{ "Event": { "published": true, "date": "2023-12-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-21", "timestamp": 1703203382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "36b0d248-2760-48da-8c08-63aecceac437", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb61822-a027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703180064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180064, "uuid": "c5656a98-ac8b-4348-b27b-b1935030895d", "comment": "Malware payload (Socks5Systemz)", "value": "600e74b40a5c566e91cb30cac80455c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180064, "uuid": "67173eb6-75b0-432e-878c-6d9f32036cab", "comment": "Malware payload (Socks5Systemz)", "value": "00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180064, "uuid": "d3773ee4-4bb4-4e0c-8f50-d96e3efe8ca1", "comment": "Malware payload (Socks5Systemz)", "value": "4968ecbbc322cc9f68c3a644bf69e583971ece17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180064, "uuid": "954ff030-bae4-480f-a7ab-46076e3fbb6c", "comment": "Malware payload (Socks5Systemz)", "value": "fe7a8ec682c7bdabe51787c973a6e88aeb156368a21797e1d49e171242abd6185f6e547485ceac97783007a941644592", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180064, "uuid": "fd1ecded-9060-47da-86ec-082e6ab60f50", "value": "T109663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180064, "uuid": "db670dd0-f55a-4420-bacc-f58d3a7631a2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180064, "uuid": "9510366e-c89e-490c-a9d0-d567b01c7f05", "value": "98304:j4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:Mh7teThPZidcKj8fPz6+4jb1KswNdDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703180064, "uuid": "c187a77e-d369-4a0f-8f0e-534feb034b99", "value": 7054359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703180064, "uuid": "3cd9b77e-cead-453a-830d-c3e16918e1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180064, "uuid": "1a62b3f5-6dbd-4bff-aa74-9055ef56dc6c", "value": "600e74b40a5c566e91cb30cac80455c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b05256-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182756, "uuid": "7ea45ad9-f519-447e-93c8-6f7b300b47e7", "comment": "Malware payload", "value": "3ebd1125a368af550681bdd8cd76de0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182756, "uuid": "0eed7ef0-d355-4580-851a-0f12d856a59c", "comment": "Malware payload", "value": "01b40f48bb8b9a8bfe10197ae8000d6399cc6129d5fce6c38d57b5e7f7ae5fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182756, "uuid": "aace339d-9777-4ac0-bce3-a95fc2c523e1", "comment": "Malware payload", "value": "855d63db93a4a98afb56906e7035eac8e9f51060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182756, "uuid": "4650d84d-c463-486f-b415-b31226498c2b", "comment": "Malware payload", "value": "87df07dbc8ca6c34b66d090f5351deb7fa685383c15f4d7aa63f7f2603b076b88d450272f812b3237b5667a0c35519e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182756, "uuid": "8195ee1e-13ef-4189-bc2f-b290d6343648", "value": "T109F49ED2FFCA60C9D9623A7516B2D3266F36A52E43378CCBE7605CE22B504109E35376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182756, "uuid": "569282db-fbd9-4fc8-b4b8-1fa3980d5421", "value": "12288:XsCODqaXxtvNqVk8l9kLhPj1HuSRULqvRHPkY/So:cCOTtcVkLLhPjpVHPkY/So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182756, "uuid": "76e95a4d-f6f2-44e4-8b96-73d02f5f4014", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182756, "uuid": "01c27f8a-dfa2-4fe4-bfbf-027474a77fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182756, "uuid": "8fbb063e-e7e7-4b30-a3e3-ae818bceeed4", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.4358.5734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d355023-a027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703180115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180115, "uuid": "76d9a0f4-ac89-447e-8656-73e8d4c07581", "comment": "Malware payload (LummaStealer)", "value": "96323074c8fd721f75ddc2ab7397c1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180115, "uuid": "d66f1391-dee0-4118-8b20-59b017c9625f", "comment": "Malware payload (LummaStealer)", "value": "02eb002f33af51183396e8406bc7518c01c4b2f3b326d227fef6bc7e3c8fd1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180115, "uuid": "65338e19-7e6a-454d-95c3-45971d77c887", "comment": "Malware payload (LummaStealer)", "value": "c40cd803483779b6bb2a12bed03eaa7e3766cb8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180115, "uuid": "a38aee98-ba1a-4af1-958d-5ec2ee4fcd63", "comment": "Malware payload (LummaStealer)", "value": "2f7861a5e1e67f8eee1192c26d26aef1a4b8f743cffa1ea8618cc726359d7465fd608c35fbfb858d02fdeffa97368f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180115, "uuid": "3559255a-4c85-48ad-8b5f-fb51724afb98", "value": "T14F343B4352E1BC64E9264B738F6EC6E8B61EF590DF5977AA12188A9F0C711F2C1B3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180115, "uuid": "fd8266b4-b277-4126-8331-cea3ed7106c5", "value": "e3c24fce1b756c9be54e4411a8b4aea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180115, "uuid": "968a267a-9301-4356-9dab-523995224143", "value": "3072:chozwL7vlllDfIPfjR0SguB3ECRoris7pxIAfJD6VFR99edNYV2Bk:lzwLxvDfI310P6orbxBJDe9ENs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703180115, "uuid": "ca7f2a83-9927-4971-85dc-7d6ea2756f12", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703180115, "uuid": "dfd3f998-4548-47a2-a301-495d67d96423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180115, "uuid": "251f02d1-74ac-4902-ba44-e5f4b447abf4", "value": "96323074c8fd721f75ddc2ab7397c1f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a386e1-a035-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186092, "uuid": "d76e609f-afc5-4cbe-bb5e-5ffd8c0f6c7a", "comment": "Malware payload", "value": "7f8e030803a97b405a37f1bbf58beb80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186092, "uuid": "45041aa4-50a7-429a-ab07-eb310948e2c8", "comment": "Malware payload", "value": "036015d189a2a302d58bc811129a0375f2fe226e18e117e21db8dbe0717f14d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186092, "uuid": "a781914b-e0e7-4be5-9c19-622f61400ce8", "comment": "Malware payload", "value": "3b8faad3f937f1a2da36edf4981ee337dd25a405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186092, "uuid": "6766e508-27ee-4675-a5f5-d52cefbc0d51", "comment": "Malware payload", "value": "5b8e1ae8810ef269163856025591c20f56a94cd78193a3449cf7a08924127c10f9b7b9913c16c9cf143e96824a56aa1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186092, "uuid": "243e4d5f-fd86-4f85-9150-ffd8f14fb306", "value": "T15EB4BF4352F0BC54D6A68B738E2EC6E8B61DF190DF59779B22199AAF0D701E2C173702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186092, "uuid": "758c85f5-943a-4aa4-8393-33bb80425108", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186092, "uuid": "91d90899-837b-4823-85ca-eddb6b1fc27b", "value": "12288:A1C+CIchc08QtMszZFn6vdFrEztcIuWX:ACIAbFnEcz6WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186092, "uuid": "e9395e85-4aa6-4491-8814-066d36d4dd1b", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186092, "uuid": "ecf13716-400d-4205-924c-d1595f223dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186092, "uuid": "35f23b37-b69b-464c-831e-3570ce732b8e", "value": "7f8e030803a97b405a37f1bbf58beb80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2d6e0c-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703186931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186931, "uuid": "7e5663a5-d861-4842-97f3-28a17d791f39", "comment": "Malware payload (Mirai)", "value": "8e9e55ebea7a6e5167f0132c435917e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186931, "uuid": "ae521cb7-377d-4f93-af9c-19d45d193842", "comment": "Malware payload (Mirai)", "value": "039c246ba6ef20fa08a2318554f00481daa04685e348f2e6a124e3d8f2d5caf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186931, "uuid": "82382d3a-30fe-437f-ad98-5458378bf288", "comment": "Malware