37a-c982876de918", "comment": "Malware payload (Amadey)", "value": "79fbd35cae4148d9053cd4590b6d41c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652459, "uuid": "7bf9ff95-ef7a-45a7-af76-aad4e6ffa43b", "comment": "Malware payload (Amadey)", "value": "9c1751ba73fe53ed9385f24750212c6e785843e4c63dbafec8f95d3e6a5088ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652459, "uuid": "4118e65d-6ccd-4e91-badd-195f7789d1d0", "comment": "Malware payload (Amadey)", "value": "3548d8fa1f242206447224068c16ffd30278ede3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652459, "uuid": "b5f7ab58-01ad-4134-945a-e8e34a0183d5", "comment": "Malware payload (Amadey)", "value": "23a093ec967522bcd337b6e7c4168830a87791477bc8968726df6724f59cdd3ac6734830286178a67f01cae871a23597", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652459, "uuid": "c59a8d36-463e-4fd0-b1b5-bceebfeae3ac", "value": "T1AE9533484EE09BB8CB6DD473FC9B921178FC20BD84435D71BA4DB5C19213B98CB69BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652459, "uuid": "350ee950-cd75-4f6e-b21d-9be81a02626c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652459, "uuid": "36356466-59cd-4ecc-8326-c329a652493e", "value": "49152:rOixuZfOJofYPg+EevCu7OgYZkwtOc/Xe+vv:rOgIfOJosF/jYZk/cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652459, "uuid": "6b6fa539-a5ac-45bf-a7bc-9b4771ec1a97", "value": 1906688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652459, "uuid": "258bd864-d196-4e16-83e6-5e8960b39089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652459, "uuid": "1efc722d-7ee6-44f1-b8c5-ac34b9f9e539", "value": "79fbd35cae4148d9053cd4590b6d41c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50e50f9-ec9b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711586480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586480, "uuid": "79aff8b2-1fe3-49cf-b6d3-986765486575", "comment": "Malware payload", "value": "f20e9c1ab9657581fa7ffaf918989211", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586480, "uuid": "bf048fe3-e600-499c-9bd0-796ab497e312", "comment": "Malware payload", "value": "9c8cab47e0c9ac216fe89259b818981716e48001870275a36fd55b51456088c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586480, "uuid": "fd7b5800-67f0-48d0-95ce-e9041401a95a", "comment": "Malware payload", "value": "65776699a589dce9528cfa2661ad0f5b7fcd12df", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586480, "uuid": "58e2a422-f67f-4d19-b033-367b9cb5a083", "comment": "Malware payload", "value": "511b0b39f3a3a15292e2c369b58fbab1fb045b7dae6c404c5686c535d77025ba4ce621b3d8500a586c84934b43e9b06e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586480, "uuid": "8f191adf-f286-48eb-892b-6435ba5a4588", "value": "T171143A303808C53FD74F1771AE3D9E6B202949A90BB650C7F2C85E6A18761DB2B36E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586480, "uuid": "55e44a25-5c9c-41a2-92d3-7c8649877fd0", "value": "b636b4bbba5dd32f2ec6e23bca0b8407", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586480, "uuid": "2cc22518-bb1d-4456-b631-101cfe73f2ca", "value": "3072:QM+zj5HMfx30uX7OOuytpTB5QKR96wBJy+Ef40+:pBfuOuytH5lRXBUfz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711586480, "uuid": "b7437bbf-66ad-4d5b-b09d-b584d3354078", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711586480, "uuid": "54b66662-3abf-41be-aef0-300fcaafc759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586480, "uuid": "d6b31147-f1aa-451f-b0fb-3add5acef65b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.16513.23095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3b1ead-ed0b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711634298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634298, "uuid": "6ab43ca3-6ab3-47b9-9e36-b883fc905974", "comment": "Malware payload", "value": "ce087243d61bdcb2c4fe6debf860eabd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634298, "uuid": "1e59ce5a-3b53-4c2e-a7c0-a92241ab7c44", "comment": "Malware payload", "value": "9dd8f310c975492a8c51c43a2d2ec27c5331e0784ddf3f791387525d2ddcd2a6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634298, "uuid": "a3a5f016-9c11-4cf9-84bc-65d32dad3c52", "comment": "Malware payload", "value": "719076eb7d38c35ce487de15f604628c602f1b65", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634298, "uuid": "49aa8c90-3782-4582-be38-93bca2c50160", "comment": "Malware payload", "value": "3c6d18be86f4eac223acc534d724f4e7c570d955f5a24e76d7bed2485646e7758a894fee636dfea356615d69f48376fe", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634298, "uuid": "d0b054bf-3978-4847-af16-e9f88c19be9d", "value": "T18F918EBB406DFB954C66C12491869DDAF406403D1B3CBB1F8997037871E96AF0168B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634298, "uuid": "c9509966-6260-4184-8ccb-cfe377efb007", "value": "96:JG2xM1mhFcXfE4W6ALffCWpaR/Bz1yEYpWppudarHO:gWHEXfUzzpgX0WTugHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634298, "uuid": "8d3847a2-53ef-40a3-9236-93b0ec9f6754", "value": 4555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634298, "uuid": "95547e49-2100-42bb-bd5d-59727043e842", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634298, "uuid": "e0dd50b4-0405-41db-b6f5-6fa1ab9645c9", "value": "image006.wmz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e60f0b-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609864, "uuid": "b4e2ab8e-a828-4431-9cf4-58cd6937c1dd", "comment": "Malware payload (AgentTesla)", "value": "41bd6059396fdb7e5fd6692c003b58a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609864, "uuid": "fc6e05e3-5f6b-4cc4-8b24-80539d9042da", "comment": "Malware payload (AgentTesla)", "value": "9f20ac2fe0041feeda59946899fe0ae20d0d74de009990023102a7d902065324", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609864, "uuid": "3a96a772-aaab-43f3-90c6-2e3d02576dd6", "comment": "Malware payload (AgentTesla)", "value": "9da6c16a501a619e44652bf1eb3eea3012835f53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609864, "uuid": "99e9fb4b-750c-49ab-9d7b-d531807669ce", "comment": "Malware payload (AgentTesla)", "value": "df52fae2a58cba2e0b2e1f5e90b5f6f41acedc7a9bb70499ffabaacdcc305376551fded36d71392f706315c14aa4ca1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609864, "uuid": "8818c010-3c54-4bd2-a563-661df3646795", "value": "T190F3C5E3CAC526188A892AB7ED274B734DA4419D73031F3497BDD65D9083A5C82BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609864, "uuid": "0bc4e6a7-ad17-47bf-a737-38308c3854dc", "value": "3072:UpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8Dh20PWgn:UpKyPeadLaz+k0zn1j7rZeqGbHfNcckk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609864, "uuid": "68f20bf5-f24e-4a21-876e-46694c58d096", "value": 171408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609864, "uuid": "7b4158e7-1eb1-4924-a79f-c8462a710b5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609864, "uuid": "50257b85-b673-46df-9c2a-8179e7a74ffc", "value": "salaryinfo24.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bfdd93-eca1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711588707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588707, "uuid": "d710b0f5-d3eb-46d7-9bff-ee64b0677c8c", "comment": "Malware payload", "value": "596bd6f5b8857dd0c02baba9ddfe110a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588707, "uuid": "18e676c2-cee3-40d1-b74c-33416960041b", "comment": "Malware payload", "value": "9f96a809198ca55fe32688162e01ef2719bb7e6b0b04e56bb67d9ab718278b85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588707, "uuid": "7f1b1650-2eb1-4237-b7f2-99daab28df4e", "comment": "Malware payload", "value": "4e5e55c0a0e901f7205bf1db63cca55367e24fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711588707, "uuid": "9719708e-ae83-4205-907a-236ecc2206e8", "comment": "Malware payload", "value": "b0071a9d1b70033328ef5664f607904593dbdf761d154893bf7f72093713b75ef8a795ccfdecbb938641966ca2c4101d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711588707, "uuid": "26449145-7189-4e1f-a974-751b1b4a8d66", "value": "T122673319632E9335E88FAD3C91953E1DCA292AF64653850357C72A3BC5B9B60C7732C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711588707, "uuid": "57f8c53e-9254-4618-a390-148d9b8a1cfb", "value": "786432:3rf0GIKORNuDLS0B7hHac5Gi3ENiHMCZsVla:QBRNuJ7hHZ5GiOiHHZsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711588707, "uuid": "e4995ed2-7364-4368-9bba-7a040ba1e39c", "value": 31588352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711588707, "uuid": "1d74e47a-41d5-4167-9933-bd2112a67cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711588707, "uuid": "aa04e9b0-dbc9-44ee-b1bb-e11392664298", "value": "SecuriteInfo.com.P2PWorm.004d32291.6226.21171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de01d0fb-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711617821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617821, "uuid": "79e78922-9482-406c-b8d4-f884d10e94a8", "comment": "Malware payload (AsyncRAT)", "value": "c8d9593196962fa5d706a207c16674cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617821, "uuid": "17f7ce8e-5b09-4c3c-84bc-89bff5d84022", "comment": "Malware payload (AsyncRAT)", "value": "a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617821, "uuid": "752b7542-a0ba-42f0-9eb0-747b34f18d9a", "comment": "Malware payload (AsyncRAT)", "value": "686a8e674e6615d5cd91f7b2cba0c755054b3f69", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617821, "uuid": "be24c383-3c90-4721-9996-46c29668be14", "comment": "Malware payload (AsyncRAT)", "value": "34493766a8845ca0ce66c3c4b17195f62c0fd243c825849bd9576ea497fa08561995bf7a88b78ed97d55c67b314fd9e2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617821, "uuid": "9119caa9-ce84-4994-bf80-e3e51dd9f69b", "value": "T157A40228B3EC5977C7DF127974B4A0918B75FBA77222CB8F4810854E2857BC14B62B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617821, "uuid": "8c17b14e-65e9-42cf-95d6-0c97783b7bd7", "value": "12288:XcTpGLwWpFGIWFfDtaY4S0LEy7w0iymL/:XOpEwiFYxsEyHiyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617821, "uuid": "c9b89adc-cf3f-4a67-ab55-83355cf10c54", "value": 466528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617821, "uuid": "e0b69dde-8444-4aca-824c-794cc443a932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617821, "uuid": "b8c00981-276e-4197-9743-6291bbe227a5", "value": "SecuriteInfo.com.Win64.PWSX-gen.25316.31097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419e90a4-ed0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711635598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635598, "uuid": "101698f9-0007-4016-bb35-b00b63393241", "comment": "Malware payload", "value": "9b83f4aef17adc5febcbd1c7f787047e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635598, "uuid": "6823e5ed-bf9d-430c-bd62-341f71d384f0", "comment": "Malware payload", "value": "a6b9b8fa15a63c2c8c89a54dde4f5dffaafd6c5f62c9e05cb21c645f4c7b9c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635598, "uuid": "e60536d4-faa3-4840-9376-a595f1d8d90d", "comment": "Malware payload", "value": "b19fbf4f4c053d46bb99afbde6fecd7e4e547700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711635598, "uuid": "f29766e6-fdb6-4f65-9c0f-fc4d4f9a5ca1", "comment": "Malware payload", "value": "6d6d7f722c31b84a3b97ea15aad7f12860b8f89019c771bbf3cb1ebfb64d99ef31f6113d8c8493752f2ecd2cd94e1341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635598, "uuid": "148e378d-64a7-4eb2-8a87-b5530955c154", "value": "T19C559D29E6415BC1E23EA3FA41361B0193F5B822973ACB4C7EACB0D81F79F0559476C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635598, "uuid": "ccfb4f12-e21f-435b-8de5-371b063be58e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635598, "uuid": "b343bbc8-075a-4001-b044-3b2a98db782b", "value": "12288:OUtF7OEA8ynvlk7Bw7B67BpJFJSJipac/MZBNmXVytYSAOZHxCkMhrIGtfyog7N5:V/AvkeE9jY6/2BeotYSLtxvMhrIGh8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711635598, "uuid": "67896287-847e-4fe6-96c4-135d582d9928", "value": 1391536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711635598, "uuid": "64f9b7c0-6ee3-4d45-82bb-3e6f2a06cbf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711635598, "uuid": "4687e8e0-71ca-45dc-bbd0-15062297a379", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30150.14087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d17b51d-ed5c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711669252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711669252, "uuid": "8c77b0e6-81c9-429f-b0cf-a414fd23c299", "comment": "Malware payload", "value": "36742d167f78ac1d6d24e7d28a116aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711669252, "uuid": "324274bc-3da7-4387-a8e4-6a812d7a34cf", "comment": "Malware payload", "value": "a77c902baaecf691c4ecaa8bfca78e2e3a61605da8d1a991273e29073bfc76e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711669252, "uuid": "31feef5f-be22-47e0-9733-f6ee0aba676e", "comment": "Malware payload", "value": "e3ab2f267e0556f9f5c9d2b0972960d466d20f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711669252, "uuid": "52e06eb9-a0e8-4c60-ba69-40c9fb74c292", "comment": "Malware payload", "value": "56ebf3f5b9e0232a44b47ea40c3edac7f6166c88ddf9da0c38bed314bb11bad6f2ce4b84987fd7d0593c56cc66e2bbda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711669252, "uuid": "6c47a0f4-9243-4980-ada1-596d5d89121a", "value": "T11A1733A7E84061A8CE8976FC3CB2112B45B93DA006C2D9D2D1F2FC47A13D7ABCD6564D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711669252, "uuid": "f0b0b876-f2ac-43a9-bc81-9fda48036736", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711669252, "uuid": "c242b066-6a65-48ad-9835-c04c6e6fd194", "value": "393216:V0qdqQB7cpi7A1qIaE1Ow04FjNqrVZ7M4v/I7uNCNCD:bdBBeic1qIHOwRjN63o7dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711669252, "uuid": "48473fb6-0f24-49c3-9500-5d271546d28f", "value": 18689536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711669252, "uuid": "0412687f-6f09-43c1-8a6b-56044901712f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711669252, "uuid": "8fb9f35c-2995-4168-bcb7-eb34b5944e5f", "value": "nintendo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e216c622-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711639303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639303, "uuid": "d71ac675-92f5-4ac2-b24a-1979eeacd4ea", "comment": "Malware payload (AsyncRAT)", "value": "0b459466e3619d2a29bb93ea2dac077a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639303, "uuid": "27a11dab-6c03-486c-8a16-1c0ba3f42cd9", "comment": "Malware payload (AsyncRAT)", "value": "a7adeed2290a6e7d4b061a44337ebbcdc91a9800e40cc96a31632e3e52d710ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639303, "uuid": "ea2d9e09-4852-4dda-8d1f-ecdaa56b915b", "comment": "Malware payload (AsyncRAT)", "value": "b55a18a2d13589b81cae82c691d83e7961799d44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711639303, "uuid": "dd302ddf-6f09-40c4-b9cf-acdebb1a038c", "comment": "Malware payload (AsyncRAT)", "value": "3e603d3638187f5ca2c06e48a5ef262d6ce4a51b55e5ced8f23759b15a44ad2a309e9139c4d4670b44b1203cfa1ac88d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639303, "uuid": "8e3856b2-fd21-4cd2-971b-a8ee24db153c", "value": "T1A6E733102189D9B9D1F8A5BDDF2FD90214EC53A129D16BFF1C15C3250EBFEE2A89A1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639303, "uuid": "2f3bac6f-0925-4cd4-a447-41f6ba3f240a", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639303, "uuid": "07a8998e-241e-4af1-afa1-d34c1df46453", "value": "1572864:iFffrC4ndj0tJT5vMiaUMeRBFGkdWEeJFj3w:gf24dj6T5TaUTBbdheXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711639303, "uuid": "54267d2c-4ae0-4c86-a8cb-071220651259", "value": 66234368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711639303, "uuid": "bd216258-7759-4a47-8da7-4c639c877fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711639303, "uuid": "874efecb-558a-45d3-8db1-0d5c6976ee16", "value": "0b459466e3619d2a29bb93ea2dac077a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89611b01-ed09-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711633571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633571, "uuid": "783ce0a9-783c-4286-9833-e007c7934746", "comment": "Malware payload (Mirai)", "value": "eb2a7a1b130021512410fcd528a00d5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633571, "uuid": "bc6a9484-a7c2-4451-a294-8725f1c427d1", "comment": "Malware payload (Mirai)", "value": "a8ba447e109a128bd4f005cbfc01ebbd51ec9b2b281e4db81ca9942744c49299", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633571, "uuid": "6586b98f-77ee-4f5c-a1e0-95e387cfd095", "comment": "Malware payload (Mirai)", "value": "4637dd285367863ca0a21dc5c1696fcbe65572dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633571, "uuid": "a43a4708-3382-4ddb-8b02-de050fe06239", "comment": "Malware payload (Mirai)", "value": "e57c9a3843c074054801b6abbb7a52cf7f8c9e7e98715311cdd819b6ae7d9231f0c0b9192ed7057bb9647a892fd6b7bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633571, "uuid": "9237043b-29ab-4954-91e8-87596cc1008a", "value": "T1FB63D644F954932FC2D277BBF759028D37391A58B7DB33215A382DB43BC5BA46E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633571, "uuid": "626a05c1-f1a2-4e65-9413-b6d90b4fc531", "value": "1536:QGJwXwbzKBahJJpTkgPcqFRoTTpxK6SN/va:RbeBMpT1PcqF+TGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711633571, "uuid": "b028fd4c-12c6-4e95-8747-1a8b4e410e31", "value": 72557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711633571, "uuid": "195b36ad-73ef-46b3-92bc-15562bfdad03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633571, "uuid": "d5741d78-48b5-4509-a042-1b99e2a4304d", "value": "eb2a7a1b130021512410fcd528a00d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4010d2f-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711609644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609644, "uuid": "ce95c3cb-1723-4f78-9391-a325c06e3a59", "comment": "Malware payload (Formbook)", "value": "98eb55275c529b7687b176c76c53a759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609644, "uuid": "2de78d59-5f43-492a-b321-6505bb51b285", "comment": "Malware payload (Formbook)", "value": "aa11f352c3358d95bbee240a562519763af7625f4237d13f2764a0a0fa0223d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609644, "uuid": "8cc2599b-be24-4177-ad97-3030a622a519", "comment": "Malware payload (Formbook)", "value": "2819b9d765d4231beafc2f266f1b062665a850f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609644, "uuid": "32375057-e40d-47b9-9557-885bada14db9", "comment": "Malware payload (Formbook)", "value": "69f01ce209ce2a62080b8e62866cfee8d780193d99e98aebbcc814ce6122c832b755152188432acdd5193ac78372ea81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609644, "uuid": "cba3aa4a-c177-4dbd-97e2-5ff6091f518e", "value": "T1BFD59E52F45B4FA8E24DD737CAAAD404AF69EB826523DB0E3CC9B7055403BA21C49737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609644, "uuid": "33b18f43-aac5-4e58-814e-d63f77b762a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609644, "uuid": "a741a076-e25f-456a-85f1-b2bfbcfc59bd", "value": "49152:dU2zbLL2YsJIZk3c42IrDjy/AnzqSppF7Lw8KR1T:Fzb+7Z3NrD+/YqqtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609644, "uuid": "c8b0446c-9b18-49b0-8902-94177df6fdda", "value": 2961920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609644, "uuid": "7ff4afba-39a3-4f64-b193-4a8dd881c8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609644, "uuid": "c9b9a02e-3f55-458b-b1ab-dfd06c680dde", "value": "Payment Slip (SWIFT)\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4eb031-ed52-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711664714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664714, "uuid": "9242bf6a-a282-4b5d-8059-e2e0a449be3f", "comment": "Malware payload", "value": "5da5d327d44645e0f3eb50b13a562927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664714, "uuid": "26c88f9d-c0b2-47ff-9c6c-2395fa22e4ee", "comment": "Malware