payload (Mirai)", "value": "d23d4b01e86cf8822d008b18d3e8941f6f62e4bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186931, "uuid": "a244032f-780d-4091-bfda-4052c64d2bb4", "comment": "Malware payload (Mirai)", "value": "88d299b856241dd144717a0582b8e900227772ae11f9e259ba060614c5a7281095d0df18c60d38fe9d863e26aa3ca949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186931, "uuid": "0fd3fa1f-7536-4824-94e9-61a95990e012", "value": "T1DDA30944E560971AC3E333BAFB59418E32231FA8A3DB30259934FFA423F6BE61535525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186931, "uuid": "c696aecf-fc69-4329-b4fe-91e2c963392f", "value": "1536:5gnn1WTef9i6qHcJBNlBaHuVCEdZ7ifDEI3gfHOaO5jBY2CW7YecFq:rrvHUDBaWkEI3gfHDORoIoFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186931, "uuid": "9d045df8-01e9-4acf-a17f-3a51f99376f2", "value": 103244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186931, "uuid": "c84dbb46-6205-4300-9541-602091b4a337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186931, "uuid": "7df00681-c8ab-4cdd-831c-570f3f1d636c", "value": "8e9e55ebea7a6e5167f0132c435917e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cda6a04-9fe7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703152519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703152519, "uuid": "f4f750e8-7527-4304-8b59-4e0b066cfac1", "comment": "Malware payload (RedLineStealer)", "value": "2869e33b4eafdfbfca473ac41b21e0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703152519, "uuid": "a21d2db2-9a20-4213-b00b-5ef31810cc09", "comment": "Malware payload (RedLineStealer)", "value": "04092b8f76b37c2a759e76019ea76348dafeb676576580c5c5024f5816130df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703152519, "uuid": "0463466c-ecdf-4cad-9078-7f44a70613c5", "comment": "Malware payload (RedLineStealer)", "value": "13546cc7d6728cf40872db0f9bb79410373ba298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703152519, "uuid": "cf6520fd-0ae8-43fb-b5bb-a876e2da6275", "comment": "Malware payload (RedLineStealer)", "value": "3fb270c24c843d3b1b47bc9569202369971227805e850f254dbc799114c515ea65e175a675df829c67d1a7f31aa6e9a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703152519, "uuid": "c72745d0-4bc0-4b5e-8da6-08d2c67a9925", "value": "T194563385EBCC1CD7DCCE2FF048B96A550826BD5416E0027F168C9A191932BE4BD763EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703152519, "uuid": "dd7343f9-934b-475c-a4bb-4ec5b223cb64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703152519, "uuid": "25f946b2-7118-41c3-a685-d894ebee96e4", "value": "98304:+1aufXhLbFmmWpFTFkxsd4zlHTtOX9m7aG2ta0F0UDz+HIQlmoVLhYZIxLbpxWDD:QaihLbSSLlHTtOX9mKpfamo1+uxLbMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703152519, "uuid": "9a67e266-c426-4268-88b6-6a44f8204946", "value": 6430208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703152519, "uuid": "58f2526f-f85c-43cb-ba3a-57857c176fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703152519, "uuid": "29f8f6e8-a096-4302-96fd-627e86c37c9d", "value": "2869e33b4eafdfbfca473ac41b21e0e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5865dfe4-a057-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703200750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703200750, "uuid": "7e3eaa86-76ea-4016-a9da-b846e207c74a", "comment": "Malware payload", "value": "d726623281d1e6ab50f3996e1466b877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703200750, "uuid": "6797f389-0635-408c-a90e-fc36cde3b84c", "comment": "Malware payload", "value": "05cd76decf43899175c3108649753c82106007a104728d60cd3eef6c739b8e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703200750, "uuid": "a4795322-6f1c-45d8-a830-9a022cbc951d", "comment": "Malware payload", "value": "4ffa406ae17dfef46e262d8bd9bde7bd0fb51829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703200750, "uuid": "298cc4cb-9d6d-400f-907d-261f68662afb", "comment": "Malware payload", "value": "67a9f86b4b5a59f382a7b7879607d9045194abe08285017d41de88730a3484c07192686e83e38e1f378ade5387d18505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703200750, "uuid": "f7487d4b-1d69-4985-a92e-10a333ce08d4", "value": "T19A66336596A0C277F8068279CC72A789CA35FAA12B59D7E2309C3FD24F7F472A453350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703200750, "uuid": "79c7bfd0-640f-402d-98f1-05ff32b18209", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703200750, "uuid": "8ad41808-41dd-4b95-a71c-a24d07aaf485", "value": "196608:zwDjImo2P0187y9klWkG5b1IUZIsySlp6UnHPF:AjIUP01LcWkG5b1IUIklpTHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703200750, "uuid": "d59f6491-cec2-44cc-bef9-8871e22987c4", "value": 7099555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703200750, "uuid": "4254837d-42de-4d58-8ee1-cdbeee8436f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703200750, "uuid": "fef87640-fc64-4e78-9fe3-ed892f9d7db3", "value": "SecuriteInfo.com.W32.Agent.GCOX-9154.14951.11601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1c0085-a00c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703168733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168733, "uuid": "70463f9a-3ece-48fe-a605-9855a8ec5006", "comment": "Malware payload (LummaStealer)", "value": "9527adb6094eab92b0a8c22e2bffe713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168733, "uuid": "e2ca28a5-6095-47d6-8c87-f69af0e72657", "comment": "Malware payload (LummaStealer)", "value": "08bf93d859767b6623b49312cdc8076b701d2147ce3d87e3a994734f0f1319a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168733, "uuid": "1ff2b44c-50c4-4c30-b563-d34624988a5a", "comment": "Malware payload (LummaStealer)", "value": "93ca6d0fea8a6583f947515b47360e31894326b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168733, "uuid": "6bce014b-959b-4f73-a229-d929fe36f6ca", "comment": "Malware payload (LummaStealer)", "value": "1b7c6f584de7149ffb9a86af0784b50d7959f9eeae0fb0043741e7b7b3d6311ed3ffd2db47692c2efb2dabcaad08a107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168733, "uuid": "2f109269-4abb-4206-aa2b-ee7053c9ae30", "value": "T1C634295352E0BD50EA364B739E6EC6E8B61DF690DF4937AA12185A9F0CB01F2C173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168733, "uuid": "4093096b-5903-49f0-887b-de04a6394c3a", "value": "21a899cb2bf7f1bc566f7c47e1443114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168733, "uuid": "10882c20-36a8-4c5d-833d-3b0dede3bdad", "value": "3072:udoz4L1fDdZL04QqkwmSvddBz8R1a1Jrb8QpjHWOrcIiR1ol+dNYVDBk:Xz4L9DwwBvvBZJ6dolkNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703168733, "uuid": "93f55ae3-c7f4-4e2e-ab37-ce87338a2854", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703168733, "uuid": "caed28c9-44eb-4533-a4db-3d89dfe6b28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168733, "uuid": "2fe25e05-5b5d-473c-b92c-f2d2c1cec23c", "value": "9527adb6094eab92b0a8c22e2bffe713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2db2065-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169602, "uuid": "c9bb3863-7e74-441e-b164-73f3e32aca42", "comment": "Malware payload", "value": "7944ee847c86d4dab5540eb5199af1c1", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169602, "uuid": "4c0c092b-2dc1-4baf-8e41-2b0ba530c8bf", "comment": "Malware payload", "value": "08e6ae83220ff2497cb117b4ad762cb896e1194d4b005e08a45b878439115e3c", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169602, "uuid": "7d4b855d-8ef3-4af1-9f74-57efa4b69aef", "comment": "Malware payload", "value": "dad159c51656cb94b55f91848569289a07644f8a", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169602, "uuid": "9045723a-fba2-4a25-9431-8c45dac94819", "comment": "Malware payload", "value": "cd0e28415389744d6b66fac89a51bc367c05f02bd8392865abf4c26272c714b9b0085c50d296327af154e70f4b50f6be", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169602, "uuid": "1686530f-176e-4121-88e7-9fce11c89ab6", "value": "T1EB6612C70EAD81F2CF6BFDF1A717528C5C510D8AA4E17C6B8EC735D554086FA11A38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169602, "uuid": "bee51340-931f-468e-9856-5b37923d9f73", "value": "196608:JTXGuUSMFybIIj7Putt1pk9F9CoGmy+hUelFaeBmLBI:NXdUPAzj7stU9Fgky+Omt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169602, "uuid": "31465c34-f9e5-4b86-882a-ec80cf330d9e", "value": 6500868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169602, "uuid": "d40c84de-d4e2-4b7c-86c6-d9ce94e3f243", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169602, "uuid": "9bbd84bb-4b21-4a11-a0cc-3c37c942bbf2", "value": "PLmp.