payload", "value": "aa2d947e869e13f0f09bc5762690f56967e03392f9720d83f03b67601958cd7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664714, "uuid": "b7a2ed0d-cd75-418b-9eaf-8b140c16b5f8", "comment": "Malware payload", "value": "a75c81577273a8636241299f5f28af46e524250a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711664714, "uuid": "d9f42321-f506-404e-849a-d408d67141b0", "comment": "Malware payload", "value": "790a4837467086899993fd5c09e3ff627d919b70fc16237a582a7e71e0bb370e23d85d389af16b7d6f9209c2e86902ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664714, "uuid": "8e051a19-12cf-4a41-bf2b-809735f72027", "value": "T10A132B59BE254CE7EA52533E90E7C7762B3CF1814A2357B3BB30F7345B236922099246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664714, "uuid": "1e48ac59-1b06-472b-b176-ecc481e018b2", "value": "26b67a10d8c2bb0006e66dce8bce4de4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664714, "uuid": "e3d37dc4-f616-4faa-a99d-082a40587754", "value": "768:T9yEQ+O9qhwfJPP3lLuzZPKqfgSpo7TEpOm:TNO7fJPP3lLuBZfvoMpOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711664714, "uuid": "6a59d2be-8a40-4dfb-a74f-934fe20799d8", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711664714, "uuid": "8a9cb4ae-3ca6-43a9-b1a9-26357b8eec5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711664714, "uuid": "4eeb3fcf-93cd-47c2-834f-83a5e597c07b", "value": "SecuriteInfo.com.Trojan.Win32.647.23647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02e9879-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711630710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630710, "uuid": "16cc0e59-3622-4a28-b119-734c044d0586", "comment": "Malware payload (Formbook)", "value": "749404f8b6bd72307f017d1fd8f3081e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630710, "uuid": "70b8b51b-34bc-4496-a876-f98a29ef20c8", "comment": "Malware payload (Formbook)", "value": "aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630710, "uuid": "82dfa868-b764-4cb8-a2f0-b6f131029a8a", "comment": "Malware payload (Formbook)", "value": "84995cbfec91c10df85c97d0f7acec531dba455c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630710, "uuid": "e94a9e93-88ab-4ee3-92ee-e7f727e62c77", "comment": "Malware payload (Formbook)", "value": "11888300a931f65669d7b8ff4df2e458c1bfc945005854c226f3e62e3cb0d128fbf8edf76311290fbe260b970900bc32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630710, "uuid": "499d4bf0-4b38-4c72-ad9e-bea09fe1ca1c", "value": "T184C512743FCB8A66E69D03BCE052513943F5C017E5CAC74EDD94E0E92C8BB56960A0AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630710, "uuid": "59c67075-faff-4b68-a0ff-70b2b347af5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630710, "uuid": "c5846ee7-09a5-4df6-8dde-038e5684c404", "value": "49152:i5L4P8xfttrOoXDhNkxtOTBcziRLhT2vWkYd9n:OymFtrOGhNkxY9RcOkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630710, "uuid": "157f6edd-a818-4ee2-a186-9720e610c467", "value": 2534912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630710, "uuid": "ae8f7f35-61b5-4e20-868c-b330d6bb1053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630710, "uuid": "5d841c93-392e-4729-b0e3-21a7c5501a5e", "value": "QUOTATION_MARQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdce89e3-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652583, "uuid": "1867c1f6-d60e-4a2a-bb67-5a02dc232362", "comment": "Malware payload", "value": "40e03cd1101c9ca0b28c59b62efdb92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652583, "uuid": "fc66d4ca-4812-40b9-ae0c-5d47dfbb7de6", "comment": "Malware payload", "value": "aadf4f3f0cb83e2605ccd24184f84d4aeccd7b1b448f1be329a081e55abead09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652583, "uuid": "6d9cb608-7fcb-41f1-98e9-2ebe8eed518c", "comment": "Malware payload", "value": "3cb08901740b660023836ecef932913ceba46b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652583, "uuid": "3d37c5d1-7392-4c24-94ef-28caf8c0ef09", "comment": "Malware payload", "value": "b8ed719fbf41cfd7925c21f9edf14b74149e50dde79bc8cf9d99cf4dc19a6234a3570f3e56bdfbd0d83497ddd947aa16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652583, "uuid": "44b3b066-06ed-4c24-816a-b986b1695fe4", "value": "T1B326AE0DB3C89E37C19E223058AB9E643775DB876A46178372E4676D6FF53C03D4A288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652583, "uuid": "9ece0a5f-83a0-45a4-8739-a09d6f0c1b8d", "value": "97ee83cf603ee11e9c027e449c194e00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652583, "uuid": "8566b8de-15a2-4908-a4b6-d1c8703159fa", "value": "49152:jCNyAT12qkXPa6q36RH7BBkeAopkoPXGye7FVjJNmbS6d+mMPstZlmLbit7NjAIo:OoRAopkoPXGNVjJNj6dBbtZkStJjDBDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652583, "uuid": "f651c30a-124c-4c0b-ae8d-3688171d6c97", "value": 4425117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652583, "uuid": "70a26d7c-f138-4b1b-ae8d-7ad7158d5825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652583, "uuid": "ae7217f8-f376-4462-8855-ecd33ea0060a", "value": "40e03cd1101c9ca0b28c59b62efdb92e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2685687b-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638988, "uuid": "d4eb72df-02ec-4c59-8eb4-86daeddbc18a", "comment": "Malware payload (Mirai)", "value": "1e065b9b685e1fd4f608240588cb7ab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638988, "uuid": "c5e61788-d1d8-4f7d-92cc-15d574e09cb7", "comment": "Malware payload (Mirai)", "value": "ad71b1ebfc34f1e49876c75ef008bc183322ea0cf02891c2b4c5b81a43bd1f63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638988, "uuid": "7ffe56d3-c4d7-40ae-b99e-ad7b9672f413", "comment": "Malware payload (Mirai)", "value": "d7ca73ba08d2078353381c2c73845546e744e0f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638988, "uuid": "2e02e25b-2a78-49d5-a137-a211d8066787", "comment": "Malware payload (Mirai)", "value": "0f2b555dab9cdc393296d888a242a5074f5aefdd2b2b245051d92bf491e66729e1da437febdff41afbe6078c6dec21f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638988, "uuid": "2391b1d4-436b-4ded-8b21-5e00bfd2e09e", "value": "T13C930909E510576BC2D237BEFB9E419E33272B94A7AB33255E345AB42FC5B991D3C020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638988, "uuid": "b472c5f2-6b5b-47d8-81ce-4633cc01d6cf", "value": "1536:bTfnkysHX3WBbb5l4MPUEAoxIBYaiXRc6IIiruEYHpdGiEGucauNnV8eY/I1+N9n:E92Vb5N7AoKuaFuEYHfGiEovLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638988, "uuid": "d308fad7-df69-453e-b68a-ec6cae8c60fc", "value": 90010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638988, "uuid": "752f5fca-6e73-418c-8438-db99b34cf224", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638988, "uuid": "c3ef732f-3e19-4710-8dae-2ab0eae67c49", "value": "1e065b9b685e1fd4f608240588cb7ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff7b3cf-ecd4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711610684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610684, "uuid": "60cab4a6-e8da-4faf-945e-11260e8aba40", "comment": "Malware payload", "value": "0cb4cc8a9f145e69c6765bc81faacc7e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610684, "uuid": "8ba1db8e-edfa-4023-9981-01ad45aad42f", "comment": "Malware payload", "value": "adad8b635d0e68f9bbef153e5abb427d85de2e3a4f786668912074b8419ee239", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610684, "uuid": "799ae761-4b92-4be9-9f60-6be9176b7ec2", "comment": "Malware payload", "value": "ce6f40a67bd31738f47ed4d8f017e7c13aa90ceb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610684, "uuid": "5330ab57-6983-49d4-9988-79a99eec96ef", "comment": "Malware payload", "value": "7b8fecbea43b26fa839e21c9b1a6fe532a09c9bbbb4b2b04866c65751ad70ad4b233312ffff8c988d3ca706ae9a0ebc2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610684, "uuid": "fc032690-e138-4439-9c82-c0230a4d51f2", "value": "T19F169D87BC9044E6C4AEE33A84669995BA31BC480F3077D73A50BE7D2E36BD49D75308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610684, "uuid": "157ec6f6-2bfe-415b-b51d-6ad0c2bf5e37", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610684, "uuid": "8a2e8058-8222-4434-8abe-9299c3c78668", "value": "49152:fjIJ/Kg6NGN+V+efZCM8jr/dWQciyvFTaFAtfP322EcERaScBg:0FtKk3eSJ8T4cHgYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610684, "uuid": "7d6c755d-cf7c-4469-9d9b-e807df3f1219", "value": 4095488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610684, "uuid": "1abe6d55-8c97-4d0d-8811-45c48bc55e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610684, "uuid": "58333522-148d-42b3-b4c3-01b2407dda2a", "value": "0cb4cc8a9f145e69c6765bc81faacc7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebbbfe7-ecca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711606548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606548, "uuid": "8e17b70b-edff-4c0f-aeca-a2ea32cd4f82", "comment": "Malware payload", "value": "3003c62962a7f04ff69fee6ecd19395c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606548, "uuid": "03c35980-52e7-4fd8-bdcd-fd9d04260667", "comment": "Malware payload", "value": "aebdadc68f467c9463362bf8eb6b165b341b0e4a08f11e81d58520ab7319ca5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606548, "uuid": "bf5442c2-ceab-495b-bea5-b1b991a75ee8", "comment": "Malware payload", "value": "87d4bf436f00b3254036ed6acbe85633e081b90a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606548, "uuid": "e856b8b1-60b8-4e4d-a5cd-bade56d84e63", "comment": "Malware payload", "value": "4eacdd1774d250c0a7e1b9b9c2a06760ea4531fa538d0f3f30408768d81f9de2476fe56fe58277a1434af9e44385bb09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606548, "uuid": "1dc10587-e714-472c-8d76-7df169f0242e", "value": "T194D52302B9C58DB1D922193756254F70A63E7C302E75CEDBA3644D5F9B636C00E38BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606548, "uuid": "e0437170-394b-4b0b-be9a-0dfacce49a3b", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606548, "uuid": "3643d5ab-0d89-445c-aeb4-f451215e49e1", "value": "49152:VIL3nYrQ8XcQTYS1DoAgzmfQT7P4VoDU1JDUjgjXU2jSzkOTEYN4WwwPm+cTtX:V4nYrp7kSGA8mfQTTqZUSjSgxmPmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711606548, "uuid": "d8da7d47-63d9-421e-9b77-f3dd8c533c72", "value": 2993488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711606548, "uuid": "67d1b92c-6647-44e4-9d5c-609e8fa31788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606548, "uuid": "5a1d6fc5-0236-4a08-a5ab-0be57bdf780f", "value": "SecuriteInfo.com.Trojan.MulDrop26.45354.13674.32221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c23d5f-ecd0-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1711609222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609222, "uuid": "a7a2e1e5-30f1-494f-a215-23b1dd744bfa", "comment": "Malware payload (Vidar)", "value": "8dae8b6a6be6e3527183594d1c26a2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609222, "uuid": "912d3d31-113d-4299-b052-3caa152d7373", "comment": "Malware payload (Vidar)", "value": "afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609222, "uuid": "76b56d3c-6d01-4622-bce7-f0b10924c360", "comment": "Malware payload (Vidar)", "value": "b87e40cee60869a36e79c88c8a3a34baf0bc4889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609222, "uuid": "ef4e1875-5e41-4669-8a64-4fb902c26f81", "comment": "Malware payload (Vidar)", "value": "fb2d0a95b4ccdab0c82f8a5fb6036de8f30c05dba6f8bcbfcc94d19ecea141e8a79ff1297f0d12b71bc488fe52426442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609222, "uuid": "061690ff-bee3-4c7b-afef-9bb74d847ce4", "value": "T11D548C2176F58435F3F79E3059B3A6950A7BB8737E34818F2668122A5E317C18E72723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609222, "uuid": "bc3df421-e376-4d21-ab50-7496d74cfed3", "value": "e381a5a93083caf35e69fd7d319ba0c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609222, "uuid": "e0aa03e1-2bc9-42af-bbc5-ad8c136909cc", "value": "6144:GtcSsUDC2OZuhYRQqPY3x/OKV/LYZsTZgzENh+a1:TSsUO2cuhY1m/VYZsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609222, "uuid": "75945cf1-f534-4b0c-acf2-c60704a76541", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609222, "uuid": "1c8ccfa2-f2ab-45e3-a838-416260129da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609222, "uuid": "8b60fd4b-5823-425f-863d-967f6b4fc27c", "value": "8dae8b6a6be6e3527183594d1c26a2d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cee983-ed2f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711650053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650053, "uuid": "7f6884ad-5854-4176-8a7d-8e34e19a2516", "comment": "Malware payload", "value": "a7fd0906a9ff298dd752e7165317aa61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650053, "uuid": "450515f6-4ed7-4a62-858e-5ab39d3de47c", "comment": "Malware payload", "value": "b219094323a77dd707533c7a3c77ebc64d7c1e4c512a8249a2284d35cb83e020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650053, "uuid": "134937ca-8060-45b2-b5c8-d3519a62629c", "comment": "Malware payload", "value": "3b7b20f2eb6202ba91598cf23ae5fbc37673ef0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711650053, "uuid": "73f37e17-ec27-47a1-870c-06513ab93de4", "comment": "Malware payload", "value": "66ca1ef9afcc13806ad696993d7574a3c0ef266108aa789f707cb9cd8448be79035a7c81748291bbc199400bebfd66cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650053, "uuid": "fc248b0c-23f0-4bd2-98f4-c569ad89a46d", "value": "T1EF667C90FDDB50B1EA43193044A7627F2731AD098B24DFC7EA147F7AE877AD10A32259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650053, "uuid": "10b8ef4a-38b6-4af9-8e69-bda0f01db216", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650053, "uuid": "eeb5acd7-d0d6-424f-9e23-435a756da6e6", "value": "98304:PXE0Ycqt+QdV+nIivJAo50ELMxtXvYfKre8Mjocc:f5IVq0SMxtXvYF5jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711650053, "uuid": "b6d5a7d2-54bd-4fff-bda0-7ff077c0551c", "value": 6729728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711650053, "uuid": "dbcb6ec0-1197-4703-8a20-764628741811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711650053, "uuid": "51d0350c-0ecb-46ff-af00-c43cbdb20095", "value": "SecuriteInfo.com.Trojan.Agent.16707.14121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0820f5-ed5a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711668316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711668316, "uuid": "36646321-49ed-47bb-8ed7-eb9cc124259b", "comment": "Malware payload", "value": "e062993efb23581109f7805c288783ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711668316, "uuid": "820ae124-39a1-4140-9342-d0111233ef29", "comment": "Malware payload", "value": "b3534d11d00582370c948f9a314d9a3d54b3b05292acaba756fe40cd01b15fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711668316, "uuid": "490b3b52-6e29-45c6-a01c-a9f2d750915e", "comment": "Malware payload", "value": "94080af66b1f0d902035122e4474576ad9dbdaf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711668316, "uuid": "f5f9121b-d259-4b3f-816d-4df2a8a1da54", "comment": "Malware payload", "value": "039da6c974dde3692f6b038b3c8ec4ed1b8f23ad2fbdaee09e0585766412840b22cb32d2d79b996cd0f0b4a0eff04139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711668316, "uuid": "88c6c01d-0afe-4776-85a4-3c6b563fd4af", "value": "T1B816333AA6908C20C76E17756483FE554B10C5535B8C936696AEE90BBD31BC2CB3B4CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711668316, "uuid": "a5233417-b879-4b32-8b04-a00536250f53", "value": "b0e61e0342235167ea6b0cd39dbbab85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711668316, "uuid": "e242601f-8533-460a-8ef4-d2fd66bab122", "value": "98304:GjezfWnQE225WlxBP1FTHPwY7hSzmL26WPm4I4scCkm:Me8QEOtFozl6WPm4ljG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711668316, "uuid": "a444bb66-2fad-4069-a3e0-2624ef31923e", "value": 4264824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711668316, "uuid": "1109b928-3e2e-423e-a98c-373e9552b4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711668316, "uuid": "2f948b8f-6a8e-4780-860f-102c3ca76b5e", "value": "getscreen-728974364.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7d8007-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711651106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651106, "uuid": "c4257e3d-b2ba-4d09-85bb-8c046a80be95", "comment": "Malware payload (GuLoader)", "value": "a195eda4a1bac972a294e3ee5b6af892", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651106, "uuid": "7585cfea-0e69-4297-ad53-d65ff28e75ee", "comment": "Malware payload (GuLoader)", "value": "b38108c097315365de5bb45374ddf6d6d37e82466d1c1eee2ad6a4cd700c640c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651106, "uuid": "2f8cc6c9-fdc0-4aa9-9987-616c783bce64", "comment": "Malware payload (GuLoader)", "value": "dd3acd0fb8f6e0e75f6ba14558e5cb388fb2e5c8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651106, "uuid": "63dd8bcd-fa9a-4b7c-b7c4-fdac40fbd62b", "comment": "Malware payload (GuLoader)", "value": "0c6bb98e8d4d5ade24ec35ae4f8f29f3bc879700beaa6aefa813730d5358dcf904c1bb6e8a14384212234ccffbd0e712", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651106, "uuid": "c6158095-7c74-497a-8338-a9be9ff1cc74", "value": "T1C3B3F98A76461FF47D272FB60D8A244DD4B40C22D13B44C0FB22A3D53A125AAFF7599E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651106, "uuid": "fd81e06a-180c-4cd5-90ae-645166deafb4", "value": "3072:K5oZaGnVaQYAXwbzr0GPyxGkhx7aPjAoIxxVoM5BGPbvcIst4TsAar:K5oZBVaQYQ0r0GIGkhx7aPjApxxVFGPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651106, "uuid": "6024921f-c888-48a3-81dc-966c42a2479d", "value": 112398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651106, "uuid": "47e198c1-b674-4ac0-ad4d-cb7264e3c885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651106, "uuid": "c4b36167-4061-45dc-b4f5-eafda2a238e1", "value": "20240327110926122_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecab487-ed0f-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711636049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636049, "uuid": "7f5d4541-a17f-465e-9762-b8b9b379b127", "comment": "Malware payload (AsyncRAT)", "value": "1f2ec9232f191e28fa8d5fbcbfad3a4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636049, "uuid": "f73e480d-e81d-47ff-9fb7-9ffe50e8c748", "comment": "Malware payload (AsyncRAT)", "value": "b3b1a41903116bbc9fedd6403c9ad1976eefdcd50c322859f993a822b3bbac08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636049, "uuid": "f20915a5-5e44-471b-a0c3-52d4d2e9335c", "comment": "Malware payload (AsyncRAT)", "value": "ee22f5b25185c5a6d37e16d3eb52f9515fd6964d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711636049, "uuid": "fed9637c-cdcf-460d-886a-aa39d0c53825", "comment": "Malware payload (AsyncRAT)", "value": "f3ebbcead69031c31f40ffa6d10921ef426356e5525fcc1e0f1fb919fb3c3e29b00ece30c33b3ec07974458fd1eae5f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636049, "uuid": "6ddda35e-a5ff-432d-83f0-16fd08560ea3", "value": "T1DF331947F6DA85B1C68887FAF19BC8C41378E792B2A3D74E788E139519433EAC90544F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636049, "uuid": "52cdd196-37f8-4fc9-97d2-5eeca0d0c090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636049, "uuid": "1fefc2b6-ddbd-45df-983f-b00835a173ad", "value": "1536:Idzg+bioFSXbzMncp4t9vUEUL4NQ6lD1UPko94yQ1Jzra4o35PGCwWCDGD3fNmHz:2mkcpumcvQaB/EINnZD6nLsow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711636049, "uuid": "af46bc69-47fc-4b5e-a075-665296ee5865", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711636049, "uuid": "d2be74e9-cd8d-4356-bfca-f5f7f6f01673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711636049, "uuid": "41429bcd-51d7-4cf7-bf64-954886ec0b29", "value": "1f2ec9232f191e28fa8d5fbcbfad3a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9804b6c-ece0-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711616042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616042, "uuid": "3d09689a-bf28-4b35-ae46-a6e57b107ada", "comment": "Malware payload (LummaStealer)", "value": "ee00befc0e8ddba06dfa8510902aff79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616042, "uuid": "841ef108-c6d6-4f52-82e9-efe26d917d4c", "comment": "Malware