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe0a6bc-9fa8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1703125547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125547, "uuid": "827e1a86-01b7-4b55-8eee-d63c57d07eef", "comment": "Malware payload (MarsStealer)", "value": "f00006d42f06343a11d761e36f11937d", "object_relation": "md5", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125547, "uuid": "bbb6654f-3cff-4627-844c-50077f15bdfc", "comment": "Malware payload (MarsStealer)", "value": "09854915bafa02b6de0ee7b94d2487e7c8867563c1194ee8cb73d7e0cbc60d97", "object_relation": "sha256", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125547, "uuid": "92eedce5-eff7-417c-b08a-6e29d94230d1", "comment": "Malware payload (MarsStealer)", "value": "0d2e4832dbc7999badfb54dd860b97f32f311849", "object_relation": "sha1", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125547, "uuid": "0d921ba7-7288-4a52-83ec-c885053cdd17", "comment": "Malware payload (MarsStealer)", "value": "bd3076815bc4fb89a3a5eee62ded9e6231c1e65e215ab1de801874d4a9c5839ab6bbf4193378fb833873e04eb38d29f5", "object_relation": "sha3-384", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125547, "uuid": "f3ac83eb-c927-4883-ac10-771d6e608c86", "value": "T1CD3401057A3C344BF4E1ABFC95D539CC69A358A864226E2E8F6F8431F2E3754FCA1851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125547, "uuid": "f1e97513-792b-47df-a34d-75117d8f2029", "value": "6144:lchb+Ro4mr3miBsYOAy/zO1JgymEp6rCbl22ACQLLdir:oIymYYzu+xCbigr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703125547, "uuid": "8ec21eff-b492-40e7-bef3-efc57458a8f6", "value": 241589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703125547, "uuid": "5f40c919-93ef-4d89-beac-b05746ae8b49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125547, "uuid": "d61cad10-da96-4142-91ee-1d61a23104ad", "value": "Ghost Hunter Vena_d-34UG1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52dd3ad-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174384, "uuid": "1deae477-78de-4613-a6bd-8628935f6316", "comment": "Malware payload (Mirai)", "value": "a09f950e0a5f4a44cd1aa4961cf58768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174384, "uuid": "13f4a516-1c41-4992-bb98-c0e0367ddc4f", "comment": "Malware payload (Mirai)", "value": "0a9ece4cdfa45057bb2104606054a05539e44a059326867dfc29a35cac95c664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174384, "uuid": "aaacd4bc-37ef-4071-b038-03ef7eb8a7ef", "comment": "Malware payload (Mirai)", "value": "80e62d57824fb9cb647e2f073df49343e547bac2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174384, "uuid": "4aa2b5ce-b2d8-4a48-8f91-fae151a8e03e", "comment": "Malware payload (Mirai)", "value": "3eff3f65449855a1ee5d99d73986ab1e16e18242b560f819c9ff0af4d1ded247e1f37a086ca8d56926f6db32700d93a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174384, "uuid": "31645778-716b-49f9-8b51-5fde4fd6e003", "value": "T1A563921AAFA44FB7ECAFDC374AE9174524CD650A21A87F757930D818F24B24B19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174384, "uuid": "23e1ff8e-2150-44ca-b55b-136901611ecb", "value": "768:GViBL7TRkSW6+9n+9ukQnlJIphA5fteheameDZ3NtEZ1pHXiscrLiw81:pNc6+oMUAfobmAZ30Z1p2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174384, "uuid": "766f529e-123a-4a30-9d89-1aa3b8ea636f", "value": 68984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174384, "uuid": "bc6e4bc6-fc56-45d6-b097-4d5882e82958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174384, "uuid": "bfe9bd9d-f837-4cea-ae4e-1a822f1b7ae9", "value": "a09f950e0a5f4a44cd1aa4961cf58768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2206d9f-a054-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703199612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703199612, "uuid": "819ce093-48e4-4a43-b9ad-8383acd8039c", "comment": "Malware payload (RedLineStealer)", "value": "a62a0e06ff7de44ccd5c98c2b13bae2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703199612, "uuid": "f8e85c4c-ae96-4d21-bd51-49e6962517db", "comment": "Malware payload (RedLineStealer)", "value": "0b56c3f36aa9fcda36d68ba0e190b0d3547b16800e2d8c0c03818ccfee5b0014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703199612, "uuid": "ba5b33dc-fa24-4da8-accf-06c144e6e890", "comment": "Malware payload (RedLineStealer)", "value": "0e4604ad8842171bcd537a5f1de8864080d9f60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703199612, "uuid": "c2df8e13-4fee-4afe-8254-f9061bff2b6a", "comment": "Malware payload (RedLineStealer)", "value": "7896b6b74cf1d16d4cdc2a1025a3aefb3cc6c20ad7517134e5e0ff4b8071319e2cbdc84617aaa9147e85447717c71dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703199612, "uuid": "53611b38-8d56-4d80-9c00-0b83db7d1789", "value": "T11903D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703199612, "uuid": "1b795059-24f5-4397-b6be-2ba2efa0e9e8", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703199612, "uuid": "af11bc6b-a216-47af-9526-b9f10469ee27", "value": 38106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703199612, "uuid": "a9be3fdc-46bd-4803-8888-b997be6d1ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703199612, "uuid": "a90f3bfa-1089-4a29-ab3f-709be1350ab4", "value": "a62a0e06ff7de44ccd5c98c2b13bae2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e980c9-9fdb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703147434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147434, "uuid": "89cad952-21a5-4b49-91f4-f6c580b3e37c", "comment": "Malware payload (DCRat)", "value": "bcb183aa478a2a9d383d9264f755d955", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147434, "uuid": "230a709c-343a-4ba0-89b7-24294d7fc25b", "comment": "Malware payload (DCRat)", "value": "0d4d05c3759455700ae8c9c7b863e7ada565f0bc6d570fc77324c9b21b951f9e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147434, "uuid": "ad59c2ff-0eea-4372-b2b9-84be0bf83b25", "comment": "Malware payload (DCRat)", "value": "033cc2d8f75106387b789ad5e3a26ceefdc1b347", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147434, "uuid": "f83ca618-c29c-4672-bc21-4b7080acef03", "comment": "Malware payload (DCRat)", "value": "af07a0cd7ad3a609e6ebf8100a5d4986d1b837ac8ed10a96f2eccddd02106844bcc67391b378b5bac0a99966ae9688b6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147434, "uuid": "10c8abaf-c502-4aa9-83fc-f0ab8d51d1ae", "value": "T165C5DF017E44CE55F0192233C2EF49488BB0AD5566A7E32B7DBA376E25163A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147434, "uuid": "88e6b04b-e1f5-43e5-9d8e-3a1dc33c758b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147434, "uuid": "8e86e3d7-4342-4424-b1ef-a542430722a5", "value": "49152:iTiSPZ60lPXLcYYi8vT8L9x7lgifCrq29jS60QmRplpKhbF93:EZZPXLcjvT85xiif/29jS6ypU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703147434, "uuid": "02d410f0-ce5e-409b-8af9-5e3f5241695a", "value": 2660352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703147434, "uuid": "93354c07-65d3-4552-a46e-ced063021b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147434, "uuid": "6c5c3fb9-0a88-4571-b954-2e3586b9351d", "value": "bcb183aa478a2a9d383d9264f755d955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f39082-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186946, "uuid": "f2ef9bd8-0f45-4910-b473-4aaf50b18541", "comment": "Malware payload", "value": "680e9acfe9679b3af3b1d5169252ff9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186946, "uuid": "8c33ce3a-1a44-4f0f-bd0e-78f705305c09", "comment": "Malware payload", "value": "0daa918bf75c150a826e788f3032ed2cb3e3ff992d8b1e3419296b701627ea43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186946, "uuid": "9ae1a557-d024-4cb8-ade3-36d41f60b95f", "comment": "Malware payload", "value": "32525849bb77fceb81de663b3e9b7d9df7762c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186946, "uuid": "7222f964-63ef-43f7-9970-a2030c9a465c", "comment": "Malware payload", "value": "050b05fc6d7892bb46efa0fbfb3e2b16f202f31c28b262e2d7fbc89604e9305705661cd6fc5243c3f0bf36b09c3e1024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186946, "uuid": "c6a56288-bf2d-4913-b2c1-dd9d87049011", "value": "T1BBC3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186946, "uuid": "9f8203df-1090-4a50-89e6-5e81b0c14372", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPyL7ymm/QMurB1nKGNb:SMQplVyamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186946, "uuid": "1aa9823b-9a42-4873-a243-ba4eab533c20", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186946, "uuid": "59ec01cb-ae2c-4f4f-a001-6729e238831b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186946, "uuid": "063f11f3-ec58-4917-bb05-a71f70d3ae6d", "value": "680e9acfe9679b3af3b1d5169252ff9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4193ec42-a02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tinba)", "timestamp": 1703183102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183102, "uuid": "7808f87a-c00b-42e1-b31d-c062dae7c2da", "comment": "Malware payload (Tinba)", "value": "9b32fa9de6f8939ab5a9809587e3cb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183102, "uuid": "f3ef703f-c4fc-4d98-a81b-766db2c2010f", "comment": "Malware payload (Tinba)", "value": "0ee662db7ac463b7869c983f911e3adfb224a04961f7af5673825153919e283b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183102, "uuid": "7b3c3dcd-bab0-471d-aed2-6d502c3456fb", "comment": "Malware payload (Tinba)", "value": "1c14827e32f3e9c0b3a2e916c9e98066cfb7997a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183102, "uuid": "6639f041-68a7-4415-9a1b-d7e8ca7217c3", "comment": "Malware payload (Tinba)", "value": "89df8fec6ba7ac3d96528b7840b8a2642d5edb67e6eb37de8be8b5357124e7d7cc0783ee04f838962da1d050561fd5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183102, "uuid": "14a19db5-2fef-48e3-afb4-d2012c17927c", "value": "T19B446B21B3C0C432F5B203F449F656EBB6397DA1673994CB61D422EE1635AE8AC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183102, "uuid": "d5efbd5f-49ac-4871-9880-be15221c7635", "value": "7f09a6e7a7fc1e0f1379972427c98657", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183102, "uuid": "0fd9be0b-fdaf-42d8-91c7-8e9642b82c86", "value": "6144:RA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0LV8SZWpMG8SD:RATuTAnKGwUAW3ycQqgxZ/wMnSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703183102, "uuid": "ece4445e-570b-439e-88bd-93a5814b6dc2", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703183102, "uuid": "adba2d58-54a7-4666-8de1-204fbd11a718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183102, "uuid": "2361bcab-6f47-4d63-92bb-2349801cb5c6", "value": "PrintWiz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222aa40c-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186485, "uuid": "e604d13e-8f1e-42f5-aeca-0a6770b070df", "comment": "Malware payload", "value": "8657f4d16bba34377975acf354996648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186485, "uuid": "7b9924d4-dc85-4b68-9224-312d4a23ff69", "comment": "Malware payload", "value": "0f03aec82d2eca2bf13ca5ee9490aac6683cacc4ac90c583d2b1c1ed92f9d8d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186485, "uuid": "b2374652-b7e8-4694-ac63-f3030390bd96", "comment": "Malware payload", "value": "e71b8c2cf71f59cf6be40bcba6ef6b525060559b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186485, "uuid": "a25462f6-e3f2-4963-8b73-517fe03d0bca", "comment": "Malware payload", "value": "46d6b19538b8cddfb3c8efd912385ac4db4358fd72040203ff7118ef0bce07025c6897fa77c33123131c5f7246666a1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186485, "uuid": "9591211e-c5a6-4895-9e58-9da8c42a96bd", "value": "T18DC3223E7E21AF7EE278823107F66F70C35929D636A18344E16CF6485E7528C189F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186485, "uuid": "634ea870-82f8-4e60-a916-c4b547dab936", "value": "1536:dcjrzNw7l53+fw8rgf9Pq42rKHpOBY2cACMxKOiVg9DAaTDOpULGiVgemfWsb+e1:AAXtA2VgVAaTQULGiV+dSe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186485, "uuid": "5f06750d-4155-45ec-985b-2a778c65664f", "value": 129688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186485, "uuid": "6653fdf3-00aa-44f2-9df3-b9aecd6ed6d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186485, "uuid": "848d1334-eb54-44b0-ad96-320881677cbb", "value": "8657f4d16bba34377975acf354996648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e44dfa-a035-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703186408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186408, "uuid": "bb5d5128-5d3d-4ac5-8bf8-9bd6076a826c", "comment": "Malware payload (RedLineStealer)", "value": "b3f3c032602eba8762ede8d3de4b1162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186408, "uuid": "821410f0-3d87-4256-ae1c-49485d0ca9f7", "comment": "Malware payload (RedLineStealer)", "value": "0f3d5594200f4cd0b3945bb7cc68ca39a73c0afbc5c443e585bd0fbafafe230c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186408, "uuid": "9ff467bf-1b6e-4519-a91c-797a0c64792e", "comment": "Malware payload (RedLineStealer)", "value": "32dc14fd52c90cf2c5db97e6d9383d8f3f5cafe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186408, "uuid": "c7a397bc-a75e-427d-b5c5-9b58a2153444", "comment": "Malware payload (RedLineStealer)", "value": "82101d193f8062f640c429767b8c671f18f2b8a9b989dd587bff02d45550cd8fe7af5cd75673199904d0e98bcb8f16b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186408, "uuid": "265d4ea5-94cf-4260-98f3-646245e717f7", "value": "T140563383E6F0586BCCF8377454F122621560B4A11EF0F57EBA89499E0E72ED494B13EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186408, "uuid": "bbaf6147-e8a6-4d63-a44f-e8d3e7868638", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186408, "uuid": "1671d209-086c-4a50-9252-61238886bbf9", "value": "196608:Td/F297KcfVOGm7R9g5Qpvz/q15mepe8N3zA5:F+3mfg5wz/0Te+34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186408, "uuid": "e56dba50-66b2-490e-ad50-31783c45efa0", "value": 6426624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186408, "uuid": "4e0bd1e9-fe51-4346-b2ce-6594c98b016d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186408, "uuid": "36c669fe-d3ba-4150-9e0f-b42a4b90bef4", "value": "b3f3c032602eba8762ede8d3de4b1162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0358e927-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186433, "uuid": "415c7a3a-ce11-41e4-9117-46a24217b639", "comment": "Malware payload", "value": "90ec067984b7006116fbf604c143707d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186433, "uuid": "51070189-3970-4a45-af76-797c1a52ed66", "comment": "Malware payload", "value": "0fac618d94d1b89221d1033a95787133b602ee6605bc6ec6930b64a53c97de7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186433, "uuid": "b01508f1-e892-4246-b9d4-95e145b24de1", "comment": "Malware payload", "value": "301ad06f89bd4e190d17e17e0abe27584468c85b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186433, "uuid": "609d9277-bd11-4c98-a62a-1d5b9867ef0f", "comment": "Malware