payload (LummaStealer)", "value": "b484b5356d00aef00d35c1339aa0c8937f2725cdccc06156d1941ca6bf63efb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616042, "uuid": "0ecc787f-f9b5-4add-b196-d2e4bf751ddf", "comment": "Malware payload (LummaStealer)", "value": "7af7a60d99c8cea7c9d64e87ef2a4bfa56199328", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616042, "uuid": "d8fb1068-d9a2-4bea-9f2f-d5adf2a09075", "comment": "Malware payload (LummaStealer)", "value": "eb4c207f9c69bd63e869df15a97e796fb11ae9abf23aa4b0fb3225886fb6bd5ddba7e17e24e175b38611a505bcaed188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616042, "uuid": "0ba4ccc6-5d6b-450c-ab36-615b7b6070e3", "value": "T1C384C03372E1AC60E6B68733DD2DC694262EF9618D98775B33585E0F04B01A1D27BB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616042, "uuid": "6a2f5e5f-a482-4990-9345-723b6648d055", "value": "d6cc7eef7e91d5b40575c3542ffc17dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616042, "uuid": "35fc4e9a-7342-45e6-bfa0-42ba9fc7f829", "value": "3072:SA3jy8PU2hlpXQ+nIdw4ziY0T+0oU/xil8NLuimFRTxgZX+jJGDCzA4O6VG5Du9S:zmMAs+WiPzT6V7DN1HuU319Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616042, "uuid": "5222afb0-7b41-41f2-a84c-7046499931b0", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616042, "uuid": "5d1d2e6d-5847-4e53-93ba-7cb4d9640d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616042, "uuid": "a9229080-e751-42cb-b3c1-94d6712c2420", "value": "ee00befc0e8ddba06dfa8510902aff79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d65b2be-ed21-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711643670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711643670, "uuid": "8e41e7cb-915d-43b3-9128-94b6959c4ce3", "comment": "Malware payload", "value": "2ecfb5962169fd0cd5481a5bdfa56bba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711643670, "uuid": "5fd8ad8d-8594-4c67-86cd-a0341b7eb855", "comment": "Malware payload", "value": "b50491831cb3674fcdb34933ad61d233ac2cc275ac396d00f7257f9bc0328a97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711643670, "uuid": "36b364fc-319a-40e4-a390-b982a336e735", "comment": "Malware payload", "value": "9e97ed9944bc0442554b423009f1b4950811a4fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711643670, "uuid": "f58ea20a-af4b-4f4f-836e-ddc5df658d05", "comment": "Malware payload", "value": "95ef194290bbf335a2060f8bd5cdaf241a830da097184b2a4887018713bd90f458fd51049897afd05cf372ccac95ea68", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711643670, "uuid": "96b266ce-e674-46e2-92ac-fce2e52d98b0", "value": "T1CC64B0B35D473EC9976D4FC4F942E6200CAC7EF72354D2A0AD98278667F80694E10DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711643670, "uuid": "15d4a9eb-25c7-44ba-9cfb-31ac57c6a04a", "value": "6144:4MJG53b6/eR6+9RtBBg6G/MsfYrxdmQuPrPU+7:4M053bvRDDBBg6NCPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711643670, "uuid": "7016d466-3d3c-4a0f-9783-a0fc67ba3c98", "value": 321034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711643670, "uuid": "16a65041-8aa7-49fc-9c5d-de236f5efd0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711643670, "uuid": "24b8b6bf-5fa4-4e30-8be5-c318781a3bcc", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740baa0b-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711652003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652003, "uuid": "86361d31-a767-49dc-9bd5-e4ab5f7ea074", "comment": "Malware payload (RiseProStealer)", "value": "0ee8874628614a8fb4c0ee5d97ea6c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652003, "uuid": "b11fbc23-0159-4ea8-8eb8-d9af016d848d", "comment": "Malware payload (RiseProStealer)", "value": "b5468ef28fbad7cf3fe6e60f324215f81fb75fd6289c17a587ad418d49aeb751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652003, "uuid": "73f485cb-6dde-4d24-817f-5ed07fd84ea7", "comment": "Malware payload (RiseProStealer)", "value": "63e37e83ee9b2fef519c2c036bf41479899d0b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652003, "uuid": "d7187c92-dbf2-40ff-a93d-916df59c6adf", "comment": "Malware payload (RiseProStealer)", "value": "df00872876d6f4e715c2e03be62ab60a2e2da6b9f32786f10277b8264bc72b4ebf26e37611dfd9700f0f12c90611c745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652003, "uuid": "e01f32c5-27d6-45cd-81c8-c07fd197bc29", "value": "T1BDB5336A9E2EB35BCE9D13314456D65B5DA87A38063C7D1C1888BCB3FABF3428240757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652003, "uuid": "7b3b29f0-212d-43b5-824d-4ed1b00a9a9e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652003, "uuid": "9977f267-9bd5-4ddc-aa3d-665fc515521c", "value": "49152:IxUdtgORpeElG8XQA3TJeQY7qNXaX1D0Z8YB87WF0J:IxUdt1AOTQQY71V0ZL87WSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652003, "uuid": "256ffe2b-3aed-4d4f-944b-a49d91fde333", "value": 2298880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652003, "uuid": "2f32e461-b1aa-48ec-bdf5-b0dd91205032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652003, "uuid": "7dbfce98-9679-4375-bd1a-8b5e328e6cd1", "value": "0ee8874628614a8fb4c0ee5d97ea6c5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf63037-ed0b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711634623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634623, "uuid": "4c7ebff0-380e-4024-b1b0-32631a9f480f", "comment": "Malware payload (AgentTesla)", "value": "3c6f9e3babe0abf7f7cffdd5973478a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634623, "uuid": "21321c1f-bda8-4b2d-8bdb-80f5efe47969", "comment": "Malware payload (AgentTesla)", "value": "b700c973b1bf8d288ca8cfff7d713485f9792d8901e6658bd419ecf7cee76168", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634623, "uuid": "044f66a0-2b54-40d5-8f7f-7b4650fd3189", "comment": "Malware payload (AgentTesla)", "value": "2116090a920f00e5c49efda9b5cf500a4f14ed6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634623, "uuid": "5cd0b3a5-8be8-47d2-a077-4a7052a6b755", "comment": "Malware payload (AgentTesla)", "value": "8705325f242d1401a6e64ffd7df4aaba98ae2ac52dbc75943af20cfbf480028b5ae3bce7e6261660f7006f8d741d2da8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634623, "uuid": "9c360e46-6f05-4dd3-875a-fea2b98d6b94", "value": "T123E4224137E85B95E6F2477710B1508A1B7BB4221931DB1C2D8CB0DFAE3BB1296E1B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634623, "uuid": "ea5196bf-d38c-4a5f-959d-981d0dbe4e7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634623, "uuid": "6e2292bf-3051-43d0-a91e-cfe49f92fbda", "value": "12288:iI0YOwqjCGFiycXxUmyKJu11k8faIsXjpfKF/1+QxX6IqprwSab:dO7ho7RbWBKXN03t+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634623, "uuid": "3d72cc05-46ab-4244-b8bf-17981058171c", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634623, "uuid": "2045a6cb-4341-437d-833d-38db572a2967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634623, "uuid": "2ce50fd4-04bc-472b-a300-09d1ac138106", "value": "BL-SHIPPING INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620328d4-ed12-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711637370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637370, "uuid": "9a8560cd-767b-44c1-85fc-f946fbe37dc5", "comment": "Malware payload (RedLineStealer)", "value": "9aa0e1cb84eaa0bf8e0c69154b797261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637370, "uuid": "e11a6588-ef7e-4b05-854d-8a58385097c6", "comment": "Malware payload (RedLineStealer)", "value": "b72dd501577e9c1a22f9f5cee67e253353c1e1691fd981db7ee188f8c03d8c54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637370, "uuid": "ff7a822a-9873-41b2-9af2-43b92fdb74d2", "comment": "Malware payload (RedLineStealer)", "value": "fec3447e88cc504eb088a2c7e3f7a493e339aa1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637370, "uuid": "591425f2-6c64-4826-9db4-fec4fdf96d79", "comment": "Malware payload (RedLineStealer)", "value": "167e215160978c0fef15876db2bdb307be566e9f45144fd87cb07fe24e05d8e5589cbd1f0eba77407fbcf60bb925ce80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637370, "uuid": "3779b858-9879-49a2-9b1f-00f6448cccc9", "value": "T12F7422959A789A41CDE3DB30E3F0971B6D364FD265C0A19E34D8A2203F9F3D7CA12859", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637370, "uuid": "3aeb363f-97f3-4d79-9e4a-1696159082e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637370, "uuid": "2b2750c3-8491-48b7-8ab1-18d1ca9a284d", "value": "6144:ycPfB2bf33rP/bWR/3gM/wniJGlXQukamPRiUx8pT76T7Qn48n:DZ2bvbP/b43R43lZkvRijg7Qnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711637370, "uuid": "c1b59513-55e9-4e49-b620-e0f1e163a6e8", "value": 344200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711637370, "uuid": "91369f07-e500-4c0f-a6bd-2609bf919ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637370, "uuid": "0a563c11-7769-4109-b5d5-fbe7049467a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980b3bd7-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652493, "uuid": "66a1c5b2-4d9c-4821-a889-10a43d87dee5", "comment": "Malware payload", "value": "b40cdf49e8bdcf88b2dcb482df35a99c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652493, "uuid": "df326b5e-a8c2-44ec-8624-4e01b27af491", "comment": "Malware payload", "value": "b745791c5958fec1bc601ffa925e9380aa69bbbe57dd7b5b79ccec2fc07aa5c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652493, "uuid": "6fbf3dab-0960-4b21-984d-8e08fcafc1c3", "comment": "Malware payload", "value": "089f78f5ba7825b1fa715c5d584f4253ad3a8373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652493, "uuid": "35cff1e3-99d4-42c2-b811-811e4f2c592c", "comment": "Malware payload", "value": "30573e0753853f029717a3aecae39e41ea8f78f8f48c460640fe0a856823d5bc72dc44deadc72abb4d1afa172d758bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652493, "uuid": "fb2dda6c-12e8-4985-9d49-8f1b9f874137", "value": "T162F53392D33C5802C58AF0BECE47E5A94D81FD9A11DA9F9938869CD31A4BECC81C4DD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652493, "uuid": "4fe32e38-3ebf-4e3b-81bb-d83d6b5178e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652493, "uuid": "99bdcb24-0f1a-449d-a215-3df123f7c4c7", "value": "49152:TSvz8qOXE+nQxBkfiHJ4EUY7HreSZ6qbqRauzchilhQNN+Iit/+nO3h+a6Glw3JO:A/+QxBkfIhUQ3rqQFYl6za/+O3jUQeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652493, "uuid": "4f4e3940-fecb-426d-a9c3-7db85c4046ef", "value": 3410944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652493, "uuid": "9888972b-4cfd-4d6a-9cf4-d7b5ff32461d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652493, "uuid": "bf5fc820-3659-453a-9f10-f4b964800830", "value": "b40cdf49e8bdcf88b2dcb482df35a99c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865db29a-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711642585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642585, "uuid": "5304ee5e-f45e-42c1-a7d4-ea2684b8e47f", "comment": "Malware payload", "value": "30e4f51325061eadeea3ea7fab74f49f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642585, "uuid": "fbac9c80-561d-4cdd-93c6-d312f2deb35c", "comment": "Malware payload", "value": "b7c8d99f15c3f0bd9bf9fe76a0965f226b2cbd74700404f0d351b867f81bbb18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642585, "uuid": "a0099c7d-a812-4aec-8c7c-980d348fb841", "comment": "Malware payload", "value": "fcc4803fea93cd89b0ea8087182f5ea2cdce0310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642585, "uuid": "fc85a850-3a18-4c73-87e9-4afcca8d1d2d", "comment": "Malware payload", "value": "86770cb9d97deb92d3f81374a64a07cc82888e7e1e1609ce16018087a55bb257984e536a33792cee116cd4ad467e5464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642585, "uuid": "06e7d196-9840-4f02-a296-32773c02eb88", "value": "T18D9512E1486D27A3D8CC1770EF7DBC53116B1D87396EA9A42E80B58112FA5C2C717E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642585, "uuid": "86fc68d3-6a5c-4bfc-aaf5-e3370b5cd827", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642585, "uuid": "7ea5c840-042b-41d9-8697-0ca2107c2c83", "value": "49152:BGIpewFyJnbJwyyW0h3BqXH5RWT/rMy7kOWuTySEmvLL:BGWiJ70hx8rWT/4fOWSySEmvLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642585, "uuid": "53ad29d7-9e62-41e3-ad70-d386f18870a8", "value": 1932560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642585, "uuid": "aee46646-f07b-47e1-8a0b-2e014ec5f420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642585, "uuid": "338c33ff-b678-45af-aaf6-8cbb8e0c792e", "value": "SecuriteInfo.com.Trojan.GenericKD.72085429.24047.31308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511d8e9f-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711651086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651086, "uuid": "4202a86c-4b57-4a8a-bac0-5736a4109087", "comment": "Malware payload (Formbook)", "value": "09e1b1aa6f21931c821f0dbb8ffb630a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651086, "uuid": "1c07f228-9fa6-489e-89a8-fea72582ebfe", "comment": "Malware payload (Formbook)", "value": "b9dcf5b6299259d5409b222121e3f866ef697ba83d488a83846196efd6d143f3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651086, "uuid": "1d3aa8a0-7476-4acf-a2aa-57c573bc6185", "comment": "Malware payload (Formbook)", "value": "300abf78bd3f51937752d82e610108a6025d9baa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651086, "uuid": "fb52507d-0d57-47bf-a98e-11ba454bdad3", "comment": "Malware payload (Formbook)", "value": "9cac6482ada9096de63d87f67e5591b92f0ccc7d3f5cc72b761e188c29bdbd3aee3e0f5221c8c165aeb5a236a8efab59", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651086, "uuid": "75968ac3-36aa-4ed6-b7af-f6923d55c01e", "value": "T1F2343BF0CFCA26384F4B2FDAED64445289F98199021228BDA6D917AD7243D6CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651086, "uuid": "37673b2e-3272-471a-84a8-de9481b49828", "value": "6144:Z5hQMLtOBxJrv5lttSP4KuK8jWwoipSRUiGT9rS2fTicm7fIQzmFAjX:bkVB5+jX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651086, "uuid": "f3ed00c7-7bc0-467e-830a-d6476a02808e", "value": 243000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651086, "uuid": "bb7119f3-75eb-4256-8af7-a2a0ae6a1b50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651086, "uuid": "c466dcea-08e4-441e-8ade-0780109e63e0", "value": "awb_shipping_doc_23642.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd17a98a-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711609659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609659, "uuid": "3016b95a-e542-4f57-af87-0c628b551274", "comment": "Malware payload (RemcosRAT)", "value": "f1c673516ee36caffbd05b42014bbce0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609659, "uuid": "0478cd37-b5cb-43e9-900e-49e79e758f2d", "comment": "Malware payload (RemcosRAT)", "value": "be08c20a843cf034dabef11e238c509fb60b6db0bd1c237804f3495d05077870", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609659, "uuid": "ac324126-ab18-46bf-bdd1-566f7585242f", "comment": "Malware payload (RemcosRAT)", "value": "01654b45d70c9f72ae89ec575e46d120dde5218d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609659, "uuid": "ef09b4e3-5a66-49a6-a44b-b44f3aea7db3", "comment": "Malware payload (RemcosRAT)", "value": "ba6d8caba68379bb664652bc63a4af2968b5ce6acbd802f5a8aa74d6593296f16b2668076ea5d4179762506979bb490c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609659, "uuid": "05605aa4-1e42-42f9-a0dd-519cc3b906ef", "value": "T1B4226CA2FE0B491DCD183BDCA4420C1692B54B09A476647ABDE41397660EC9C37BDF5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609659, "uuid": "c8e8dc23-d7da-4a42-8218-aaf10fb8c9ac", "value": "192:2KpHsy1NxKqBarweErqCLXH1dZQsj/n7m5+YSN+:2KhbAqArweEqCBdNLa8Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609659, "uuid": "43f4696e-5e41-4d8f-9099-225032952ebb", "value": 10669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609659, "uuid": "71c242fe-58b5-4ad7-88e0-7cc60d7fd949", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609659, "uuid": "d38a92ae-fe66-45e8-af01-b98fe8c77afc", "value": "FEDEX-TNT-OVERDUE-UNPAID-INVOICE980055177854.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8be81c-ecac-11ee-a120-42010a9c002e", "comment": "Malware payload (CMSBrute)", "timestamp": 1711593446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711593446, "uuid": "daad9e3e-0ea4-44ec-affb-11cecd7b6251", "comment": "Malware payload (CMSBrute)", "value": "bab406ad3b0603a45625755ffbccce49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711593446, "uuid": "263d8327-2c9b-418a-8ea8-c0456aa6d4af", "comment": "Malware payload (CMSBrute)", "value": "bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711593446, "uuid": "c2f86c99-e0ac-4143-956c-c8eb7fdac113", "comment": "Malware payload (CMSBrute)", "value": "7ce0bd31c68c5b54854098acad195b7a8d804939", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711593446, "uuid": "a1bba6a6-7920-4558-9a0c-9e58849e09ce", "comment": "Malware payload (CMSBrute)", "value": "1189c046dd95e2bb061e3d041f81c07ee985e2d5ee26c9e429d516c825345df571d09a13367b01721d61306dead61727", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CMSBrute", "colour": "#9A5433", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711593446, "uuid": "a90070d0-7311-4bd9-9e44-8e352ca1a2bf", "value": "T1CB952334B2B4C871E2BB74306C809961097F7C715F7097DB359D263D1E716E28BAA3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711593446, "uuid": "80e6b086-5d67-4761-961c-0230102e4ad1", "value": "409ffc0f497d7a8c723e7952b781d4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711593446, "uuid": "10e0d7da-5d0e-4bc1-84e4-1cecad014a0f", "value": "49152:hgWDef4IXn7EvfNf+x83OeG5ztpAEq2pe2n9SCtQV:hvo49fk83ONztiEqz2nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711593446, "uuid": "18d6558a-b0e6-43f7-99ad-044f57061180", "value": 1955840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711593446, "uuid": "f8e00465-69f0-45f0-b71c-e6e9afed80b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711593446, "uuid": "05dd8c61-a9fb-4b48-919f-5800d7a80495", "value": "bab406ad3b0603a45625755ffbccce49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6ea850-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609896, "uuid": "9bcab7b7-5def-499a-b45b-c7f88c8f125a", "comment": "Malware payload", "value": "ff0c35b042b9b0d4c3a8cfcdb7368126", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609896, "uuid": "09e143d6-caf0-4b8d-930d-f04f95867822", "comment": "Malware payload", "value": "c0032e24d36e1409d7c206d625cd738bbb654a790c5501141d28a8cb6a30ab97", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609896, "uuid": "7c0fb7fb-8f96-49bc-833a-edd9ec08de16", "comment": "Malware payload", "value": "b49734a20827722cfe5b6397807c5ddc32ba46f8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609896, "uuid": "b8db4a0e-d9d7-48c4-9f00-d12e59284425", "comment": "Malware payload", "value": "ffde77779833ac4b8044dc1a52c3bb5eadd99711fd79c1d54d99269dfd1fc30ff8d01c5aad8ec0f278317e83205dd2a9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609896, "uuid": "7866df2d-ae0c-49cc-8720-554551a130ef", "value": "T15803EDD29A951B4849462E7FDC2B16BB8CF6825C32321AB05B7AD13D670348859BF7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609896, "uuid": "fd2e5213-0d5d-47c8-8b23-64d136e2b7ee", "value": "384:u0tgBuHDUIWz0AujGKoCJmMuttrW6ku83V3aiHwEXqRrGudIF5sbacA/zm61hzGm:u0tgBuHJWAZGc8NnKwiQEoRbo/ziR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609896, "uuid": "c66da6ae-1602-48be-924a-2a84ce68d6ca", "value": 40608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609896, "uuid": "6f2a1e22-59f9-4226-afb8-c2275da7b355", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609896, "uuid": "fafb25cd-fba2-4307-bdf9-3b3ff5c004cd", "value": "Zuvillaga - I, SL P.Order 25621348 2609.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a89be8-ec9b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711586482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586482, "uuid": "cd78702f-62d4-4858-942f-d4215445cac2", "comment": "Malware payload", "value": "607b84dd65491c3a874b424055ae07ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586482, "uuid": "09446c09-adf0-40cc-8e31-f730903d5f4c", "comment": "Malware payload", "value": "c06593ff827ef7579a8612a6e92262683469d2314e6d1aa930c1b032e6320ec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586482, "uuid": "37bf33a4-101b-47b6-8951-a753dd5aa8af", "comment": "Malware payload", "value": "2e9c07b3296deb6cc3c9dfd6679852ad96de7fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711586482, "uuid": "e3363ebc-d6b2-439b-80be-2f9032cb9dad", "comment": "Malware payload", "value": "65da5fd44d44ccd7e6cdbfbeb0b5297efeaf792529119f17dcb98a8389427ad5c9599cf29dd3cfb5529075eaaec2bbe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586482, "uuid": "605bc711-845d-48d4-a997-3f36f9a82102", "value": "T182E633884FC92B2CF21C4EB1D8B0011E267F9F7A5AB9A321DF59FA3974352C917C1586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586482, "uuid": "ebe05fe4-b317-4527-a638-ad1b6744de85", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586482, "uuid": "faa70d5f-5718-44c3-9341-cbc01e82d5df", "value": "393216:exE2yDvGUTv7dKkQ8+zcNVszByvtIS4LjJmMrCpriCOpX:exETTTvUNrzQ+8vt61mMrgCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711586482, "uuid": "13f72768-33f8-4be4-b180-1a50d3b22ccd", "value": 14605064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711586482, "uuid": "5af55a0a-6af4-4e15-911a-82e9020764b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711586482, "uuid": "49b01313-4cc7-49fd-91de-c7d182024f50", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.3839.14708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c5b5d5-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711609813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609813, "uuid": "edd8a148-f507-4e2a-b395-18e4e8cbae22", "comment": "Malware payload (Formbook)", "value": "cf18b1f1d01b556103ceca81efca2a32", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609813, "uuid": "a1db5c70-339b-4e40-a4f8-41f78e11d274", "comment": "Malware payload (Formbook)", "value": "c0faac0aacd6a63d5cb4e508a2884434d77aced3c6299dad91e982daeb26d827", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609813, "uuid": "571ce35d-4a0f-4b14-a222-fce2cbf91385", "comment": "Malware payload (Formbook)", "value": "18e7362eafd3b355b79005d82267c3f96e1a443b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609813, "uuid": "ea3f2799-42f6-449e-92af-0d62078c077f", "comment": "Malware payload (Formbook)", "value": "d945f32761a0c8db31e2b90e93e1ab333f010d12524e4c050d46a792154e43c26349454e44990cc110e338fc3b044c31", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609813, "uuid": "1ca67214-d089-4717-8b4d-fdb64b35b600", "value": "T11AF41262115C2722C9A95BF1859ED07217711CC798A0C3495EC6ACCF3AF9FD08639FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609813, "uuid": "1fba800b-0560-48f7-8fbf-1508898ba3b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609813, "uuid": "d0ed2c19-1de0-484a-a00b-98bd68475795", "value": "12288:Skcayww0o4cPXlR1jYpiJSVrNIi0uibblrZi4DwjydgZai9l3XYU/BCDn4kR:EajA4cP1jY8sdt0rbb9E4D6Dz3oUpCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609813, "uuid": "71ed989e-00ee-4e5c-9e8b-32c7d63f7e81", "value": 792072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609813, "uuid": "03811a87-c6ab-4ee4-bde5-2f0704d5190b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609813, "uuid": "04456d05-2a19-42d9-8596-6825cf889b6a", "value": "dhl_customs_form.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08444350-ece8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711619181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619181, "uuid": "e5e62158-0a92-4e13-b7ee-b40436e18929", "comment": "Malware payload", "value": "3cb61ce448a806e79ce88d06e992cc9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619181, "uuid": "68457307-bc9e-4030-bb46-b0b009d81bb7", "comment": "Malware payload", "value": "c2dcdab49f620d41cdff93c58a50c760906ea2565001145564a1491defec08f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619181, "uuid": "d6defaad-db77-4d1f-a940-ad3eaeb77dd0", "comment": "Malware payload", "value": "0a5e460360364f1b5799df7a2168892c04156bca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711619181, "uuid": "35b08261-1b39-48c0-9607-3d4b602faa64", "comment": "Malware payload", "value": "f3a792d4dbdff02a9bd5a89a08af7749e8c64fd6f26ea7cfdbc6c1ee6c1ab1b58219b5aabb2063c037e77bcad4c8841c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619181, "uuid": "21a7ee62-0cc6-4c09-b3e5-51a89acff04f", "value": "T12332FA0BAD905532FBF008B055BB914B8AFD29A327D5A88FF780A50A1D753A0C5717AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619181, "uuid": "79f8d12f-ed6a-41de-ba54-73ff09504a99", "value": "38ca2cef077b08d131c2be3bfd70789c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619181, "uuid": "219a55ec-934c-45f7-8974-abb742327c18", "value": "192:d6eQ8BFOXpVfXfGhegWJJfxMLkWScZqYSi/HB6U:d6eQ8nAnOgDTxMQWSc9/6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711619181, "uuid": "a9bafd49-d7c7-4588-99ef-9338fe3ef005", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711619181, "uuid": "ab064556-0cf4-4afe-90de-c880e19acec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711619181, "uuid": "906e9ad6-2423-4f2e-90bf-de9b98233233", "value": "3cb61ce448a806e79ce88d06e992cc9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18062ea9-ed3d-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711655714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711655714, "uuid": "eb02c5ea-bfc1-4ba1-be51-1be5a1b44658", "comment": "Malware payload (Loki)", "value": "06e4ce3aa8ae08067b686ba000255529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711655714, "uuid": "cfaf318b-a7bf-4429-a454-4aea2bd6b22d", "comment": "Malware payload (Loki)", "value": "c84552f0ddf17223045ee2c4e5aa5a4b59eea802f9d1548b0ff7e5cee3d14186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711655714, "uuid": "64b8c31e-cebb-4373-9f08-5237a9ad353f", "comment": "Malware payload (Loki)", "value": "21369f523a74aedde8612c9dbf6d5b9df6557a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711655714, "uuid": "8289111c-4d4c-46e8-9af3-5ec78c0b6325", "comment": "Malware payload (Loki)", "value": "c63fcfc9fc469fe9cb3ed83f933faf15083a3523449f72904e9827379c998be61aa8d29bf53615e870cd947dd549569c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711655714, "uuid": "983ac65d-7b1a-42ad-851b-15e2577bdd6b", "value": "T14934F241E2E5E8F2DD86923A4437CE7D5B5FBD482E90AC17B912F70E9CB1EC0A501572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711655714, "uuid": "43d7d064-ce73-4617-b44d-7cc1765bcb82", "value": "d61a8b9d7d6225bf27124078418a3c99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711655714, "uuid": "4a9cb923-1067-4dca-a021-0de706261f37", "value": "3072:AN3O9HE6pE5ew7kIHu8ehLE+lEGoSmLhlvKaefv4gFMcNpC3wom0d:AZO9HBa5LwbthLxodhlvKae4gJTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711655714, "uuid": "823f974b-a537-477c-8e4e-1b80e25896a8", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711655714, "uuid": "f73331fa-05fb-4929-80fa-337d1d92f9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711655714, "uuid": "81071fff-51fb-4a8d-80e2-a0bb35d72f7b", "value": "06E4CE3AA8AE08067B686BA000255529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056878db-ed08-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711632920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632920, "uuid": "510894cb-3731-4dbd-92a7-f5922a7c96e8", "comment": "Malware payload", "value": "2280241dc8c25066b40ac98ca4a6a67a", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632920, "uuid": "56f3db9c-7af5-46f1-974e-23a57708f228", "comment": "Malware payload", "value": "ca427b48b46e150ed7a88cd1365392459788a6316b7d4544c5421781e60bd3e1", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632920, "uuid": "e286d210-c561-44a6-9797-8bc88bcb431f", "comment": "Malware payload", "value": "78517d2144b407ef220053b4f1579730b527ff38", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632920, "uuid": "06d29f44-60be-43f4-b841-1fd1a6434632", "comment": "Malware payload", "value": "20a5812c3a373ba5609ee58d2dfe85bed60e5ad9b1e1dd82b1c672357eeac41b7019c68af7f928edc5b405ca849fe899", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632920, "uuid": "602d7390-b8f8-43a2-84c8-c03db55c8e41", "value": "T19A0149565A79E839DACCCBC984C469041032D9DB6198A63C8BA884469E8DCDDBBC0A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632920, "uuid": "f106e454-f09a-455b-92e8-ca3a684be51c", "value": "12:X+X4Uy0RQhP9dD8JJ4qGqKrE/2asYRGf9sBnwoZi7WWNX9tayGlwm28uM092t1+9:Xky0RcnD8JoqKjnY8Vsq2WW4HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711632920, "uuid": "02c17d3b-e67b-446a-a0d0-4cda729c7084", "value": 681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711632920, "uuid": "808dca8b-238d-4a0a-abcf-bdd10d5b445a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632920, "uuid": "461ec68a-1716-4361-b8cd-36516d736013", "value": "shellcode_keystream.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1299ec2-ecd5-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1711611303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711611303, "uuid": "aa2fd12b-ac84-401e-a6f6-c10d39d11372", "comment": "Malware payload (STRRAT)", "value": "81e621517a407ae36da0a767b960c88c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711611303, "uuid": "8e1dd3f7-e758-4193-b4d7-aa6c27bf930c", "comment": "Malware payload (STRRAT)", "value": "ca438598c383fab834c5e52369032e30c657f8f70cbb095f181ea7779d34bba1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711611303, "uuid": "9146460c-6080-4a04-92b7-f519be7d5b5c", "comment": "Malware payload (STRRAT)", "value": "421f3489d10b803e2dd64d0b47ce619da2da448a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711611303, "uuid": "8ac945e1-ece3-4e96-9f81-f5b506479a17", "comment": "Malware payload (STRRAT)", "value": "0d4ad60e4473ebd3bf38e3395cc23229c2b7fd40ab7b5a1b822f241e54b6066bb5f29bc6d0228bd119c37fabdef773cc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711611303, "uuid": "9c26f728-e9f7-4abc-b10c-974d5ea01ae7", "value": "T185843372E576E4C8FD49DCD2730CEE75698A5EAC47ABE02251201B7458418F9EEE0C8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711611303, "uuid": "6ee51874-c274-4805-9ab0-aeb8540572aa", "value": "192:WtZ3hAJtjmbwOqaI55LEOkOYiDiMkCjvDhvLlSIz3v4M3LwsUE+1MB7hikCOrPiH:cZ3hOOJvsEOWGWCjvSmwM7wsTvQMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711611303, "uuid": "c3816b2b-fd86-45cb-874f-7948a43e8f86", "value": 405300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711611303, "uuid": "666b6020-69e4-4b28-b0f6-61e738a75bc0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711611303, "uuid": "5148dee4-0c2e-4670-b839-527e952b9929", "value": "Telexcopy.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69f9beb-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652571, "uuid": "5efcee39-3e07-4e2b-ac06-dadc01138b27", "comment": "Malware payload", "value": "464ea1bd9930cd4ecae392d7214c3905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652571, "uuid": "f15c737e-d39c-49ca-877d-a28f16ede253", "comment": "Malware payload", "value": "cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652571, "uuid": "a3ba2a34-6794-42e3-9a9b-cdf03348454e", "comment": "Malware payload", "value": "525be920ce25cf340d8e47a0f3fd993a908449fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652571, "uuid": "5df1bfdc-cf1e-42e6-8df4-8ab53f7cb554", "comment": "Malware payload", "value": "a841d306cc3b4b279a4a754284fb2f1319ca3a37999879d4ef7cd93a518be90d26b9bc6697dda40f6d70633b9b7b612c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652571, "uuid": "b0378fb0-b026-4e1b-98c3-13428ceea6f6", "value": "T1017423DFB69A5418ED3626F3DE5652383B1574580B460EFF9D7B6E20A010FA94E28F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652571, "uuid": "f6f95673-cdcd-4b0a-99c3-aeb3ea58f6ff", "value": "be49a2411263045f8ee0c442783b5f83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652571, "uuid": "62f8fab7-0d56-40e4-b9cd-6a6cbff31e54", "value": "6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqrsb:gf2R/EEkCQFYDwRqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652571, "uuid": "71007a09-00e2-4235-bca1-1c200c7b2ee2", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652571, "uuid": "47022f11-ae87-4287-8ded-516ab06ce2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652571, "uuid": "8dd8e67c-0b85-4b92-90b8-05ac0468d9a0", "value": "464ea1bd9930cd4ecae392d7214c3905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201524ad-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638977, "uuid": "ed17dc55-c9e3-4fcd-84d6-fab802569a23", "comment": "Malware payload (Mirai)", "value": "218398149c86a970e2b9ca770540564a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638977, "uuid": "8650e393-36bd-42cc-842c-3b3bda043324", "comment": "Malware payload (Mirai)", "value": "cb23af394b5314e696f9ce8be1a38e064bd3836a0c81b66879161e5f5f1f69a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638977, "uuid": "4ab870a2-88c0-44ad-8589-5edc55aba996", "comment": "Malware payload (Mirai)", "value": "3212184f21268b75cd5bec0d5fbdd2b463c94787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638977, "uuid": "7b7f618d-2a5f-4bca-905e-26da12208d73", "comment": "Malware payload (Mirai)", "value": "9b1842efbad2ffdec4c02091da826cb3fa54c93e9fae030cb642e6b45ed2095d8221e47db4a3e0e66488751a67fa2a52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638977, "uuid": "d19d89c2-9945-4578-bcc6-8842d37687bf", "value": "T14C531847A8A29EF7C105B9B139771A64035FB9125F1F0AEA793CADB0030F5CAA05F365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638977, "uuid": "9a51bd60-b44a-4d18-888b-203c21a73903", "value": "1536:gDXDVdm1O/tTB6Mt+5Y1XYtwH/TCrjAozjF4:gHXk8t6eXYtwH/TIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638977, "uuid": "fe513e4c-8b7d-44d7-a4d4-4a08a2e4fada", "value": 62474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638977, "uuid": "ece02229-2779-4266-9a0a-3c527e004471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638977, "uuid": "83c0c75b-ce97-4547-9765-9a43aecd26ba", "value": "218398149c86a970e2b9ca770540564a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee85f9f7-ed39-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711654356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654356, "uuid": "93dfe74f-0568-4a5d-9d6e-393577e44573", "comment": "Malware payload", "value": "556188c8bf148d99ec2b01174def0bc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654356, "uuid": "6a9371e0-739d-4331-bd5a-7446731292ea", "comment": "Malware payload", "value": "cb538c71fb317e9c570e6f28e23c428cb3fd33ebcd9e21a49b7c8692e70956db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654356, "uuid": "f1435ff3-4033-4265-95c8-1e878269f32d", "comment": "Malware payload", "value": "4431d79dd298a673633648f7ddffb3d4d1c537e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711654356, "uuid": "b3a7d553-832c-4c56-8704-8346646aed05", "comment": "Malware payload", "value": "a3b2c6c43e5674bfdc188a64100d81f39bf860bdcf280a71e5274ab47abbc90e12bb6cfaf963ec464cdd8324adce4c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654356, "uuid": "f1d80a66-432b-4863-b5ed-795f652ca6f6", "value": "T19C95017742D8D77AE150213D828CE4E268A41ECCFBC5D9C6FAB67CCEA4FDA534124612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654356, "uuid": "7e7891f2-c55c-4b33-8039-a9ee88aa2d76", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654356, "uuid": "295f83c0-394a-41d2-8ec1-4131c7a55c4e", "value": "49152:PbrmcFtcE6Nlde2gUf93EYMkLxlETlM3sjRHm1TN3r5i:P/m0t7J2gUl3EYMWATlNjsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711654356, "uuid": "c3525221-6371-4cf4-a6a6-bf5bd7fa89aa", "value": 1882376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711654356, "uuid": "1095ff7c-2635-4242-a7a8-8dbf0df9e967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711654356, "uuid": "6765b368-f963-4baf-bc75-25fbb9550237", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.16108.21776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6f2f51-ecb8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711598870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711598870, "uuid": "37e5271e-b879-4a63-ac02-4458faaf042d", "comment": "Malware payload (AgentTesla)", "value": "b34ae8df913549f1c9f75e813f4febbe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711598870, "uuid": "fb9a20c4-68f8-4f39-892e-27b2e6da208c", "comment": "Malware payload (AgentTesla)", "value": "cb65e696842c0650692cde3eaf4b37d1fb5a90b21c89fc2b14d191f06b97d7a3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711598870, "uuid": "875106e3-f85b-4a5d-a70f-2534aa4de010", "comment": "Malware payload (AgentTesla)", "value": "ad9e6dbbbcce62b76a2e4d8997f41f00d0516b03", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711598870, "uuid": "dec087bb-effa-4490-8a1b-3f57d8797399", "comment": "Malware payload (AgentTesla)", "value": "7b4c7a7ad55582cd2607bee41d188d0549f0e54fa82a03ef0b895fd5a40414c178fc912a985efa75df3595bbb2df0fcf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711598870, "uuid": "165ab085-71a7-458f-9137-e9941c2cfcdb", "value": "T14DE422623B64CA16D9CF2A746C32F1B10134BEAA5C008E2F7DE57F2F74763C21651A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711598870, "uuid": "15feba5e-47f6-494c-81be-7f0a7d3ec66c", "value": "12288:2VksqBh/3FLJ99PFTI6xfc29DTlNCGGQD3QWoB:2ur/3FLJ7zlNCG9D3QWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711598870, "uuid": "25159dec-da7a-44e9-aea6-b767ba30957a", "value": 660328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711598870, "uuid": "dbf96260-ef69-437b-b470-afae6e95c34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711598870, "uuid": "e0ef348b-b2f7-4cc6-ab13-329519b0f07b", "value": "b34ae8df913549f1c9f75e813f4febbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745b1cf5-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711630529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630529, "uuid": "d27c9fc4-80ab-42ac-ac34-d7add3c675f3", "comment": "Malware payload (AgentTesla)", "value": "4c1c86fd8a3fb71ea451791806dbfbe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630529, "uuid": "f90a526a-0ab6-450a-858d-713b5f800751", "comment": "Malware payload (AgentTesla)", "value": "cd477b7ce28707ff2a532ddf8054f743f0a5ac7cf31a01ae96fe55e089f82955", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630529, "uuid": "e59d70a4-ef96-47df-87d1-b845bc971fd6", "comment": "Malware payload (AgentTesla)", "value": "03fdc8ce41feeac7b7a0d8bf1858f1385272d12b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630529, "uuid": "4da5c197-f556-42f3-bd78-17b612bbc140", "comment": "Malware payload (AgentTesla)", "value": "841f6c4fa93e86efacb1c091733e305f4c9060393c73b4b0f243581ca002db736157f86451fac4118ee0a3605447a2fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630529, "uuid": "ef5876a6-801d-40ca-b0ed-334ffb8269a0", "value": "T1E2E4121226D4D758F4FA8FF1113080211376F6B67AA1EB6D5E8260CF1D77742CA6AB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630529, "uuid": "6e30eb84-5a54-4cda-ad71-8ce8989bbfd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630529, "uuid": "7b7fb4de-d682-4d40-ac84-3906fc320e15", "value": "12288:t/Q0YOwqOpMVE9MG6ssKHKm0yCOd6CxAMYcEX3Ztw66zUW1q:uO7VssKH/N6zJX3Ztw6x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630529, "uuid": "ff377e9f-522c-45ed-949c-45ee117f300c", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630529, "uuid": "308ffa5d-18fb-4204-8294-31d80f2f46a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630529, "uuid": "0338ac73-df6b-4209-87e1-7b275e2f4f62", "value": "RFQ__363564546 -PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6af351-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651052, "uuid": "ab06d221-4d86-4ff3-a041-cf45d9bf15eb", "comment": "Malware payload (AgentTesla)", "value": "bb890594548df51e5957ca2445cd7fb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651052, "uuid": "075e4962-a0bc-47df-bb68-bf8f2f5985ca", "comment": "Malware payload (AgentTesla)", "value": "ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651052, "uuid": "d2b6c8fd-502f-4bf2-9f69-ae00da0b8dd9", "comment": "Malware payload (AgentTesla)", "value": "7aabf17acfff6e33ef68bbccea7b266a48205fff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651052, "uuid": "42e6abaa-eb8e-40fa-97bf-207bb57a03ed", "comment": "Malware payload (AgentTesla)", "value": "c6ae57e164d25892bf915ec1b33a1bc784d033d35f1fe2b2d6ddaa3d8d09290b1b024692e38dd8eac527c846a36e02dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651052, "uuid": "8ba8f1aa-ba8c-4d75-92fe-fc3aa4eadcf5", "value": "T114D4231137A8411EE2EF27B8A9BBA4617679B7B33137989E5444104C1FBF7C023937A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651052, "uuid": "fa58c37a-e1e8-430d-946e-f5ac9039be61", "value": "12288:4SMpPbU8sOUVVhUF+i1c/OGNX+jkniNzXNDu8Z2RjbY8rk45az:4/pPbrUVo+sGNXPiN8W25YqtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651052, "uuid": "81194c43-5ef1-4847-8fa7-86b0a65f710b", "value": 626308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651052, "uuid": "d5c58b94-e9fe-470c-9a8a-a7c9732caf1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651052, "uuid": "f837df76-4d4c-4b4b-9d51-0c3afca67ebc", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131l\u180em\u180et\u180eh\u180e..