payload", "value": "9997e4668685c6aae35409ecae34868287c15618a7d13753d7efdf95827aa77b8fc10c531bd234436140ab9f0ba19cc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186433, "uuid": "df6abbd3-061b-4275-823c-f54173cb669d", "value": "T1EFA3B62B6B230F23C0D6107112E31632A8B9DF9934BC97D769E07C9D5F399883456AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186433, "uuid": "d01dc89f-3a66-46bd-9231-8d451d907090", "value": "1536:8EjcPRg3ppMuhBYyYE1Zk1hN95l/1tprtYcY:WMpyjETMhNPl/t/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186433, "uuid": "dd96a077-7549-4200-96ea-ff62ab0fc73f", "value": 99728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186433, "uuid": "af8269de-bfb3-4307-ac98-32f1551ec5f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186433, "uuid": "06bd783c-da54-4660-be50-c57dd7ef0c57", "value": "90ec067984b7006116fbf604c143707d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a40191-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703128514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128514, "uuid": "8b4b94c1-1b00-4e42-9e3e-f4cdc5ff7898", "comment": "Malware payload (RedLineStealer)", "value": "6d118ef0aa9a6a1891582c473112709f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128514, "uuid": "d12facd0-d905-44a8-8214-594c1a45318b", "comment": "Malware payload (RedLineStealer)", "value": "1204d604d88d8f4fd8b3d77db8f31b1ca1813f1f1a7f474bcaca601d217e5548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128514, "uuid": "7494680a-77aa-464e-a197-79e58b0d6b1f", "comment": "Malware payload (RedLineStealer)", "value": "43d224c28ae6386180a326efa4c97a49c5d22b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128514, "uuid": "831978d2-6882-488f-951f-5bea4a8463d7", "comment": "Malware payload (RedLineStealer)", "value": "9bab50effcd22f802ab30caa7ec46d039392400be94cd67f4e3487154e4ae352e5fe65886a432f4e03c616afc7a12805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128514, "uuid": "1770b181-03b9-44c7-92fd-b4e9de01923f", "value": "T13D563347FFD441ABCC9A337064F995421138B9909AAD83796B88A19F1DA23E0F4743DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128514, "uuid": "f9c113ec-d53c-4862-9bc6-deed2a9c2dad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128514, "uuid": "1f375338-6941-490e-9fed-e56b3bee15ed", "value": "98304:t8FwqAsvqwldaWJC+SFZfU/eU1LV8idBGTJijsqoTc/CVflH8ilvTplAzduu3/:tFqAs9aWfMFU/fVjw6sSC55zlvT4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128514, "uuid": "078d6555-18f1-4238-8aac-0376081edea0", "value": 6429184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128514, "uuid": "bcf9961e-7c57-49bc-9045-c3f5db34d4ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128514, "uuid": "0888e186-be14-4315-86f4-c5c94d08edeb", "value": "6d118ef0aa9a6a1891582c473112709f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee555cc-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703177514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177514, "uuid": "693fd6cd-4e3b-4338-9776-3519cedcdbf8", "comment": "Malware payload (Mirai)", "value": "d0d7ca18088cc540da4d93bb72962bc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177514, "uuid": "f15caa35-be38-4850-b2ba-d105b50f8969", "comment": "Malware payload (Mirai)", "value": "1295df5af6ce459fef6897ba2aa588ecfe96724b8a09ad8620cf54add8931f15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177514, "uuid": "0b4d40c6-abc4-4608-97d8-48879d4d09ad", "comment": "Malware payload (Mirai)", "value": "b80dea93ded8a5270523853f3a33be7492e9e03b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177514, "uuid": "eb706682-f5d6-439c-a7c0-fdffb48bf172", "comment": "Malware payload (Mirai)", "value": "676e6c1b5d8e8ed3e6c6fed741891297223f29fbc83cebccca12049906f668313339f6481e9f2f7b31185c6ed4eb177a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177514, "uuid": "a839a1af-dbcb-4e37-8e00-43b4eb3bc853", "value": "T12F335C417B5C0E47D1672EB8253F27D083EFEE9010B4F5892A4F9A4A8171E33515AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177514, "uuid": "1bd6be13-5526-4a20-9438-db745139a8cd", "value": "768:yHEV3Rqa9/dGKSMRbR/Memz35KJ8Hn3pcZymIYzWXvmHAhcEy1D:PqO8szzWXOHAeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177514, "uuid": "d0e7e138-0127-4301-9a41-ced0b9356560", "value": 50356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177514, "uuid": "4b5f58ad-94ba-4bde-bdbe-bf145f9240f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177514, "uuid": "081c2b82-fbf1-4f0e-ad94-a9bf6e18b4a9", "value": "d0d7ca18088cc540da4d93bb72962bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30551a1-a016-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703173011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173011, "uuid": "c93a36ce-ac18-46dc-bc8f-2946edf7874a", "comment": "Malware payload", "value": "87b9995964e47d45880011eb7eb4a5e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173011, "uuid": "712a4209-f476-4ffc-888a-d3e2014b2869", "comment": "Malware payload", "value": "13ec89801e6eec69eb31fd55d15bc633ba5fd49778fa5514d859b91520f5a8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173011, "uuid": "2cd58359-30f1-4eab-8eb3-8eeaa1f48caa", "comment": "Malware payload", "value": "17e0a8930194af9dc982246e5faa541835a9719b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173011, "uuid": "f41b7a9d-0488-4c73-80c6-aafba99ec977", "comment": "Malware payload", "value": "7676f34392f07d7c5060b2d49f0438862c46bd9b86c4cd72444f35544d7caedc3161101cf3ea66ecc6c3f00ec7e502bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173011, "uuid": "7041aa86-b6e9-4393-a948-eca1a35420e0", "value": "T1AEB5331035A78EF9D051243455D47BB2A3FBD36A2F4076C3A744C6ADCFA88A68E33719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173011, "uuid": "2d2f80a5-05f8-4985-ae0a-c26fdd73b237", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173011, "uuid": "a8f98d3d-bee3-4dd5-9181-37aa402f0615", "value": "49152:WfHtEQM6lk/D4Prrffx1o4YhsV1AJD36WLmUXleerXrFXuMj1:WlEQJM4PffshsV10D36emileeDduMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703173011, "uuid": "7b740401-fe6c-4644-8044-52b6c9ed86cf", "value": 2313285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703173011, "uuid": "765c007f-df29-4faf-9948-c38d5bea484b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173011, "uuid": "2c8e57a0-3aa5-4516-afda-b03caef42f4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74856fef-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182758, "uuid": "75d18dd2-be0a-4106-bb07-b7b0c90ecab3", "comment": "Malware payload", "value": "c81024d25bcd7bf44a2985ea880e0598", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182758, "uuid": "717be495-4c50-4047-ad01-8854d330045b", "comment": "Malware payload", "value": "181d9eba276a01a017ed5023f730dd23cc9dc21c8529c21ffdef6672a7df8714", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182758, "uuid": "d29ceeea-3efb-4b35-be6d-4dbaeed22145", "comment": "Malware payload", "value": "b4ba41472d8cc64cd6dbe20e78840c41236a380c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182758, "uuid": "32389ee3-2f4c-4e23-9a26-aa48a9e33186", "comment": "Malware payload", "value": "d917c6d07ec2de974d01c96e8855ff4955a7eb9e5315661cc8c67fe3d1e775bf3645947358bac0511091734696749dff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182758, "uuid": "f357dcc3-910c-4a21-8875-a74eed5574bb", "value": "T136C583D017F9449BE262D5360D60A9F6C9460877FF8AE116B0EEF5D89B23DA0C4CC3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182758, "uuid": "136b940b-0e29-4d5b-b613-3b6e743b4a3d", "value": "388b5d3015eda854153fedd1b62e624a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182758, "uuid": "a29e4a93-d7f5-4216-bfe5-3a07f8d466e2", "value": "24576:L4wTL/eEsgck/0MGbt8jPa1XGs5gWLVA8SazG6yJ:LtTbeEstk/0MmGjPa0WhA87zG6yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182758, "uuid": "661a7719-b786-41ea-b992-9aaad711e329", "value": 