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3708b69e-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711616682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616682, "uuid": "58f6e7b3-7afc-4790-95da-3c632314b379", "comment": "Malware payload (Gafgyt)", "value": "3af1bbf3875f7ac3c91dbdfac113dd6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616682, "uuid": "97ca04e2-0520-4b23-967e-475110e95882", "comment": "Malware payload (Gafgyt)", "value": "cf24fde7a1365d8f65dce78f57629a8e4510f590cf4c56463b84fe54ef0a726a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616682, "uuid": "039ec6e3-bd11-4d24-a35e-f1c9bf118666", "comment": "Malware payload (Gafgyt)", "value": "9b7c85a21f6b82c69c7f5cadcda530e001ee5a4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616682, "uuid": "2ffaa388-2807-402c-9bc7-020a237902c0", "comment": "Malware payload (Gafgyt)", "value": "ce4db921992ee3b2a5189c021196aafe4012bb2274a09dd75848a7eb41cbf7fdb46b331c0cb36ff151fdcee87a179985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616682, "uuid": "c2c48e54-357b-4023-93af-1eb811d09dde", "value": "T17BA3D717AB51CEB7C85FCE7306AA460120CEE45612E46B6FB274DA6CE74B94F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616682, "uuid": "be5ba7e5-623d-4cd5-ad3d-24d2a2c360c3", "value": "1536:kGeTzY+eXiKbmTYWZMbZMPtAw7p7sXjYggph2ymOimW+zWBSirHzai:k4k/pOZM1p7Ngg/2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616682, "uuid": "25565909-f3c3-4870-b2f7-a0dfef74e575", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616682, "uuid": "087ad907-20c4-4815-a69c-49cd7d01a56e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616682, "uuid": "ecc1f565-a925-44ee-a71f-94009a9d3e90", "value": "3af1bbf3875f7ac3c91dbdfac113dd6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1965d2c6-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616632, "uuid": "ac40e49c-7d19-40c4-b116-802529fb88eb", "comment": "Malware payload (Mirai)", "value": "0c4d29b3b5f636c736d0edc5521755b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616632, "uuid": "730ea9f9-fe83-4793-9366-7f3a4fdea4f5", "comment": "Malware payload (Mirai)", "value": "cf28cc1ecbaef512456900e5f351c16d4762615ecdf5f742455d3e457772b9f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616632, "uuid": "836cd0ab-97a6-4a34-a136-59251755424c", "comment": "Malware payload (Mirai)", "value": "1d91466769025d5299f91032fa9aaef592e40cc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616632, "uuid": "087650be-4f75-4105-be5c-0407f35866ec", "comment": "Malware payload (Mirai)", "value": "b57377b5f6eb096934c0104cfdb241eb95e8cd029c4bbf4688ff04df0466c2460efd3d0b1fb03e7c3ac18b31587a4768", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616632, "uuid": "c993feae-22fd-4db4-a4ea-abd850138bb9", "value": "T1065318A1BC915A6AC1E023BAF9AE418D332173F8D1DE3617CC110B547BC991F1CA7B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616632, "uuid": "d0e8cfb3-d8f8-4b2e-b49a-cf34f6a13014", "value": "1536:KMhftomyMbFmf65U/2r/x6tMplG9WeI3El1dXd42+Op:KMHCgk2VyMvG9xIcDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616632, "uuid": "25a609c7-7e68-40bd-a7e3-82184e480e8c", "value": 64716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616632, "uuid": "3df488a4-f00b-4952-994c-0c84d2e6a484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616632, "uuid": "738b0fa9-f219-4864-abb0-1eb9fe598036", "value": "0c4d29b3b5f636c736d0edc5521755b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fabc1f-ecda-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1711613343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613343, "uuid": "52aa9aa4-7845-443f-87b2-51768820d166", "comment": "Malware payload (GCleaner)", "value": "c4ec38ae5ddce37cb56b4c6d88bee7c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613343, "uuid": "e163d49a-1e9e-47fe-a465-c39ae169f040", "comment": "Malware payload (GCleaner)", "value": "d0d93869aac6091af6c953475915831f4b300377931bb4dac2adcdceeb5616b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613343, "uuid": "394609d3-e150-498b-a0cd-67fd662995ec", "comment": "Malware payload (GCleaner)", "value": "ad97d501d7d2dc64f23ba989139fac33f4dbdec4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711613343, "uuid": "7efae640-1616-4f35-9e42-96c3ca41cc84", "comment": "Malware payload (GCleaner)", "value": "8437b75dcacf70109991b2b95e9e0c2989a854e1bb628f9f867aef425cb3837fc1dea16c8bdf61c7ea7adbb9aaad74fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613343, "uuid": "ef33282b-322f-4d87-905e-7b4cd3d0ebf6", "value": "T192648E3372E16C64F6720B33ED3DC694262EF9614EA96B5B33186E0F14701A1C6AB753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613343, "uuid": "4d489f60-a17b-4101-baaf-ea5fa0aa632f", "value": "d6cc7eef7e91d5b40575c3542ffc17dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613343, "uuid": "f2e6865f-544d-4380-a94f-f4f3bf579578", "value": "3072:0u/Yc8E9PlkOF+XldS/yBjQuhLSLf7tU7zCHCOkSPK412YdBZxo9XOddA:zFKkwvSj7EuihSPKo3LXo9Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711613343, "uuid": "d3d1c967-b0ff-43c0-a068-929914d554fd", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711613343, "uuid": "bb672f34-7fbd-4567-9c10-815b0b7e5a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711613343, "uuid": "1edd8ba9-d58b-434f-b3db-25e34dd7b1d2", "value": "c4ec38ae5ddce37cb56b4c6d88bee7c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2ffb9c-eced-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711621658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621658, "uuid": "ccced46f-bdca-4542-aa2b-1d29ed01ac2e", "comment": "Malware payload (AgentTesla)", "value": "b1f42dab84b254f5595d45fd7282496f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621658, "uuid": "69de14ef-95c4-4d4e-a6cb-ef8c921ffb11", "comment": "Malware payload (AgentTesla)", "value": "d0dcfea187c2da840bfeba21de0b50952c97dc101065a93d94909e2975bfe558", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621658, "uuid": "a73a07f4-9bdd-45e9-ba42-63752e0b6455", "comment": "Malware payload (AgentTesla)", "value": "71af03e51bbdded888dbb714c67c38809802a1c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621658, "uuid": "ad752ce3-45ce-4dd4-8cf9-1c8559070407", "comment": "Malware payload (AgentTesla)", "value": "17d64ef085aa2a33174787124625df01eda8d3de80549f1b50835e179b06f6d333c1847eb5553033e7e56ba209f1301c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621658, "uuid": "05a3ba4e-cfa8-4e2d-84b2-95727b2eeea3", "value": "T1CC05BEAC3250B9DFC857C976DAA81C64EA2074BB430BD203A01716ACEE4DA97DF155F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621658, "uuid": "9f3fa660-a4a3-47a5-a11b-80c1df00ddea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621658, "uuid": "bf89f706-6254-4a7d-a489-2efa600c91eb", "value": "12288:ZfB+0YOwqOpd95DFtfxIX/kl1goC9yRqt42SfZqLxjAOLbz53bnO2Frs5r0U6+/H:yO7mTfxE/MlRp2SfZqLxUOLB3DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711621658, "uuid": "59c20044-20ec-4d73-be7d-8f1d3547cdbb", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711621658, "uuid": "a4b0c214-1ed2-423f-8ba5-302b6169e96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621658, "uuid": "5d462a00-b833-4fb5-a681-a58a4f2745c0", "value": "SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664ab1b6-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651121, "uuid": "dd6f7674-9722-4166-9b2e-4b4a895eb947", "comment": "Malware payload (AgentTesla)", "value": "e54da1c81190dbd14fc3aa6aed4e75cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651121, "uuid": "e4ddbb5a-5cae-4c7f-a1bf-bce5401925fc", "comment": "Malware payload (AgentTesla)", "value": "d11ccc73abf2ec6aba5040c45e89eabe23a9a364af505abaacd19294148b7ff3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651121, "uuid": "0f40d2db-e842-4417-b8aa-6403f1a04ea2", "comment": "Malware payload (AgentTesla)", "value": "80b36bcb9578acdb2f202d1f2505812180439353", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651121, "uuid": "78ba0ecc-26cf-42f3-b664-4d70f22f2a17", "comment": "Malware payload (AgentTesla)", "value": "ba0f9c254de1c275243ed6e03c5dd1029c2e09c0632b7c64f842f905c998c7f02b04fd4969fbe94c420b51d4435d489a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651121, "uuid": "fee05c6c-5b78-45f7-b638-0ceaf9257e24", "value": "T1D5E4122272E89719F4BA4BFA157885112733E7F71D92D30C2E8670CB1CB2B419769B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651121, "uuid": "0113ce46-1a89-4cb6-b4f3-8049ea2cb1b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651121, "uuid": "2a393816-560f-4adf-9bdf-e165afd29276", "value": "12288:o/U0YOwqOpjIxZhGQ0fwwFTDu8DXeBplNzQZacIafQzmHfhz+ccDSItmIYIo6Ejn:ZO7nw3FTfDuBdQtfOaMPDSItmyo6Ejn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651121, "uuid": "a85fab5f-b0ca-43f6-bd1f-a14a30c1a232", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651121, "uuid": "e906b3a9-401b-451d-92af-6fa7d4567ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651121, "uuid": "36656aab-3320-4080-8fb9-2c3704ff27ea", "value": "YPT23-117419 numaral\u0131 Dekont-20240328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81eb4e81-ed09-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711633558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633558, "uuid": "24c9c1c5-bb1a-48b9-8b25-57230f250f52", "comment": "Malware payload (Mirai)", "value": "e2955baa4ea7777aaeffc86195092e3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633558, "uuid": "20c53aec-60a8-4ec2-b5c9-15809495ac88", "comment": "Malware payload (Mirai)", "value": "d143842aea09ab6d12998a57a2c9367ed5ae6c3dae47faa348270df1594ae211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633558, "uuid": "3f1d3132-6c29-4a3a-9b89-6e1b294071e9", "comment": "Malware payload (Mirai)", "value": "3d73829a9d3c5420238662510814d8be0293ff78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633558, "uuid": "2672357c-2332-4a01-b824-f9b065e88736", "comment": "Malware payload (Mirai)", "value": "a64a65c17db4d1d15264f7144b2bab0f49f164da509b8c5556acac7ada7caf707fb54a72ce71518ab2de95b5dc837c6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633558, "uuid": "7cb71753-112f-450a-af8d-a57f7402a5fc", "value": "T1A063D644F954872FC2D277BBF759028D37391A58B7DB33215A382DB43BC5BA46E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633558, "uuid": "d3f237fc-e5e5-4cb6-a364-033f3e493bcc", "value": "1536:qGJwXwbzKBahJJpTkgPcqFRoTToxK6SNeva:XbeBMpT1PcqF+TCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711633558, "uuid": "2dcdef71-5891-446f-b48a-754dbefe5b95", "value": 72557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711633558, "uuid": "8fa80cf6-b016-4c3c-9941-4f9c0a81e250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633558, "uuid": "d6c6be82-a00d-4e28-a232-77ad3cb9dcbd", "value": "e2955baa4ea7777aaeffc86195092e3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d71988-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711651999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651999, "uuid": "64017662-fb0a-4c0a-aa43-6a84d884e7d9", "comment": "Malware payload", "value": "eede46d85be9e72abd26855bc9693f5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651999, "uuid": "24cf3063-26d1-416a-8f99-d669837cc92e", "comment": "Malware payload", "value": "d2b4941d7ad1eda287dda9cb7329a9de16bcea0df787db2f171d598c2c809478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651999, "uuid": "19de5a48-b08e-4ff1-a9d6-e68b401a59af", "comment": "Malware payload", "value": "4a6f7431a0b106d2a74545c4fd100155a8ed0ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651999, "uuid": "24b53f56-9c95-4bfa-a210-b7ac1dd6b953", "comment": "Malware payload", "value": "97827f3a5cfd1162387d184dd7df54e188eee154f51c6148c295cc5d24a07312c4421883accfd43b9f11fd0a457fbe7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651999, "uuid": "08d6d436-5f1a-4fa5-8ae0-b50cdc0c2d92", "value": "T1F6E3AF22B7D1D071F4E3063348749941467EFDB25EB64A8733A8128E5EB42D05B3ABB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651999, "uuid": "8d461b64-2dfa-4ebe-bba0-e6846422f9be", "value": "e87c9c66e32f791de60bd46f1df17fc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651999, "uuid": "f7347df7-8b9a-4ad9-adb0-e843bb71c280", "value": "3072:CXhVbxten6+zhwBFQvZ6E+KgkaNU5QgXgs5gNOe:CbV0n6pOvXekCNqle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651999, "uuid": "792a9965-b61b-45bb-8226-4c1b99abe696", "value": 146265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651999, "uuid": "11b4f46e-523a-4222-b471-40199220b40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651999, "uuid": "7299f744-0fd8-4572-b86b-3041f0b4aaa8", "value": "eede46d85be9e72abd26855bc9693f5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc394e54-eced-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711621657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621657, "uuid": "2d6476ec-a6c2-422b-80b0-c5d140815ad1", "comment": "Malware payload", "value": "3bfb35c4054f9b59a8b64817aa292780", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621657, "uuid": "73c20d0c-0d60-4d91-8f60-25d10bdde2f5", "comment": "Malware payload", "value": "d2ca8563455b3e2cc8b2942a4026dddb324cb37262c27432ba1fcd975303e44a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621657, "uuid": "daebed32-4821-4882-bd6f-ef593a8602b6", "comment": "Malware payload", "value": "9d126f746caf39749551574a049adf9d1e8af649", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711621657, "uuid": "33897908-1019-43b0-9fb9-e2136b95fccc", "comment": "Malware payload", "value": "1a8bdbbd60ac5be3264d55d156217aef1898784898429b4d3ab856b7703b408e1f9bc7c56383f34f5fcdb030321952d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621657, "uuid": "47b741df-c2cd-4b8d-b36d-40e24d87b7d2", "value": "T1A8435BC1A76201FAC08B4A707516F27EF27015359AB4CCE3E7A829C469635F53E7C3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621657, "uuid": "22ab9a30-9610-4a01-8d1d-3d3209671b12", "value": "f1e99cf29907465f275f949fe91b6257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621657, "uuid": "cb5215c1-d157-4b4e-8785-da1ff7f3960c", "value": "1536:T3d/Gu30sVhOZZG6kLpXTaHCec+ceDhkMENAZ:T3xGA0yhQjCpmiec+cuOME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711621657, "uuid": "2eaec9ae-1a97-4da2-8af5-94655548b4ad", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711621657, "uuid": "fda4ee6e-513c-4b79-9126-7f0a19b4aecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711621657, "uuid": "b7fca9b3-e3e4-4466-82e6-6a7ddc8aa1d4", "value": "SecuriteInfo.com.Win32.Evo-gen.18602.10500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca15cd79-ed08-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711633250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633250, "uuid": "93ed5686-e356-41be-9b1e-3722a37c2802", "comment": "Malware payload (Mirai)", "value": "865f2da8ebc299d9ee70cd857ddd43a3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633250, "uuid": "bb2196b4-4b16-48c6-928f-9145b999c383", "comment": "Malware payload (Mirai)", "value": "d3fa47112af0aadb023531c36b419d32b60aafa38b9aa2017943dd35d45c17f3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633250, "uuid": "604e6d8c-e921-432c-b8f3-4489cba4450e", "comment": "Malware payload (Mirai)", "value": "67cf6e728b98c3d94ab75c6ac3e4563c964af0ca", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711633250, "uuid": "48c3407e-a40a-442a-8c34-80992711098a", "comment": "Malware payload (Mirai)", "value": "c70a4974197816eca539875727425b111393692e63eaf67f23d01cf85f76a79e735b516573d18b3e7ae2a6ba7a39e4f9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633250, "uuid": "daf94356-9bbc-4400-a7b2-5a4cd4b86a04", "value": "T1E353172B2A91C87FC59B13F51AD7E5619413B83C2B3355477398BE2DAF3A8C42D18326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633250, "uuid": "ec31c383-38d1-4db5-8688-77d67b2d24fe", "value": "1536:N8SA+LqjeBwC+7uoJt1z2C/RLw/lqF5JufGl:VLqWwPt1d2/A5Af2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711633250, "uuid": "966c4e89-b2f9-4931-b270-6193139f05c2", "value": 63241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711633250, "uuid": "467020b7-2078-46c8-b4dc-22dff6ed92e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711633250, "uuid": "a856e66e-ca08-4715-bd01-20aad297d4d7", "value": "865f2da8ebc299d9ee70cd857ddd43a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92c2cd3-ecd0-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711609169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609169, "uuid": "0172641d-56ad-4c27-9ab4-9468db796ca6", "comment": "Malware payload (RemcosRAT)", "value": "9751f18fb374bf112f867381a68bb3a9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609169, "uuid": "e8758148-ed43-4215-a449-dc97057e71e4", "comment": "Malware payload (RemcosRAT)", "value": "d53afbfc333acb95639354fe5eb9cddce8fc0f59190d23dbfa60fec9944a5e27", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609169, "uuid": "26144d4a-9221-4316-9e68-df8f2123d711", "comment": "Malware payload (RemcosRAT)", "value": "b6690412b3ce7e65d76437b4d6704a3646e62938", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609169, "uuid": "333e9eba-ffcf-4737-8b72-c2f952dfe1ce", "comment": "Malware payload (RemcosRAT)", "value": "269eb363d566d76d7926619f43e2f49cd632ca33e8e042812a7a1787bdc88cbb15ab7017b4d1e25c732ec270e63cefac", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609169, "uuid": "37940dbb-c341-4d16-86d1-eb7d03d2eb58", "value": "T12B05AE87AA8BA5C5C1D7067395D286C04B5FBFB443A90FC1D749B222DD3158EBE03E1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609169, "uuid": "3ed21221-aa7b-4e21-bc13-56b5a4d321c9", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609169, "uuid": "5c94b126-be0e-4524-bc13-e3f1508d9479", "value": "12288:agyMCmL5EW2zV3mDinwWxjQKQpUGk06VqbwQX3isAr:YViiwwEKQpUs6swI32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609169, "uuid": "f4337d02-d12d-4c91-8fd5-90e99656a08c", "value": 870646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609169, "uuid": "a9e5e3a9-7d14-4a21-a40a-36b23d89d3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609169, "uuid": "a27d6f40-de01-4d72-9918-900ef595d9bb", "value": "DHL TAX INVOICES - MARCH 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224e08e5-ecc3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711603333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603333, "uuid": "618f6ace-f60f-4951-8c6a-86f7e1229600", "comment": "Malware payload", "value": "2d671541cd53ff9207321fd1bae5c07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603333, "uuid": "88a6051a-a339-4251-90d1-9ad803142710", "comment": "Malware payload", "value": "d5d0cd9cb2a7157072c07181b8c9b24350065924959fcef905865738a253be01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603333, "uuid": "8f9ccac1-1129-4b5f-846c-7dc7ef6d7ff3", "comment": "Malware payload", "value": "ad152c81bbbb2aa8de47084b2b7d421093f64950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711603333, "uuid": "96d73e10-a583-4207-b9d2-d1ace93b879e", "comment": "Malware payload", "value": "db1599bc212a4ed9ccfa1997ff9a7ff83a16b3018136a53cfae5d73cadc5c450933425bac38c2e4c4a9b4b4c698d3b79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603333, "uuid": "899dfb67-9361-4ef6-bc9c-8b1d4e36a3b5", "value": "T1D3A63316B2C28572D1611B79DC5AC1886D27BE201DF568973EF9C90D0A7C3A37C3E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603333, "uuid": "9c1481d8-822d-45f1-9668-226988acc7a8", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603333, "uuid": "a1284a8a-b377-4521-bb61-ef9305548d13", "value": "196608:/4NjER1jpaiwDulgx5RKJhYk3a8cqsdjbEq2j+a2Jjq+SiX0DR:kERF4pDt5sJ6k3anazjaVRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711603333, "uuid": "5f776e7f-ceb0-4565-828a-05f105f218fd", "value": 10262432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711603333, "uuid": "66f1f486-4116-4661-95a6-67c77421460c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711603333, "uuid": "08e23253-0043-4036-805b-c9f204d4df53", "value": "SecuriteInfo.com.PUA.PopAd.30341.21745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4868dbc7-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609839, "uuid": "fa4b6949-dd77-4fdd-8960-bb7a8ace235d", "comment": "Malware payload (AgentTesla)", "value": "7a24b565d557e96657a019e0c1b93865", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609839, "uuid": "01b5e246-3a4e-457a-bbfb-f127fecf0aeb", "comment": "Malware payload (AgentTesla)", "value": "d9c01464eccdd1f866bca7505ea879e1f8f54a151aa3c4cab946bbc99e1e46bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609839, "uuid": "88227dc2-8c4d-4f5a-908c-500d8e14832c", "comment": "Malware payload (AgentTesla)", "value": "b760ac2545af0df54ca335d18fa2df4280646881", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609839, "uuid": "211d2eef-17e4-4d39-a5de-49a424948457", "comment": "Malware payload (AgentTesla)", "value": "ae95784c81b890e7f5823b11ee0594d6409c8cca18760ce76894fcaee91fac6be5e91145ecbfd9d4cb0c010af354f18c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609839, "uuid": "52779691-7b0d-499d-aefe-7eb676352007", "value": "T1D085AFF876047DE6266F576BDA96ACDD03B626639ACBA4CC80647BC30563375FE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609839, "uuid": "d5e28067-9f4a-4dc6-953a-d51f4f2c655a", "value": "24576:oiu8COb31WA6cg4Y2YkSAWeyPIplPzEwWuPRaWnAtTZDTaMB0W1Ln7QiMZLKmVwH:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609839, "uuid": "c91d93e2-aa34-4524-91b6-65474ffe35d1", "value": 1764534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609839, "uuid": "517675b7-b8de-4be4-b51f-4cdde5c7e584", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609839, "uuid": "96aebeea-e723-4bfb-9943-43a5ae634a58", "value": "New Order 3118.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a78afb-ed1e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711642584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642584, "uuid": "fbe2221f-753f-4740-bc66-47389b09ce78", "comment": "Malware payload", "value": "a95660b40b22e02e090435d5555a6e07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642584, "uuid": "a3c1430d-5bf9-4ab9-b966-92b4614cd097", "comment": "Malware payload", "value": "db51bbf76672c02bc0248d242efde621cf8809ed4c8a2ea4c2ca0176c7b07623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642584, "uuid": "3a0998a6-99ed-4001-9653-9b93dab95ecd", "comment": "Malware payload", "value": "166a32f0e1c1c64922adfd46bd1d0c24b0024df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711642584, "uuid": "9ea327ce-06d4-4f17-a937-faff672cac51", "comment": "Malware payload", "value": "c9dbc684a10881a769509689666e15ffa5278a7b538df8c2bd65dd28b1899692c2729994649ff59c36d7103215f5847f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642584, "uuid": "82753459-e832-4baf-9be0-887cd9c4275d", "value": "T12D666C03F85191A9C1DEE1308666D293BA717C485B3023D33B50FBBA2B76BD86E79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642584, "uuid": "ecfce86f-31c7-4074-94a7-c2b366d541b0", "value": "49152:cPDqPrb/TwvO90dL3BmAFd4A64nsfJy2etw2JRXowXtnTNS9GOPu+/RTS5EfSMBV:cY4pnTokTE3nHXB2ym+8jfCeiG35kMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711642584, "uuid": "f4066e75-9aef-487d-bcc7-6cabd15af062", "value": 6775796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711642584, "uuid": "0b46d06a-1610-4621-be4b-faf4af307405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711642584, "uuid": "7b4c0417-9a5f-47df-81da-2e102b513fca", "value": "SecuriteInfo.com.Linux.BtcMine.798.28745.31751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f02b57b-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609877, "uuid": "92db2da4-f41f-4c72-82b9-48aba670ebcf", "comment": "Malware payload (AgentTesla)", "value": "2e0c2134e45ab06b68e1f2c9eaac7890", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609877, "uuid": "b778e3fa-530b-4805-9c28-af8ff6d2f163", "comment": "Malware payload (AgentTesla)", "value": "de7041f25e9f3a988a90b0fdf1d8e90aa8a6896c594eacba0b0fa1b81eca90dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609877, "uuid": "69318b6a-d656-4b44-9657-2cd815328f45", "comment": "Malware payload (AgentTesla)", "value": "24d2aa2cb1cc82cbde2f934d49aeedf47c6ba74d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609877, "uuid": "3de2d67b-a36d-4ce4-8138-70a418cfd2f3", "comment": "Malware payload (AgentTesla)", "value": "2a7d1bb347465679ac001ce13a64456810d487a3f979fcc1ecc8108c822a0e7bef9afd414bdc0f4eebdb0d840381f11e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609877, "uuid": "4d067c84-58fd-41ad-9655-295facd7feb5", "value": "T1B40311EAD6893BD44D861F7BEE0227B38C74406973372A3293B8C28D6053558697E7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609877, "uuid": "23a7a9f3-d849-49eb-8dc6-c57a0fe77fd6", "value": "384:u0ogBz3UIWz0AujGKoCJmMuttrW6ku83V3aiHw2oaXw4Crb8Na/AZrzbtzocLCKV:u0ogBz9WAZGc8NnKwiQQS3AhHtocL3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609877, "uuid": "769bfed3-78b0-4904-b901-914b3cedc77c", "value": 39220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609877, "uuid": "b900650b-5836-46ed-89bf-65e7ea46343e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609877, "uuid": "3c7fcd27-e873-4292-a9d3-0ed2f4396b7a", "value": "RFQ20240327_Lista comercial_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31901d4f-ecfe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711628699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628699, "uuid": "51ebf9d3-70a7-4373-bfd6-bf99ea1224c5", "comment": "Malware payload", "value": "7cfa969838d658f38b42d73e69e90f94", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628699, "uuid": "e1e09510-a724-4bae-8677-6e18736d0334", "comment": "Malware payload", "value": "dffbda214a9afe62e66a1565e1339c53f80190b826aef5f35f355e3024e49ec8", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628699, "uuid": "1886492d-d86b-4c63-a7f1-cb89259df8b8", "comment": "Malware payload", "value": "bb2140b7279330dc5a714b0ac64b74fa3253be8c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711628699, "uuid": "75852252-93aa-4bf4-b867-570b9213f0eb", "comment": "Malware payload", "value": "99f84e9bedc8d30e9c17299ac1b9619a64f2ddf48c580ef3862fff7c5b37e09b8d282a9c80dca65beb64453c317b56a7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711628699, "uuid": "724268e6-6046-4b30-a513-0801f7798540", "value": "T188A49C0FB97C8A68D595E2710E8249D710AAB75097F096C9B2CF3E70613E634B3257CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711628699, "uuid": "ae849ce5-1a61-4957-bdb5-7732d8472806", "value": "3072:MFNXv2TYg+D094D5OsxfHD3Eblx/lwbhbGmhAGGaUdiAZ2TYg+DNIzkOsxoHiEbB:ghbGmhAGZ8WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711628699, "uuid": "4157248a-d79e-4fee-859a-354e205e8877", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711628699, "uuid": "441bb063-b623-459f-b220-96a634185e6f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711628699, "uuid": "c6c4d643-dd86-4c44-b530-8cd3d57311ce", "value": "7cfa969838d658f38b42d73e69e90f94.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cdb9e6-ed03-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711630959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630959, "uuid": "38897c91-0ab9-432f-b8c7-c31a1aecbb45", "comment": "Malware payload", "value": "ef19e2ec305d4ff526c21594f958bd44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630959, "uuid": "94a9c3b0-07a3-4228-b130-de0e9b02e92f", "comment": "Malware payload", "value": "e20122b472fb07ec6dddd3a60ba1e1206802418bad07a591ab78176383d96846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630959, "uuid": "f06bd37a-3f27-4585-b95a-2c7aeabc6131", "comment": "Malware payload", "value": "42cbf54d4f5d02af0f67fe996e07a67b6d073148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630959, "uuid": "9184c0cb-060a-4241-9821-be2ac50014a3", "comment": "Malware payload", "value": "c7a157a59c3697824dc0800aa5983e3d04dca5fb74dcb81a1460476a886f377b6b7888f17714e68de45fb4c55a4293f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630959, "uuid": "c314ca42-e955-4b54-a5cb-6f792ae5e00b", "value": "T1F6455D72B5A14533D2235979CE4BD6A8B811BE211D18688A7FFA4E8CDF3E7C13529093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630959, "uuid": "8ab4d9fc-299d-4d2b-a35a-e99c43839478", "value": "3072:nmdqpevG/s52cCRHfsEvNi1REIMtS1klUwqKaz8Kb2Gd7SER+zrIw0BVWsfiNoNz:nm8evGkzCRHfsci4cA9Mp7SHkCoNzIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630959, "uuid": "dbbdfe2b-e2ba-4eed-86f7-9fa10ea701e4", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630959, "uuid": "a315fbf7-d386-4a31-9eff-4a6757d09d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630959, "uuid": "26c366ae-4666-4647-8ff3-027673180575", "value": "midyear_statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e88a1d1-ed34-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711652021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652021, "uuid": "a74a5fe9-d38e-428e-8765-b5335ca1b9e8", "comment": "Malware payload", "value": "a9b0c24d41e753b3933a42ddb331678e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652021, "uuid": "29ddb9e4-ca41-4828-b0c6-063a2e2997b1", "comment": "Malware payload", "value": "e2e6b7f0b568d699d50c8f4cc9423d0078822026f5e33f155334b3ddc8d65988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652021, "uuid": "0a28b3df-428f-4222-8595-1b169f654e6e", "comment": "Malware payload", "value": "7be3b45cbb0fc93d249b51eef8d898f9349253be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652021, "uuid": "eecb16d0-2f64-4b4d-9bc7-7d80ead3280b", "comment": "Malware payload", "value": "20edbce867828959b34dc3cf36720d47f632461dae833e76f7556b23e799ca6072b1c21ded6b1105108a1c2c99d2708c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652021, "uuid": "6f772345-af56-4042-90d4-45faea108e25", "value": "T15234CF12B6D3C032E9B302721CA49E41463FFDB74DB15A5737D8660D4AB46D0AB36BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652021, "uuid": "050351bc-986f-4ef0-b3e8-813647fb2ff8", "value": "83f60ac3c0aa9a7a804ae19989ee18ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652021, "uuid": "67468e2f-02f5-4729-a953-3ddc961eaa1e", "value": "3072:reCgdXDHFcmbzx+dUQIiXUcOoPMDS4NQQPwXwKmPht9YKwfurDnRL:rwD1CULaMDS4NpUtmJ5wIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652021, "uuid": "6300e121-c0a2-4724-86dd-6c7d61646c5e", "value": 245567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652021, "uuid": "553f74bf-9151-4b7e-b90c-a21df4872b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652021, "uuid": "c499f679-3eb2-4b4d-8741-86f8381980fe", "value": "a9b0c24d41e753b3933a42ddb331678e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c891e0a-ed12-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711637414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637414, "uuid": "0ed5ea79-45d9-4c5a-afab-e1b5f281465e", "comment": "Malware payload (RedLineStealer)", "value": "9c8f9c16d9476e30711c92307ff98b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637414, "uuid": "88a8bd9c-d1bd-4a8d-95d1-c1d88fec5546", "comment": "Malware payload (RedLineStealer)", "value": "e353a4c8c81c7815dc8a9ee01e23f6fa7d438c0b8f44ba952c7f2d00aa044899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637414, "uuid": "abd0821e-0622-4c77-92bd-af374c81b64a", "comment": "Malware payload (RedLineStealer)", "value": "dadce6f6fc960850127c7643948dd132fc60b569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711637414, "uuid": "5fd99acf-7ecd-4e8f-bca7-0dd630f0d2e0", "comment": "Malware payload (RedLineStealer)", "value": "dd79b1c9e65b3768efe6e61d98ed8726544205a5eec23176a0c575432d6c0b7547904330024fe9a306fa673bca508832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637414, "uuid": "55be04d2-9206-4556-8900-b8a1a5d10099", "value": "T1B236CF03B7F48E21D2BB0F37E5B651101FB7FA85AB21E30E7585726D1A5332909463AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637414, "uuid": "26dc9c05-6a41-48af-bf69-e1a960a1fd62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637414, "uuid": "67d1f215-e675-45d4-b4c0-faf352e1ee3e", "value": "49152:iHYqsRnsBi6+Opf/PdDS8DLRg42BjMedGcYvZRjIg+MaKU16ihEb1jVhGyIN+kJX:i4qs/T7XY7yKa6ihKjAn+Aee8NDSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711637414, "uuid": "56d44e5b-7a23-40a0-8bad-fd07af02594a", "value": 5202304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711637414, "uuid": "8fa6ee0b-6b7c-4d06-a534-25f8ce24e0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711637414, "uuid": "81867733-dbd1-41e8-bbf2-467bd1691c22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf62b5f5-ed02-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711630682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630682, "uuid": "04b1eca5-c9e4-4d33-841b-b02614219cbe", "comment": "Malware payload (AgentTesla)", "value": "a37aeaaf876c4661fbf8b175d030e435", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630682, "uuid": "b7e85b48-7c6b-46ca-afcb-a12ac5a175e8", "comment": "Malware payload (AgentTesla)", "value": "e3cce94ad61070494d45f847525f13bbe00d82a1c5643c96d9dcd8236a25e45a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630682, "uuid": "d4a57e25-039e-40c3-9526-9d0a9878349a", "comment": "Malware payload (AgentTesla)", "value": "9f9700ae58e9ae9ff3bb3f50bfa1651d614529f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711630682, "uuid": "33eefd2b-5b7a-41b7-8dea-0b45bc6ca60e", "comment": "Malware payload (AgentTesla)", "value": "b5de041961214b4def1c482e0bfa856edf8185a9fc4a2c63046a54e1150986a7cb73ccefbbc7293fdc501ffb672bb688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630682, "uuid": "e4c608e3-cf29-4ebe-ad3f-035da55bdbf9", "value": "T127E59D62668A45FCCE4A6B3AC29F66012BFDD0C10773C75F2D1E362B388335BD90559A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630682, "uuid": "e472b2b2-7623-4aee-90cb-d612f36e2646", "value": "49152:i7XLm8xI2nCY8EoVZT6JGsBp0PWInu9vxnBoqdWGJa/3HWPWar:gbmJYpoVwlpuWX9l3a/3HMWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711630682, "uuid": "07fb74a9-c173-486d-8855-e460af3626fd", "value": 3049472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711630682, "uuid": "8d8ad801-03d8-41e1-8839-d37cea2136fc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711630682, "uuid": "eee8d616-b26a-44c6-a610-8e59643e3c0e", "value": "T_240369_S\u0130PAR\u0130S.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5708f994-ed07-11ee-a120-42010a9c002e", "comment": "Malware payload (BlackMatter)", "timestamp": 1711632627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632627, "uuid": "3c963ec7-378b-4b39-aaa7-41368d66819a", "comment": "Malware payload (BlackMatter)", "value": "cbfa130416e1cd2a0ddf457e635d9c3d", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632627, "uuid": "0ad8d69a-a8ec-4133-9d9d-3b0ef0f38f68", "comment": "Malware payload (BlackMatter)", "value": "e4bd46ed9c588b369dc6cbaa9d8dd61d59424b677e4724aa7bbe4dc83b170f92", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632627, "uuid": "3b87a662-d1e8-4eca-92c1-4110593f497a", "comment": "Malware payload (BlackMatter)", "value": "e16a5d32dea354085cd845f9ab8b3d778f890cb4", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632627, "uuid": "4875e085-23e7-4508-a581-f03e64bb9d1d", "comment": "Malware payload (BlackMatter)", "value": "fdab3e6aa00fc9919f6e1552edcd51c0da8f183c1c15ce9de471920a2a88cc4cd3e67864340d0f64f223ce1bdab42c2b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632627, "uuid": "ab9e74fa-42e6-49db-a6c7-be80ec3721b5", "value": "T13393029CE9E78F4F5F6CAA1BCDA1BE4F00BB0CEF48097E43841C55AA205F769558A510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632627, "uuid": "b6ffff43-7163-47d3-9af9-4e3d917adaae", "value": "1536:QURyj38t1eValnHfpPEiNZh+hBtk/yJFhR+N+Z7+/ZyNkR7jk/8bXEAoVlLNNS:hY38t1GSfpEKGIyThRJ7jeF48b0NVlLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711632627, "uuid": "7bc905c6-a327-49da-97b2-5acffdb33fee", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711632627, "uuid": "5cd57a34-aadb-4531-9b93-413595aa1907", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632627, "uuid": "ca05dca5-4124-4a3b-9a9d-23ab0a91294c", "value": "Lockbit4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1c400e-ec9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711587647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711587647, "uuid": "3d6e714c-075c-4530-b859-45a37bcf5e53", "comment": "Malware payload (Stealc)", "value": "ba354d029f0e09cb6b02a4c196524da4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711587647, "uuid": "1c5a32b6-6589-43aa-b6b5-bb7adff9a3b8", "comment": "Malware payload (Stealc)", "value": "e70dcf3f915087251224a7db3850669c000a6da68ef2b55e3e2eda196cb01fc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711587647, "uuid": "bbddf1b8-2f47-40fe-8492-95ab88c29847", "comment": "Malware payload (Stealc)", "value": "d8a3c4115cc46bc9a7b5216232c87d1a6471f09d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711587647, "uuid": "abc557f8-bee4-4364-9177-8d5d99604178", "comment": "Malware payload (Stealc)", "value": "92b886442824885cc735cd8e477080df4bc93f3d7981c3f43ab0435310cd3166eba66ce6df97e656e47016b9b555734e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711587647, "uuid": "435370ca-ee91-4376-bb28-9b59b714c968", "value": "T13936DEEA13CDF753AD6B4D32C2FA3F5701903B311D92564F0858A7C998B9188DDFA06A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711587647, "uuid": "a0576580-9d63-4c16-82b1-15503dd5ac02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711587647, "uuid": "fa574544-e466-4d0b-8b05-645ab6edb57d", "value": "98304:GkYNNP4ya1yMLo/NDRhzEdPPi2HuzH/zVhRpfR7pIy/unY5p8riqnzQ2ye:GkYN6yacM8/bhzEZDYHhhz57Gy/sQi02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711587647, "uuid": "bb2840bc-baf8-4faf-b1b4-932310069c1b", "value": 4889088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711587647, "uuid": "78922871-dfc3-4765-9056-714146b9ac10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711587647, "uuid": "1cf12510-a679-44b3-8c02-317773168700", "value": "ba354d029f0e09cb6b02a4c196524da4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d6aeca-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651092, "uuid": "d091df90-fa81-483a-9a87-abe9f6255221", "comment": "Malware payload (AgentTesla)", "value": "97c163bbb028e2bb1439bbe5e9497cfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651092, "uuid": "4fba307c-51bc-494a-9f66-7abb8b45fa65", "comment": "Malware payload (AgentTesla)", "value": "e74c7eeb8441dcc8faf37169cd15805f10b6a21c9982d8395728f5978622f982", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651092, "uuid": "0e681baf-c89d-4701-af4a-7b46e6c15dc5", "comment": "Malware payload (AgentTesla)", "value": "a69c484d867309e1d36f88f0edcca3cb155e25b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651092, "uuid": "975106be-9d4b-457d-ac8e-a893b52ae2ef", "comment": "Malware payload (AgentTesla)", "value": "125469bb34cab26b6ef741d45868936d1ab92c69c606589f56d7fec15125fe863d55c6590d3c8c472edeac61c7914887", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651092, "uuid": "1eb34370-e1b9-4338-b5c5-98b7b8d618cb", "value": "T16E030DE3C9853BE44A562BB7DC021B334DF44A6A7B770A309B7AC14D682355849BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651092, "uuid": "7e16c0b3-893b-48de-973d-1d5b3717ce17", "value": "384:u09gBJmUIWz0AujGKoCJmMuttrW6ku83V3aiHwMgz0YaXBP2a+eGHz4b467QiBAc:u09gBJEWAZGc8NnKwiQxwZY36cuA+yBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651092, "uuid": "9a3639ed-b2ac-44ab-9c93-b1cf167cf2d7", "value": 38295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651092, "uuid": "a857a8b4-dcc5-466d-962b-aab5fb6c15bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651092, "uuid": "b6e0ff73-e8a0-437a-84a9-f652f9ad7e1a", "value": "assento 555 pro-Model-2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5263d4db-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711651088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651088, "uuid": "b915919f-7166-41e9-9a0f-f4f966d89a56", "comment": "Malware payload (AgentTesla)", "value": "fa056beb38a88b12dbc668b3f154e767", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651088, "uuid": "10dde4ba-e661-490d-887c-44d38eadcc15", "comment": "Malware payload (AgentTesla)", "value": "e89cc01f68abe8c3b986801052bd118be35c6dd01e3757ecfe80ed90acb2bff0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651088, "uuid": "82e71663-dc18-4027-baa8-b42413abe9c4", "comment": "Malware payload (AgentTesla)", "value": "fac7b8db2c2d25253df4b363c4be4e6f53d36e5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651088, "uuid": "3b2c65cf-2cd9-42e8-be75-5e96d5500edb", "comment": "Malware payload (AgentTesla)", "value": "a926f962820a3b8aea948920eab6c87705eec3238f8ac5b50bc0ada09071985b08f4219c98d6cba38aa8fb1b6d254000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651088, "uuid": "52918a5c-a971-4e31-9eae-a5c88c470ae8", "value": "T11D0321DAC4856B56494F4B73CC0617BA5CF4008A733B5EB0937CC22D622B7686E7E6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651088, "uuid": "fec810ae-69a9-4110-9303-9d2f295de2c9", "value": "768:u0agBtKWAZGc8NnKwiQoAMyCgnnDSR9mfJYAwYu3:BQqNnKwbmgnDSefJYADQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651088, "uuid": "93c85819-b15d-447e-9ad1-ceae7c69a0e0", "value": 39972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651088, "uuid": "7578bc8b-6019-41c2-a0a5-03a6821f1c28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651088, "uuid": "fe466b27-bddc-4614-b115-f3c1c903cb1c", "value": "ocrev ns.ordine 290520280324.