2574524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182758, "uuid": "047ca1a4-17c8-44ed-8145-b8f8e1afa2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182758, "uuid": "98e5b6a7-06c2-4eaa-ba15-f3bcae43bd9b", "value": "SecuriteInfo.com.Trojan.Swizzor.3397.13447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a486f5-9fbf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703135332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135332, "uuid": "1b381d2b-e3c8-4cce-a10c-29fd6d9ba468", "comment": "Malware payload (Smoke Loader)", "value": "d1806114ccb4413f0ceef471a48ed8f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135332, "uuid": "e8eea721-c856-47b6-9fce-950a866506b0", "comment": "Malware payload (Smoke Loader)", "value": "1aa7193bbb01beafb0c15358d24d0642685bec304bfe65a2938542fa5fc9e46f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135332, "uuid": "f83a26a0-c1b8-4a46-93ca-dd73c8fe57d9", "comment": "Malware payload (Smoke Loader)", "value": "7f884903b7feb741e03b239849d92f2bced07dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135332, "uuid": "44411a5d-1d13-41f5-9529-b688e841edc7", "comment": "Malware payload (Smoke Loader)", "value": "a37bdbef90ac5695b602a4ce5216ca37ee6710ad279115c6fce0ea2a928a2cf952b3e26f35d3999ba1ffbbf94fc2016b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135332, "uuid": "50dbe348-e6c3-4b4d-bc1a-60321e933eee", "value": "T1ABC6229E2572D91E8D686C326EE17CF7C63C13617F913C088A8A52824BB59D0C3E5B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135332, "uuid": "42578210-9861-49a1-837a-ac76ab9a5105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135332, "uuid": "d2909435-2a47-4f4e-8633-def406b1129b", "value": "196608:Fi5bGZyNP8p8FRO59pA7na7UoYz4NuXlIsaXdgCiIE/dTdPLl02BB9NMo4+7SVBg:AN0iFRO59pA7nVooVIs9ChE/dv/T9NjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135332, "uuid": "fee779d2-4e84-4be8-a154-f6070d16bc3f", "value": 11538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135332, "uuid": "807a90de-24af-4a96-a2ba-4ed22da04166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135332, "uuid": "76d365b0-6a65-4792-bae6-375c23a858c1", "value": "newrock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed738c5a-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174371, "uuid": "8b9495ef-8ee2-455b-aaf9-39bb14917c51", "comment": "Malware payload (Mirai)", "value": "7c9fea3a536f7683117021168f9509cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174371, "uuid": "70042d5f-6e29-41eb-8ce0-0acf2bf5daeb", "comment": "Malware payload (Mirai)", "value": "1cbe5fff606821311c67b77a28b90bf38086b326febaeff893ad9e6df882a23e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174371, "uuid": "56dc922b-928c-40d2-8e9f-f38c0490a502", "comment": "Malware payload (Mirai)", "value": "dfc82ca979e8baab65e10ebbeba9612e7812883c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174371, "uuid": "993c0c4e-9be8-49a3-b719-ec6f0618062f", "comment": "Malware payload (Mirai)", "value": "7bdb62bcf9f1c17c42cb26db62de77f7cb0b75ac689578e6e2bbca54b4126ab9934da86de3b67c0cf19ea7b2822a9738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174371, "uuid": "cf030e9e-1cac-404e-be0d-c6578d5a682b", "value": "T16604885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174371, "uuid": "da463e68-ae79-4f10-b15b-1ed64602c34f", "value": "1536:Cl2JvnXPvLpEQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zet/Y:Cgv/tucwZsCK9VRhAX+bShFSP0HbbelY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174371, "uuid": "907c149b-9645-4004-ab7b-99c1a090a679", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174371, "uuid": "75d8ac3f-749f-444c-ac54-7f71cddbc577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174371, "uuid": "30ae6e8e-5b3c-4957-adbb-52ce1907c80f", "value": "7c9fea3a536f7683117021168f9509cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d4198a-a03a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703188510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188510, "uuid": "23e31175-4f0d-4d4b-91cd-dcc79897e37a", "comment": "Malware payload (LummaStealer)", "value": "2ac53a02ae356521f43bd47806c0727c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188510, "uuid": "d5a64884-031c-49a8-a85c-ee2a32262983", "comment": "Malware payload (LummaStealer)", "value": "1db54ba35abbe3cb1e178971085be979a8c62351630bd9c6e616a6391ab270bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188510, "uuid": "01bc6680-a31a-4dd2-95ad-f6606f819c83", "comment": "Malware payload (LummaStealer)", "value": "49977e78c560c854ae0f5022aa3c5d6c59366c6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188510, "uuid": "cc0b2186-4c10-4f38-936a-1f231ec7b192", "comment": "Malware payload (LummaStealer)", "value": "e41128eccaa8b8d5eef71fb78efadda7759a7d853422c5b06726eeaa2f7a4ea9e1b8e4eee97b9069ade2df760330d79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188510, "uuid": "ac814c9a-71af-414c-8edd-24335fd96a23", "value": "T1D9B5232392DC8472E9D4A3717EF4038A263738E118B9C66B2771748F9872ADDA531773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188510, "uuid": "116432c1-c364-4678-b0d2-15a3ef3bd3b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188510, "uuid": "f3c6db9e-6b59-4cc1-adbc-d20ea0c17dd4", "value": "49152:FFOzsGwNJp72gr0XQZ/8VM+giH+pmGj1DrGpc85Rwxh:OfwnEg4hVvNCm6GpR5Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703188510, "uuid": "da5f57a2-4328-4180-a3b3-94bf64333669", "value": 2383360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703188510, "uuid": "8c5ae3c1-32cb-4ed8-83c3-6fe27e53932c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188510, "uuid": "ef1f1a64-8506-4235-aa1e-585af3a85bb0", "value": "2AC53A02AE356521F43BD47806C0727C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f3db4c-9fe2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1703150416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150416, "uuid": "909b51f8-e4ca-4e78-b968-dbf6242ab9ca", "comment": "Malware payload (Pikabot)", "value": "0536f60350d0c574b8fd9d9ef3367cfd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150416, "uuid": "cdb8f93c-3947-40a4-9dc7-7e59ea825932", "comment": "Malware payload (Pikabot)", "value": "1f361027d2fe02f23373b6c257680e8b7ef26924980f89e14d8fdd39249b11c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150416, "uuid": "67fea3cc-d647-4999-a09f-36b022f77fda", "comment": "Malware payload (Pikabot)", "value": "b66a694c81e9fb169f82467b64fc9e643a4e171b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150416, "uuid": "87c2d5fd-cb2b-4f09-8e1a-43073b46ac8e", "comment": "Malware payload (Pikabot)", "value": "a0b5b1f36c93a167364579313f7a308bcdb5902e94b1ccf33802559610338ce1c38c33a30c2e7535c2a971bc6e34562e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150416, "uuid": "f63bd15a-6d19-4115-8ef0-3e9c65b1ac52", "value": "T15CF4E020AB4282BACD4AB6741CDF2326277473909347C2D3E059765BCD827D16E72ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150416, "uuid": "173e3c4f-af3f-43f9-883e-a6925d49a673", "value": "41180156669194be820c0c0de0c0b730", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150416, "uuid": "9ad46604-96ce-43f7-a823-8594224bfce3", "value": "12288:/tonMOAJVBWzQ6O6/74C5kkbbJC68mKgJLA36VgXgcxMgsKmHc0P++o6ChV4b8D1:OyKglo++o6Cz4bQMyzsfVQRr2Tm0UpQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703150416, "uuid": "4a91849e-97f2-4030-8d56-37e06ba3f412", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703150416, "uuid": "c3a13fb2-45a3-4b7e-b00f-66f38ae126f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150416, "uuid": "5085a616-aca2-4bb5-976c-34456e4a21f6", "value": "Okfivifkigjkdf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8449466e-9fed-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703155297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703155297, "uuid": "c5e1785a-8be3-41fc-80e9-b09b4c56241b", "comment": "Malware payload (AgentTesla)", "value": "4d47c0f77f339310bcb77c88b460cddc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703155297, "uuid": "7599900b-4cc9-43b8-9076-861f15af7305", "comment": "Malware payload (AgentTesla)", "value": "1f6773b4c67343482d958302d8a6dfdb4945cb6d09410f753a55313969eaf07a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703155297, "uuid": "2fadb47e-3181-40cf-a0ba-14959bde8058", "comment": "Malware payload (AgentTesla)", "value": "07ba66ad5c4a28eb1cc23c9c2c558c8f2341237c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703155297, "uuid": "07c0d510-d36a-409a-b0b4-61eb4cde1811", "comment": "Malware payload (AgentTesla)", "value": "8dd197d6e998062030c266ce40b7376f99fc0fc976c5824dfb9ad453345a688d6a6f100886b4cc5984af3b84cd1529f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703155297, "uuid": "6358abe6-0696-4cc0-a816-d4fd9d26779f", "value": "T1C02307F1CE9D1E19B84AEA5ADD428844F7ECCD260612501BAD99038E6F075CC977FB0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703155297, "uuid": "7d5826b1-5533-458b-b94a-6174c0a7eab6", "value": "768:Q9h/5yRL3i/2ElDsfGg4udKexO76bXJPdaOlBh3UN6n9rjAfPkyAjflfGe:QL/5yRO9D+lMLe7aABhEegXMRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703155297, "uuid": "c7440a69-4cb4-4620-a755-f42cd9a8b6b2", "value": 47174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703155297, "uuid": "d1c8fde9-5b7a-4260-beca-3d2433bdc177", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703155297, "uuid": "05a75bce-21e0-4e3c-be04-05ddae12a668", "value": "RFQ20231220 Lista projekt\u00f3w komercyjnych 2024.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743aab2b-9fbc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703134224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134224, "uuid": "8e64c081-ea62-4504-b605-2475c229237f", "comment": "Malware payload (RedLineStealer)", "value": "ca0976d441c38fe4b8809554edd2e3c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134224, "uuid": "fe15edf6-03dc-4032-b955-a18178e15ec4", "comment": "Malware payload (RedLineStealer)", "value": "1fa4ef6233d959052f43cfb416ece175dfbb69f70ee987ec1c21e4981957fce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134224, "uuid": "f31da7f6-30ca-4ab6-ad3a-713956dbcdcd", "comment": "Malware payload (RedLineStealer)", "value": "014b27a230f1eeda2c59d5597d27af46026f3e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134224, "uuid": "65ac6254-6cdd-4a46-9e32-55fc910e77a1", "comment": "Malware payload (RedLineStealer)", "value": "905ce431f06b3a1e103d15b41c2d8228583deffc8fbc799b7502dba7f4c9ae6e589a849a6d424f993b275ea781e8b73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134224, "uuid": "f34a1d4b-5f33-46d3-a1d3-df64c59d95cd", "value": "T1665633C7E6A449EFCE5E137860FA03030A457DA005B1967F6A8860AD1873FE569367F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134224, "uuid": "0122f2f4-57ef-4c19-a0e1-1b41852ce5a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134224, "uuid": "f7b2d21c-fb15-47a9-8382-43e6ac06a4b5", "value": "196608:NgG9yGvLGL/ITllig9ZJ7XO5coUtJTu+Nku:4VL/IxlisZJTOUJq+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703134224, "uuid": "9c3ca283-95b7-4a8a-ba61-0b7c112020b6", "value": 6423552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703134224, "uuid": "e169d271-af8c-4882-ba46-22be80e0b79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134224, "uuid": "4634eb3a-588d-4520-818a-e8d8ac5bdc77", "value": "ca0976d441c38fe4b8809554edd2e3c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfe9105-a020-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703177028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177028, "uuid": "571fc513-07fa-490c-ab80-4006855532d4", "comment": "Malware payload", "value": "b0a57b92cae07ae3cad328836c68e96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177028, "uuid": "2ee3a88c-5fe1-4a57-bf6a-81f810e43c1c", "comment": "Malware payload", "value": "2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177028, "uuid": "b25beb57-3978-45b1-a7f4-40c4762791dd", "comment": "Malware payload", "value": "c0780cfe1ce52bd8c87c73a4e2887a3f6981dde9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177028, "uuid": "daeb60a6-9cae-45b4-89e1-47f6874d82b0", "comment": "Malware payload", "value": "7eb5d7a74846e95611f370bb1d428df12fc26f52ca89c405bd922d6caca94110517d1a93ef6925312b135831b3895a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177028, "uuid": "f212be0e-f664-4a82-9121-2db71fd777fe", "value": "T122B533307FA346FAC7517871DDD64BF692F6DB1A43002B975780C6A9AD386CC9338688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177028, "uuid": "16264e23-03ca-4eb3-8f78-90f1e4c69f5d", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177028, "uuid": "087c15db-da2a-4e5c-9c7e-3a4ead78074f", "value": "49152:UJGiWtEQM6lmdgfnmQaRyzFOmukuffX4gMUuxmQ2T+wSHSqrxShmVJyOBWJB:UIioEQJugfnfa85OUufnyxx2T+w1qrgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177028, "uuid": "c5eb5ff3-d574-4fcd-86aa-759771a6fefc", "value": 2311997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177028, "uuid": "30423ba2-0cbf-475e-83f4-3c872316f50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177028, "uuid": "fc0f72ba-f42b-468e-a6eb-cffff8816503", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d190d7d-a045-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703192973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192973, "uuid": "f846f36f-cb3d-4d7c-90d4-66e14c0797b6", "comment": "Malware payload", "value": "35efd4929ca380c9c7b2956a75f3cecf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192973, "uuid": "34ce5187-1fbd-4c30-b8b4-2d80ddabe50f", "comment": "Malware payload", "value": "216f15601add34daf25b908b6e68d4213396e7f7e47c314355527d9eec673963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192973, "uuid": "a35fb7d8-9db4-4011-aa97-ebe1ce9ee4da", "comment": "Malware payload", "value": "c69a19897cb5bd069dab8ea704461dc5558bed4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192973, "uuid": "a89f54e1-88d1-4f6d-a86e-3554c4448921", "comment": "Malware payload", "value": "12d2513d628c095ea24a35ec5858f07c351c7d3664927cfdf1643b7192d254935a1b1f4f5bce5686d545419454535b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192973, "uuid": "6660254d-6ed6-4ebe-adf8-c6ec8f2a7269", "value": "T158B5E017F2BE85FFC12249758B3F53F799E86E270C30725A71E9A91C4E36B8824251C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192973, "uuid": "b57f838b-f258-4da6-b20b-94370989ff5e", "value": "c3f6c7d46c5e93a63a61ee9778465cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192973, "uuid": "e44ba23a-82da-4755-9dc3-7e07c2852fec", "value": "49152:cCHkJ8nYA8toheNwf5bgXPlUgmAY99q346GVGnc3S4YaXCuLIp:ceMtDuh8NUHA8q3ZvC7LIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703192973, "uuid": "4439ea9c-9cd6-49cb-a470-5a418a9a9662", "value": 2448896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703192973, "uuid": "d9553071-747f-4ad8-863f-01acda68a232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192973, "uuid": "bdb9e9e9-426d-404c-b28a-fec441cc677a", "value": "Ref 122023e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab810e6-9fa5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703124169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124169, "uuid": "af1f9fc8-a249-4fa9-83c3-2795568fce8c", "comment": "Malware payload", "value": "37100e4a43f2b008a1961315e5797f15", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124169, "uuid": "58cbe612-6d9d-44d9-9277-7516fa029168", "comment": "Malware payload", "value": "23087de9decec4839758a8877d352c9607a8191724703f21cde6e6b2cb4cd04c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124169, "uuid": "511f8ad1-f6f9-4805-8cd7-1f2aa0ec1b26", "comment": "Malware payload", "value": "c831bc8fc3179b7ded46ebfc40347233dbd065bb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124169, "uuid": "872861e1-eeed-424b-8802-9b642b5ca80e", "comment": "Malware payload", "value": "df482e57aedbc76fc877277a6d6ce2df812c26b64a24e14453266284bf7f1bddee208bcf04968e030ad582826fc793ff", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124169, "uuid": "d7a5916c-5670-4f8e-914d-ae66cd4b8547", "value": "T18735E082B348E427CC33C93947F9476AA6858C5059A7E31719A5B61C8DFFED04E88FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124169, "uuid": "1eee79b7-552a-49a7-b993-f1fd13e931d6", "value": "24576:wWQKTVanMbVtWa8yZqXyLDgvFGMWxcfnl3evzn9Tn:wWp8nMptWaVqXyLDggMHfUzn9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703124169, "uuid": "647aa2c8-e79f-4227-b246-8508a821c466", "value": 1097282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703124169, "uuid": "2e972181-3f22-4d81-9aec-e2bebcb15caf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124169, "uuid": "ad9cd314-fb6a-4b64-9e48-4b1a787b5905", "value": "Ultra.