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa33ae-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1711609637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609637, "uuid": "f2b24354-4104-4e63-b629-63ba03e176b7", "comment": "Malware payload (STRRAT)", "value": "3bfea4981a2d01174df157cce933c998", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609637, "uuid": "287f485c-e36e-4e30-89c9-6578ff0ab6a7", "comment": "Malware payload (STRRAT)", "value": "e8a0d4fa41af68e1cb71db72d94b576fb030f845b02f7bcd93599846354f0475", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609637, "uuid": "201d4d3a-088e-41f3-b7a9-e47374aafe62", "comment": "Malware payload (STRRAT)", "value": "9f90ec5753e4d0ad7d0103e39b00bfce95fae574", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609637, "uuid": "e3424c5b-9fc3-4f54-a585-b6fbc6e315bb", "comment": "Malware payload (STRRAT)", "value": "91a633345907ffa3936d944ab21be5c7fe92bcfb3dcedb82239687fbd4f32d0c8200b2ff1fd1664057e188ed2643fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609637, "uuid": "db5bffb7-7ebb-4e26-93a0-044ba167a76c", "value": "T19774129F7BDEE079E0135272221502B4EB6E4AC5D285941FF6ED1B494C37C888B52ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609637, "uuid": "87b856e5-552a-4d88-be4a-dbd77338fecc", "value": "6144:HxQ7vXDRgg7g2DpAXh6hxaDnsX+slwqunmQyHex4L7jj3:RQ7/DRL6we7dpx4Lvj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609637, "uuid": "7c68f313-01cd-4041-a572-7706098ec8eb", "value": 344540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609637, "uuid": "3cb6b249-63b7-4cb9-9c3c-345a8da708a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609637, "uuid": "a369f701-a674-477e-8fea-a246bbfda968", "value": "Swift copy of payment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e9bcb5-ed32-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711651058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651058, "uuid": "10b54aac-01e9-418e-8ebe-cb03396573d9", "comment": "Malware payload (Formbook)", "value": "1c2e10456d4941fc03b4505745df986d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651058, "uuid": "93518453-28fd-47da-a016-f06178d87dd7", "comment": "Malware payload (Formbook)", "value": "e9666b1c4832b4fae3effce740700f565e6336bcaf47852005c1e0553436e7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651058, "uuid": "f3351228-0593-482b-b8e4-29eb1991bf2b", "comment": "Malware payload (Formbook)", "value": "8e4a49017e5906846ed12440dae27f7c702bc64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711651058, "uuid": "95a2e7fc-9477-4e6c-ba3a-afa83a582ac4", "comment": "Malware payload (Formbook)", "value": "fb7e52df4d73d37cbf97a92bae75293494a9c2ad1e63dd9cf9df9a735d870b998d38cb077a6a86d067652c1293d2928e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651058, "uuid": "a24c4dae-7b06-4818-af9e-c9750a87d00a", "value": "T139E412423AF8AF48F1F68BF052B0981553B2FAB32951C66D5DD251CE0CB17A0835AF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651058, "uuid": "47f1f245-5541-4be9-a959-757e5e27f382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651058, "uuid": "b90c0348-4671-4734-ba56-e5c780c4c5e8", "value": "12288:a/US0YOwqOp67LHOv8AzfetftWQkPV48wjNk+KmTGvUbIu0xCBUK4kogNCGSkR:qO7HLMzWf+CEmTGvK8CqK4kbNCGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711651058, "uuid": "56b622e7-110d-4ab2-8a71-129755cd045e", "value": 721928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711651058, "uuid": "f7110b98-351b-4a9b-9d79-b5ee151d0ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711651058, "uuid": "d62c15ea-7855-42ac-8361-49fa3a2da3b8", "value": "FedEx_AWB#53203024643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086d0a42-ed23-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711644521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711644521, "uuid": "f47fd441-8148-4789-bddb-e45549159330", "comment": "Malware payload (Smoke Loader)", "value": "b05a74505fa03339578dff002ba57c69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711644521, "uuid": "18a3b5a7-a0e3-4a0c-b1b2-9f2bef7b9cf5", "comment": "Malware payload (Smoke Loader)", "value": "e9839a31cca5038608b57f6e13e75f43aa845a2f892c917a77b3c4f0bcc35c7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711644521, "uuid": "81be3b15-7696-4406-a329-af1a45c73e9e", "comment": "Malware payload (Smoke Loader)", "value": "b9851e84dbd2c8b2ecccb30452ddccb0496ef974", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711644521, "uuid": "f238b0c1-574a-419f-8ea0-654cebc210e4", "comment": "Malware payload (Smoke Loader)", "value": "8d07a78b1d5530b32e356f2a1e237d73aaeece714e3522ef194acabb63b2eccd55335a33002d92ff8637113959a3eaff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711644521, "uuid": "378e63de-93f4-4c12-99a7-186d1ab2ed9b", "value": "T19244CE1176E0C474F6F306325C349A85177FFDB39E758A9B3398A66E2C712C08A26763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711644521, "uuid": "939ab544-ae78-483e-8165-02c26f6d5324", "value": "73a705984e6e7b2e05c030d50f71c6c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711644521, "uuid": "d2d912bc-54ba-4b0b-96b4-bb484b122d5d", "value": "3072:NCEgl6HLc0iImEkhg569+wjkabBB2n2qr4j54wCxe9yFfqdwiB9ez/WnQEbK3Zk:NsUrc06Fue/kZr4j5vwbb0WWnQEbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711644521, "uuid": "6f419bae-79d9-4187-bad3-1bc29ab455d8", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711644521, "uuid": "3e565601-62a5-4298-9b28-bf8981e71da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711644521, "uuid": "e913bd29-38f5-4d61-ac55-847d9c77758d", "value": "b05a74505fa03339578dff002ba57c69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16771d2e-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638961, "uuid": "5db66820-fe9c-4466-a553-f48b25e7fd5d", "comment": "Malware payload (Mirai)", "value": "52237510bcabef96cd1f556a89542e2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638961, "uuid": "68b3fed8-d92b-4b2a-b5ec-49e6eb04481b", "comment": "Malware payload (Mirai)", "value": "ec3b581e653f390dd8283bcc3432861b7d48eb3f28b9b76efed2694c51db91d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638961, "uuid": "244c5804-4d5c-41cb-8e84-125038b72e3d", "comment": "Malware payload (Mirai)", "value": "cc1c10e7f1a2246ed766fb2023f31c07dd6c41ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638961, "uuid": "e987198c-834b-426a-9f98-33a55f4d1d6d", "comment": "Malware payload (Mirai)", "value": "f9c977457a9a9aaea60bb2ac88f2f856a99e7c0ce263a3a21c2eb1870659492fe039c6bdb2b13ba8b66eb186ef24bd54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638961, "uuid": "39a46d9a-eff8-4f1b-8b9a-fcba742b788f", "value": "T15373D73F2B532E63C4C9103245F34331EAB6E65A38BD4B53A8A05D686F09B9435563FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638961, "uuid": "84fe56e9-c1df-41d8-b17c-dd31a47519fb", "value": "768:t7iq8kdy5xHeI9fAH7MAoy54/cTaClPnR40NG7zRWyWjSsYMDp2uL01O+EuTFnsZ:TuxiBnvnGGDDIuL0V3nszo+ORq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638961, "uuid": "1fc2b311-57fe-4ddc-8e08-3bc7dc38fbbb", "value": 75765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638961, "uuid": "57b67007-011c-4692-bd52-a813b2be76f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638961, "uuid": "5fbdfde9-4d76-46c1-b851-536450341129", "value": "52237510bcabef96cd1f556a89542e2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a05d3c-eccb-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1711607061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711607061, "uuid": "148d73e9-3aa0-4b85-a0f3-cc289c9bb649", "comment": "Malware payload (NetSupport)", "value": "d3b4eacce35fb5b50b0f45f35119508c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "techcoredigital.com", "colour": "#892E6F", "exportable": true, "hide_tag": false }, { "name": "tomuttaro.com", "colour": "#9C761C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711607061, "uuid": "c55ddc92-6931-4a0a-bbd3-81c5e08153e0", "comment": "Malware payload (NetSupport)", "value": "edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "techcoredigital.com", "colour": "#892E6F", "exportable": true, "hide_tag": false }, { "name": "tomuttaro.com", "colour": "#9C761C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711607061, "uuid": "711e17ce-4ec5-4a47-81c4-d3cda901ad9c", "comment": "Malware payload (NetSupport)", "value": "18ae2430f7ea7ae5e92e95ca251711a59738f31f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "techcoredigital.com", "colour": "#892E6F", "exportable": true, "hide_tag": false }, { "name": "tomuttaro.com", "colour": "#9C761C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711607061, "uuid": "ea6d574c-74c2-46cf-b3a5-92db16d36a76", "comment": "Malware payload (NetSupport)", "value": "9d52f4a190c1c115fd5cb22e6ae55d541f8065876afb81137135fb2c94880e8de8b40d7a1c50a43ba19575c222188669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "techcoredigital.com", "colour": "#892E6F", "exportable": true, "hide_tag": false }, { "name": "tomuttaro.com", "colour": "#9C761C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711607061, "uuid": "4b530fd7-420e-4abe-8c02-f7fd203ce917", "value": "T137F6233FB258393EC46A1B324273C23059777E60A96A8C2E43F4795EDF375610E3A616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711607061, "uuid": "79f43134-6517-4fa2-a1f3-6ec34f70417e", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711607061, "uuid": "8f082c7b-5f27-4864-a206-14fa3a47b326", "value": "393216:j3JQVz1M/0XRlPzAuIhlQd5A1eT67vXUFjyO/Nk:gC0Pbxc/eTAUlymC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711607061, "uuid": "9fae63a4-56f2-40f0-9f02-0a03a78d777b", "value": 16532128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711607061, "uuid": "04a4376c-0ffa-40b7-b375-bf8d6c45bcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711607061, "uuid": "52c3a072-a368-4010-8b89-0cbda3e0d369", "value": "SecureClientInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb7958e-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711609900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609900, "uuid": "312a54d5-f6a4-452d-a76c-b91e5e6a75ba", "comment": "Malware payload", "value": "62c65581da8c7d455a8874d4b7fc66e9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609900, "uuid": "44ccac28-11a3-4e3d-b093-53555ad41d35", "comment": "Malware payload", "value": "f1e8bf6a1a7d984e0d20b2e7042aba07ddc184a2123ab7260a66596105f26cdb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609900, "uuid": "c452b4f2-874d-47ea-b3ac-cba6dbea795a", "comment": "Malware payload", "value": "626dceeae47940c55d06a948046166fefbef4332", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609900, "uuid": "09a69f96-818a-4ee8-a819-3d8da8385105", "comment": "Malware payload", "value": "eef67526a779ef32cbac893b9abfdbabc56cb50062160a772af255baf0e3627d017f6526e876b8c399e70496d87826ce", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609900, "uuid": "df718cee-3d6a-45d3-91fc-964ad62d8f21", "value": "T172030CE2E8A93F9449461B77DC42377E6EB4015A733B0E30977A8A0D608355C49BF6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609900, "uuid": "81d3c150-cda6-4c05-8255-c51ad00e816b", "value": "384:u0QgByQUIWz0AujGKoCJmMuttrW6ku83V3aiHw28aXt9z4Ef3i75N2eMd9HL1acR:u0QgBy2WAZGc8NnKwiQ6kEf399zf1Ipg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609900, "uuid": "9f3f22fa-4be5-4b2c-854c-568948d9f144", "value": 38988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609900, "uuid": "acb806d0-f06d-4571-9b6a-e66f56643ac6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609900, "uuid": "1a33b97a-9e6a-41b7-b56b-00ab37ba121d", "value": "BL_#348113.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24fb8ee-ed0a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711634176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634176, "uuid": "c13f3a4d-b0a0-4c71-83b0-d2d58a3ac088", "comment": "Malware payload (RemcosRAT)", "value": "d7fa42ada80342b77afe8fc6d8a3b454", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634176, "uuid": "fe881dcd-aa01-4422-b435-67219a0e46e5", "comment": "Malware payload (RemcosRAT)", "value": "f2983bae21d56a3081e78ebdfe8c91b007a0e7e3b363850fb48ee90eeea953df", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634176, "uuid": "f62f1493-ad0a-4769-80ca-41ccd6d92eb6", "comment": "Malware payload (RemcosRAT)", "value": "4ca1e8f488e2357148a990f375b0f8b4c21e63fb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711634176, "uuid": "24a67b7f-d544-460c-b1cd-d38191e4c873", "comment": "Malware payload (RemcosRAT)", "value": "1550910511a972b3a85017236827cedf03879c18e841e6d2f8c4437a309790e865b34997c03de656f3cf2b37cb521647", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634176, "uuid": "63e91cea-49d3-479e-b89e-280fc7854d24", "value": "T1E4F5829B2DAD4B89971E73EB1B0BECCD932BCE111F826DEC81C2098C404676F1555B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634176, "uuid": "6435cd16-f302-4915-939c-8369e2a5bf1a", "value": "49152:rEC7f2ylcohhw5oJVu4nXyxfW+T1nCzm3svMqa7c+7ZpupGKrx5rNfHz73Mm03uH:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711634176, "uuid": "88af7ec5-bb68-40d1-9acb-0b337440a0d8", "value": 3500311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711634176, "uuid": "f5f3c3fd-b498-4a96-805f-abbe87429d8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711634176, "uuid": "843d4c2b-073e-44f3-9f76-15c70b20cb8e", "value": "Document 20240327_1188908_1188909.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc18057c-ece4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711617818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617818, "uuid": "e01523f2-ef0e-4093-b6cf-1ecc4950bd16", "comment": "Malware payload", "value": "f8970bd9459f225f6aa60c3434004f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617818, "uuid": "f570e7ce-33f8-48bc-97a9-3e4d935c4834", "comment": "Malware payload", "value": "f32234ccd875ee03ecc62a6a741f52f6045d3de0c6eadb53afda391b1d0ab73a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617818, "uuid": "528dd347-e765-44d6-95ba-4942b10f389f", "comment": "Malware payload", "value": "06c30b14ae2bb03c9dc5652a40d4a1731f67eb81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711617818, "uuid": "74ebfb75-8fd0-4800-82ab-c6255be73fa7", "comment": "Malware payload", "value": "89870d561b0be3f930b754d425f81b0d79fc52ba61172282d623f25982e4a1db04e3c7f4524420e0ea40f2cb27278beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617818, "uuid": "ae38a0a0-3e34-42e4-aff5-68fb434e584b", "value": "T1F304D98261CC59D2F173BF3A47F3639243B671539F03AA1E0189B65E2D92DC49A83379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617818, "uuid": "8dfcbcc6-b7d8-4669-b3d1-0de40859b91d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617818, "uuid": "08fbe0e3-24cd-4f38-af93-17dd539c50e0", "value": "3072:u5GnbBA5D6Vj4nCUmIEUzwsS6y1okuPcck+evIzjLtz7pTSF1eqE:3nbq6VkPK6avIXV7geq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711617818, "uuid": "cc38c7fe-b4fe-413d-bb3b-cb22e3ae59e9", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711617818, "uuid": "f3cd7435-d163-4631-9503-c20153b88ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711617818, "uuid": "02a5da90-e4c7-4b2d-98f1-4131f4991016", "value": "SecuriteInfo.com.Trojan.Siggen27.33484.28759.31674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f1ea52-ecf5-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711624782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624782, "uuid": "87aaf57f-cba4-49d7-a81a-436b805f8c89", "comment": "Malware payload (LummaStealer)", "value": "878fb2d16b47869ef9d6521274a1790c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624782, "uuid": "807adf3b-f469-4f84-a150-50637304c183", "comment": "Malware payload (LummaStealer)", "value": "f6fdd1efcd17813514cdabda3cbfa77b35f74bb8de0992dbe72fc9fd53ec5c81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624782, "uuid": "a06c16fd-c245-4ac1-8021-f69ac91942ac", "comment": "Malware payload (LummaStealer)", "value": "88a84b6a780a296485b0afc61e6a22761437538a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711624782, "uuid": "7cbab806-2c71-4ed1-8f71-30269a4bbca6", "comment": "Malware payload (LummaStealer)", "value": "dcce504422cc182399e2d5c58167777657d94338a87ff70587db4f6071d58103a784e2b79f6c436416e0523a91ddd098", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624782, "uuid": "de4fde0a-b712-4067-9719-6f4b9ac45a1d", "value": "T1BE84C032B2E1BC60E6734B33DE2DC694266EF9618DA56B5B33145E4F08B10E1C56BB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624782, "uuid": "c662039b-6f47-4867-9793-bb2250f32fa9", "value": "6c253ab46183cf59b107fd8e97e1073e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624782, "uuid": "785754b7-401e-47d1-afbe-15eb225a293b", "value": "6144:qbZ8ZDVW1VcLHSlRdcFrQRzN2WTNKlU2mx55kN9Xi:q189Q1Vcqz2rQD2WTNKjyCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711624782, "uuid": "1e20ef7b-ff80-4595-b0dc-1d29b56a0a54", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711624782, "uuid": "10cc22e8-11e1-477b-950c-df445131800b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711624782, "uuid": "394627f4-806d-4e3e-8b5f-cf761d49dc90", "value": "878fb2d16b47869ef9d6521274a1790c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf05bea-eccb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711606866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606866, "uuid": "5d538d81-280d-4d09-beb2-e47b31295879", "comment": "Malware