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f54095-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703187934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "0191c28f-d7b1-4959-b1af-d70b90eb5d3d", "comment": "Malware payload", "value": "0607a527a8ef15720f3bee3a134d3e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "c148ffe8-db56-4d44-8e87-45bf5392d406", "comment": "Malware payload", "value": "236b141121d5f8772f85bf485a6675102c871e22734bcb8f2e11478c2d8d3365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "2e365e9c-f98b-4773-816c-12091f7d2909", "comment": "Malware payload", "value": "9777a7ffac5e18b9b8b9a566a1be17f0ab1ab402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "9874c995-7bb8-45ae-8e8b-e4e45a1e3166", "comment": "Malware payload", "value": "eee60c35cfe4a3ae0d8c44a2566eef680b1c80937b5f932f1906fb81e667fe8c72a619f64f8988cf02475f90ea73d400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "fb4e5a3b-7f8b-4ba9-bccf-d3f9278b9cdd", "value": "T15966334AC9071EC3C9BAB074F1635B8317DAFC98E03655C2D8DEB2485AF6D0AED06761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "fef24154-9a35-4f3c-a0ee-72a10ffb42cb", "value": "6ea02e00483c90b3f210e2d517ab619a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "70f092e3-fa01-43a8-88e7-3dc9aa038d11", "value": "196608:l1cMrm+eLFVlfqATlzu6TJDFqODrncCIexHIKfU:lzsLFVlxi6TZcOVIcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187934, "uuid": "373ebbd5-d735-47aa-b4cf-b25bce50a372", "value": 6661200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187934, "uuid": "588f49f6-99b0-41ed-b153-309a50b13937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "39aa5490-fe5b-4fbe-9aef-ba5fabd9cb43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4ecd40-9fc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703136171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136171, "uuid": "5b7e2a9d-b783-4998-919f-f48e7f007c66", "comment": "Malware payload", "value": "dcf8c8ef55fd294027997128de155b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136171, "uuid": "86715ab5-ee76-47cd-97bc-05b9191f0585", "comment": "Malware payload", "value": "236c90cde83b3dc403c3c186193b0d2cd14b067f6b4c840d5f0baee57840eba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136171, "uuid": "50e01f43-984a-440e-b1bc-270a9713e36a", "comment": "Malware payload", "value": "a7ca95740760a4bb57ef61814ec1579568fbffa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136171, "uuid": "9909360b-3d93-458a-a02c-439ae23dedaa", "comment": "Malware payload", "value": "4293810cebfc458e2da64c7be6f442b0cd31eac0551fc26a64a25d2065081590324f44191e648d5e89f080f4893fd51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136171, "uuid": "1ff6da40-7611-43e3-bef5-cf42a558d778", "value": "T1CAB55A46B2A148E6D3A68038CCA6E667E771341D47F156FB3680C7D92F33AD17A39312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136171, "uuid": "cc510527-f8e7-423c-b669-1be692257075", "value": "a85f38e7f91123fad59670d6f5a40ae7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136171, "uuid": "71400f96-5a9e-46a8-946c-ee633df436e6", "value": "49152:V2JQb0rvdEeF5XsHuCmDKTkB7a1GwvvnE0jVBTs6vUaB:5wHH0kUHZjA6v/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703136171, "uuid": "d8e5e836-0a29-440c-aabe-18c966a908b2", "value": 2334120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703136171, "uuid": "2e958a04-5794-4980-a041-5b1cb39c72c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136171, "uuid": "5d4989f7-a09c-4ffa-bab6-f1481e005cc1", "value": "Go.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47524065-a010-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703170227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170227, "uuid": "4283c9e5-79b9-4f08-9b30-1cded3560b37", "comment": "Malware payload", "value": "de669b04aa35fb4e15fe445c9f0f2ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170227, "uuid": "284d4a0e-c21a-4d75-9a37-d77ad8656da8", "comment": "Malware payload", "value": "23f66cb1747f3416fe4be36fabd5e29d4855d4b0964cca68b922d8f0ed541403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170227, "uuid": "0ae38218-1973-4af7-9729-563a16ded6c9", "comment": "Malware payload", "value": "9c812cd787c41fe8f89e17919f9745f9aa35d634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170227, "uuid": "59f98010-ba1b-45c8-8d1d-e5f9ec78ce49", "comment": "Malware payload", "value": "42f8464f6c3b3f1d8527b4306d47698686ab82877491f4f8fed1ba6387d7d7c8e65d6c6daaf5c8479f38577e7d7db393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170227, "uuid": "960ab7c4-743c-4a13-9800-41ed9d92886e", "value": "T1C115BC00A758AA19CC50067DC5A2457032A6BDC5D2129ACFABE6BD9FFB3CECD41C075E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170227, "uuid": "95ac026d-b067-4353-a3fd-4d31559c9b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170227, "uuid": "b95b443b-6a98-4ac8-a20c-dc1c578caf8b", "value": "12288:e8r3tvQ8FTrAhcuW/6m712Ao/1jHmq4qs3WM7tY6sgDuC6sIYhzOW:ZRAcuW/6mVAi/Y6sgDuVsIqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703170227, "uuid": "3cd7bc8b-db41-4b9b-8dd9-acae13b34657", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703170227, "uuid": "a9832086-9011-4719-9ac2-705f7da45588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170227, "uuid": "84a89edd-352e-43ab-8fe5-59f51778c826", "value": "Purchase9175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5a1544-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182749, "uuid": "0d06b339-fc67-4716-8021-5d5e187a6330", "comment": "Malware payload", "value": "d31bfcf4a3401bc03ac16288ad584aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182749, "uuid": "74022738-5c9f-4304-b299-af97593ce814", "comment": "Malware payload", "value": "24d2aeb3a5dcdebf4e0ab9b26d62388d5c97a6c9d9a5358efce11001f1aedc5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182749, "uuid": "a6bac6e9-3c75-4c45-9162-3686eceb51db", "comment": "Malware payload", "value": "aab5be26bb48d67dc56b89da60b8d34975253718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182749, "uuid": "b79ca398-dcb0-4489-b669-03cac8fb080f", "comment": "Malware payload", "value": "a7eecf0284f0fe8fa13079a3df7a4eea20f813337947523da0551eb9805251cf83c14e5b51975c9cded00660bcfaf9e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182749, "uuid": "81d5fd40-66fb-4cd1-a955-9e5de20cfd9e", "value": "T169649E2179A8C079C38F123449976B36B7B9E901AF71C78B9784DE4DDD333819D3622A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182749, "uuid": "08fbd482-8744-420d-ac47-8637194696d6", "value": "3072:YF7w7EnQ9E28eai23aZEoVFq5CQb7DJzFt+p9o5OR6CiO43KVwruzfUNoL:YF07EnuhkaCwGDVOqFCt43KVOub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182749, "uuid": "c7681712-3f32-4248-93c9-e13c206f75e1", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182749, "uuid": "e529224e-ba8d-4516-a38e-42b1c614eaf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182749, "uuid": "4bf6e79c-5b22-4eae-a0a9-534fdcf5f58a", "value": "SecuriteInfo.com.FileRepMalware.15072.1615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8180e84-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174389, "uuid": "76856bab-f759-45e2-a173-07d1137c1717", "comment": "Malware payload (Mirai)", "value": "139e4f8f864fbb4e47d8090cbb692bad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174389, "uuid