payload", "value": "e9834f3300848528be52118a9918ef14", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606866, "uuid": "bb8bef2c-0a42-4438-bdbf-fbbf6574cb6a", "comment": "Malware payload", "value": "f77db76f6004258118637d32ce28fd183e55df5a6f8307b4cb452741f62f75d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606866, "uuid": "58103d5a-6a87-4f34-82c9-ada468c7ef4d", "comment": "Malware payload", "value": "c56215bf7b8435e542934010b3e571a4687a0c52", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711606866, "uuid": "9e91a271-d397-4f8c-b8fa-670886a34b44", "comment": "Malware payload", "value": "3d603bd302e88b2e550572237223e25c149376c70834af33686a86442e75536e2abbc08b900d5d2e14b1c25182fe4030", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606866, "uuid": "5cb794f0-ecde-44ee-91c2-7e479c687209", "value": "T10AE2A457B7C58E06D16A317448FBC34CAAF8BD19CE62E34F71A9BB1E28305F4A741618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606866, "uuid": "9d7f4a5f-dc65-4605-808f-e39afab91697", "value": "192:Dhv1ctiEJOFxpGjhmsxEhSisTCExc6/6rNavrgYjk+4bWldwhg31hd2yiVl7LhDS:DZcMiSwvxjk+tdmvhDNAxz99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711606866, "uuid": "ef3a1956-f2ba-4c96-98aa-96a4a48b2496", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711606866, "uuid": "7d34df55-8077-4a5f-8785-e8bfc9bd8c6c", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711606866, "uuid": "db5937af-81c3-48c2-b675-111ef78d7f72", "value": "2024 Eclipse Sponsorship flyer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16458610-ed07-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711632518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632518, "uuid": "75743c48-1db6-4690-85fd-9287452c5bbf", "comment": "Malware payload", "value": "827c2735811297a85b5115cdc701b868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632518, "uuid": "aebb731d-6ef0-4424-b411-5a97211ad8c2", "comment": "Malware payload", "value": "f7ea997ecb3f1b3d9669ead7539d2b0b7da60ac08279e5bb09aaed20a97efa9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632518, "uuid": "5863955f-3aa6-4479-8dcb-a46b05bfadc5", "comment": "Malware payload", "value": "0597c01af54d280b883c003cd46df13d861c22bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711632518, "uuid": "8fd652ae-2508-4441-ab36-83236b6a60f2", "comment": "Malware payload", "value": "4eeaed5c3d522497e022c65a953ac30e89a97d3e0903305b261259d3ed56bee8d3f808fc57188b26951cad3db76a7adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632518, "uuid": "4a5c8b72-d9f9-448a-82a9-a7f8fb8e4a38", "value": "T10328333177E2C132F37712386AAC862B4876A83893638DDB92C1599D6F34590DB7DB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632518, "uuid": "1b09d950-c138-4c34-b2eb-a7c1a6c3e5f5", "value": "f3bc7307a737af2e91a18c2deb1d81cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632518, "uuid": "04adb574-2641-4c31-a1bf-02eeef6e5c3b", "value": "1572864:LPaJRyFcjmUMDt4nVFQuY84u2inv9uVdG1IXHDkPZLDL8wrPyTgrB:09joWVKXTinvQQ1IXeLDL8wrysrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711632518, "uuid": "f2e6da68-c9a9-4967-a7ec-40c188e1a448", "value": 99314064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711632518, "uuid": "289ba0d6-803c-44d9-a3a4-0bc957fbd0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711632518, "uuid": "b47a171c-6c37-4161-91eb-f42d539b17c2", "value": "SecuriteInfo.com.Trojan.PWS.Steam.36457.26808.16558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26c454e-ecd3-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1711610473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610473, "uuid": "58416f58-0cdf-4a50-bdba-eaa37c26e8ef", "comment": "Malware payload (RustyStealer)", "value": "9032a431c190f22ff5a9458b81d93c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610473, "uuid": "41d878b3-9d7c-4882-bf29-bba71278ea72", "comment": "Malware payload (RustyStealer)", "value": "f88a5fd1af9829d4b51c45ec98dec844bbe327a658a12de715de4e688b7fa27a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610473, "uuid": "d2716067-f26d-477b-925d-27d149cf765e", "comment": "Malware payload (RustyStealer)", "value": "c2c3c17588873141f113cb292ffd368cba7bb626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711610473, "uuid": "e24cd592-c88d-49d7-b663-e00f9e9ab5f2", "comment": "Malware payload (RustyStealer)", "value": "bc780631e308870b104c5ee6b0af23a5527244b20513b4bb7601dc3921511361d65a3a8905a1d54277d8eafc8b23a176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610473, "uuid": "ad1910cb-cc60-44e3-bf93-65751f23f5e6", "value": "T138359D82FAC27AB7CD471235250FE33AA73298094719CBDBE7D49D30AC673611D2A15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610473, "uuid": "e4a3c060-92eb-4df8-a8df-8d59d5b81b8f", "value": "251d3404eb0425683c737712d63d3560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610473, "uuid": "9151b32c-e7c7-427d-85d5-0eac9185fc52", "value": "24576:6Z7+q69d0eDDdPjPUbjgfiVrzFvVHmCkRYhT3bSGQn652l+JOsv8u2mWw:QhtbjgfigomNmJp8u2mWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711610473, "uuid": "2934bfc4-42fb-4b7a-b760-d3a1b7924513", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711610473, "uuid": "da77185d-1bae-446b-a88b-73819f5b85c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711610473, "uuid": "e913896e-fbb0-40d0-aaae-bee6af28757c", "value": "Microrover.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5090c95d-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609853, "uuid": "6dc3128c-72ce-4105-a834-a405b9f1eac2", "comment": "Malware payload (AgentTesla)", "value": "98d38570369050c3e503e18035277ad8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609853, "uuid": "36d7395d-3f84-4a40-adc6-408d2232f16f", "comment": "Malware payload (AgentTesla)", "value": "fa2132896865e53db4ca14d8cad05bd53bcc176bed28e3a39a2ec99501e034a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609853, "uuid": "e623b7ef-cd96-4558-9887-d9be6a4f3453", "comment": "Malware payload (AgentTesla)", "value": "384119a540c60cd5c853375a03fdc6080e0e359e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609853, "uuid": "d023e6a9-8fc3-4428-b9c5-f4a918cd6ccc", "comment": "Malware payload (AgentTesla)", "value": "58bc4af7e5612304de849955fdc3ce6514365b881a54134f09d1d3ac8021148160ab10b520a1ebe71dab92c88d363a61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609853, "uuid": "189fb412-452b-4425-945e-e0b1e822bb79", "value": "T18DF3C6E3CAC526188A892AB7ED274B734DA4419D73031F3497BDD69D908395C82BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609853, "uuid": "5ece7875-9e6d-4875-b846-f451b2a1a98f", "value": "3072:xpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DdUqYy5:xpKyPeadLaz+k0zn1j7rZeqGbHfNcckg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609853, "uuid": "0c6d5164-af00-4e36-a5ae-aef6190f1f96", "value": 171015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609853, "uuid": "431a1880-c722-4dd0-b8de-54e42b612872", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609853, "uuid": "b0adaf86-bd65-4669-bd8e-361ce231699c", "value": "Wage_Plan_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6a9080-ece2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711616691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616691, "uuid": "33ad6c74-58cd-4bff-8933-fd2bd5b794a8", "comment": "Malware payload (Mirai)", "value": "a2cda5d87f0457200b380858c922a2fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616691, "uuid": "3d1e7a70-5c12-4e93-a802-4b04bf0d15e7", "comment": "Malware payload (Mirai)", "value": "fd14841bb9222de83eb20b7b6fe3b02bfaf5d3212c491b7923f79760bd037649", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616691, "uuid": "4b116a9e-b475-4ce6-b58f-9684686f6ca0", "comment": "Malware payload (Mirai)", "value": "639a23615332bf0cfd139b60612c6b28a36f9d8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711616691, "uuid": "461be345-69e2-4c51-aa06-4b741f0f7c14", "comment": "Malware payload (Mirai)", "value": "d27eeb0252878e0a19913f1f566a0c1386e03fa1ef1069b4995cc6ac837bf008c5e0682de159629016243d5cf868719b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616691, "uuid": "38549f3a-9012-4548-80a3-e722805dff7b", "value": "T135635C0333280E17D6920EB0353F07E093BFF95126E5B6865A0F9B664639E772186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616691, "uuid": "22bc6c3c-ee59-41b6-9a76-352a510ab68b", "value": "1536:BaOWnAwa/vzzj1Diiydpur65IQIKMl1dXd42+9:OsvzQiYpu+CQIjDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711616691, "uuid": "a54af322-b154-4c3d-9899-7539c964b58b", "value": 72768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711616691, "uuid": "b74502bd-bf79-4b9e-bb34-33d6b5ef5c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711616691, "uuid": "ceba6954-1147-4e2f-975d-237468937acf", "value": "a2cda5d87f0457200b380858c922a2fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e26a04-ecd2-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711609889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609889, "uuid": "08efff21-4c71-44ec-bf50-2b46ae933d7a", "comment": "Malware payload (GuLoader)", "value": "b478df5fcb26b5f6be934fa417dff56c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609889, "uuid": "ef7f54d7-2bfb-4d7a-8d56-dae2f15d3324", "comment": "Malware payload (GuLoader)", "value": "fd1b3ed805346ee23f9956377c3544546550d86718543b03ec7496ad89f3558c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609889, "uuid": "a7981f5c-d905-4692-8aaa-59e21439c84f", "comment": "Malware payload (GuLoader)", "value": "f10f47328523372fe2097c2450bca6b632412301", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609889, "uuid": "2dc07176-4542-4c65-ab9c-5154665dbacb", "comment": "Malware payload (GuLoader)", "value": "afb96f882d7b04a6ec41471ab7b6dcb090c01b3d95226a380182ac49e84770b32eeeb0fafe3c41ed0cdaf8c2424b9ca4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609889, "uuid": "06f37cc6-5215-4294-8598-41143cd626ed", "value": "T1D154A1E3CAC626288A461AB7ED234B734DB8419D73131F3893BDC65D519395886BFBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609889, "uuid": "e99ca112-44ac-478b-896e-f9ec5b9c2042", "value": "6144:2LkLMX7IYSHPDvPKbhikkFnEbzM/PDiXJfljw91aVX/e+B97TpgxZFMwgwxYRsnV:2oth32KSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609889, "uuid": "a1800fc6-c2d5-441f-8e68-7f41ff429a62", "value": 282275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609889, "uuid": "349f62eb-03c7-4e2f-ae72-18c6f007653b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609889, "uuid": "828664da-8b21-4d2f-ad26-72d3d8bcc526", "value": "7294042_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90e60ae-ed35-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711652522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652522, "uuid": "e0fb20a4-a83c-4815-b910-32594f6499f3", "comment": "Malware payload (Smoke Loader)", "value": "516547ec4cca7f8038998b6f3c9d95b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652522, "uuid": "0fa51c59-0a61-40b2-a715-e6efdf1ab57c", "comment": "Malware payload (Smoke Loader)", "value": "fd602cbf605a4f9baffac0737c13291635ad0019567db051809d5bf8823dce5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652522, "uuid": "9a05c2d3-c101-4331-a25b-27ad1994fb5d", "comment": "Malware payload (Smoke Loader)", "value": "41dbc19f9f6ce4279bfbef5e05ae7acb28771f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711652522, "uuid": "b8ee5af2-6970-4baf-bcd2-293f8a383e47", "comment": "Malware payload (Smoke Loader)", "value": "bff7c1c0921ea3a682eb01e70f50492977a88d3b92dae76f21ddc4913d27a2b0bc1e2f81b4e3718e94dea5e9437d0588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652522, "uuid": "191f9e33-78af-4a3d-8704-c4142211a654", "value": "T16B245B2136F1B436F3F75E3059B496A43A7BBC736A35818F2650172E2E716C18E62713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652522, "uuid": "39f69dbc-ab2a-4ee8-9dcd-7820464ef06d", "value": "e381a5a93083caf35e69fd7d319ba0c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652522, "uuid": "ec1f86f3-0504-4d94-9ed2-59fd56a6d4fb", "value": "3072:nRgqc0TaB1K9OXUr/EtJklTVPuAuqmNDghM/Aqe2+V6eC2OiH:nDc0T81K9YUBVPSj83qZ+V64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711652522, "uuid": "6f91fcaf-cc27-4a0f-95eb-445fdc452591", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711652522, "uuid": "34b683d8-2bbc-46c7-8428-919185fa6422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711652522, "uuid": "a9097c59-91f8-455f-9ad2-d295dbc6a499", "value": "516547ec4cca7f8038998b6f3c9d95b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2375d9ce-ed16-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711638983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638983, "uuid": "c2dcdc9b-922c-4390-86e9-aea6167158ea", "comment": "Malware payload (Mirai)", "value": "21c0a727d78e696675cd84ee946991c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638983, "uuid": "f6e0ab11-a522-4b88-b610-103bbce67725", "comment": "Malware payload (Mirai)", "value": "fd7baa107a72d4ed3b34736f2997ac5bd95c35c07e4b059889e652b00be64bbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638983, "uuid": "3e515682-2a2e-46e5-be7b-b1d2cb308902", "comment": "Malware payload (Mirai)", "value": "fe14645515050d1aa94f3c8ceff3bcc33a9e4cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711638983, "uuid": "c7b72aa0-9e08-4b63-baeb-8de509b16139", "comment": "Malware payload (Mirai)", "value": "77a945adbdf000c47d1b01de3fb1caab3b40c0e5e1d9a7c42cf5b9e5cd3d58f029557f2fd740802a6be4d068167e8383", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638983, "uuid": "d122065b-14e0-4d6f-b2b6-dda82d2da66c", "value": "T10F434A45F643C5B7CC831BF542A7A9BB5631F9289AAA0C5AF31C3CB4E7539C97019322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638983, "uuid": "3727e00f-9976-4dd4-b93d-0415435d8152", "value": "768:JQFNO4CHedJB+FOz5ulsGAWzoONqvB+YlCjXRW0CiTrHyo1j6IH:JAw4f+FOklDzBeBvCT1V/HpFbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711638983, "uuid": "72861a95-5147-4789-ab38-63f2d2533a5e", "value": 58081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711638983, "uuid": "62b1bad5-417e-4b30-b34e-5860a3bcc109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711638983, "uuid": "e7206a59-9332-4f96-a58f-1b9ca4d6c4fe", "value": "21c0a727d78e696675cd84ee946991c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea3f508-ece5-11ee-a120-42010a9c002e", "comment": "Malware payload (Kimsuky)", "timestamp": 1711618279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618279, "uuid": "1ab522ea-2b21-47b4-a18e-2e15fc56f7c7", "comment": "Malware payload (Kimsuky)", "value": "a4bd6d00abbd79ab00161ff538cfe703", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618279, "uuid": "419279d0-3b09-407b-bdc1-4be5ef29029a", "comment": "Malware payload (Kimsuky)", "value": "fe156159a26f8b7c140db61dd8b136e1c8103a800748fe9b70a3a3fdf179d3c3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618279, "uuid": "d430a603-f04d-4460-b5c9-74eb10740cab", "comment": "Malware payload (Kimsuky)", "value": "075d7249d09f14cbf0a4ffcb077c77512d3ab9a0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711618279, "uuid": "07e7ae0f-c032-403e-8f36-8a29e6410898", "comment": "Malware payload (Kimsuky)", "value": "3a25899815d182fce5a7b74c4ab709a8f88d77ce41a191a72064fece92eeb692849c133642af431eb64de658c92b5323", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618279, "uuid": "069c8847-0bfc-4a89-87ef-8c65843ab147", "value": "T12E357DB026D90208E06B9979557A74395D333F135835E70E025CBA3E03B3B89DA9777B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618279, "uuid": "3598e592-4b8c-4da2-9de5-c591a8a5748a", "value": "1536:LCNrr8wc73ExbcrIoHXnTKZva0CfkTYcIJex+155sB:LCNrr8wc73ExbcrIUnTKUfkiH54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711618279, "uuid": "8fcc92e8-1419-46d7-ab21-2f199fca7cf8", "value": 1110652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711618279, "uuid": "f2f9eaff-efed-4ba6-a1a6-915fca7a0f1a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711618279, "uuid": "825af18f-5fae-4d92-982c-ef920e3a44ba", "value": "11111.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5b311e-ecd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711609656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609656, "uuid": "f51bde61-335c-43e1-ab69-62b7938bc051", "comment": "Malware payload (AgentTesla)", "value": "388a85182dd3fe6c6e9d96617d8a8149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609656, "uuid": "f20873e9-b5d6-499b-b3b6-32490b92ff4a", "comment": "Malware payload (AgentTesla)", "value": "fe83d5e9847e8cf0cfa719135a98734ed8e89c55c2c328f446b4a983d4c92c0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609656, "uuid": "ab7e528f-89d7-4ad4-bcad-bf0e0af9bfb2", "comment": "Malware payload (AgentTesla)", "value": "8685e212db44fbf7df85e6e12b9ac973418e33b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711609656, "uuid": "29334161-e7e4-4f1e-a6fb-5243e565f64c", "comment": "Malware payload (AgentTesla)", "value": "b2f8a46077732643c72883e22a53e404846efd32d8b785d8bb997a2f3ff22154e35ccb3a65800f5c5425165b838fbe5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609656, "uuid": "cc3e8691-b280-48cd-9bbc-cb7aa710834e", "value": "T14FD58C22778A45B4DF890B39C6AF41002BFEE9C51733C71E794A3356389376BD806A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609656, "uuid": "fb24b0d9-cfbf-474a-a792-11c8945b8565", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609656, "uuid": "7358d1b4-e4a1-4297-adb5-a60b3d0f74f4", "value": "49152:rUbVXnEoeQV8oI3BosehgnxlEstphJyle5Hdfd1HtYA3Fr:rUZ8CenXyiHdfnHtr1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711609656, "uuid": "f91f0e14-84d6-494b-80f2-860c013eebe3", "value": 2955776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711609656, "uuid": "feed97f5-3fd6-4a46-927b-f33c15b353f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711609656, "uuid": "02546dd4-fcf1-4d7c-aae1-558adaa5fb9b", "value": "Yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76ee175-ed49-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711661189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661189, "uuid": "030e7554-3684-4d16-8636-ee3d37ee6aca", "comment": "Malware payload", "value": "08ee9612139c00b1a60d3078a1c94f5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Supershell", "colour": "#16F26F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661189, "uuid": "21479795-f67e-4b18-be87-45d74087fb6b", "comment": "Malware payload", "value": "ffce0d47281a3673151f4dc6aa97200250a9efe132bdd15d5c265d3c8dd39202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Supershell", "colour": "#16F26F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661189, "uuid": "18f090b9-1039-434f-82fb-10573c37f071", "comment": "Malware payload", "value": "33e9c319efded472c2b4622b1357495a4284f9cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Supershell", "colour": "#16F26F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711661189, "uuid": "0b26cdad-5547-42d0-bf18-1c69215c6bb5", "comment": "Malware payload", "value": "60e9bcdbb470a8526e22ed836d2edeb28be18f1fba4412a329c7ef022861199f50da031647ec934690dc34992f7415e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Supershell", "colour": "#16F26F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661189, "uuid": "947a7f72-2b87-4e16-bab4-513312b92d17", "value": "T13A26330862217E33E7C42BE494B17589DDA2D91C70EC93557FCBC5A6933AECB892E530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661189, "uuid": "f9a62e37-ed57-4ab9-91b3-ab9f85479d4d", "value": "98304:zodc1IpOeV9cOr2Zs6Cz1hCfpMtyPPRbyp21kIjRsD6qRFX1KE6FGtHI:cdsI5rr2y64hRMImkIj+tXbAGtHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711661189, "uuid": "945c463a-cc68-46d4-ba5d-5239db4c86c1", "value": 4740068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711661189, "uuid": "ad0592d0-4143-4c0d-8224-1e7fe7e51d96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711661189, "uuid": "b4b4bb34-3312-4d28-9eab-64905d6d37bd", "value": "lab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }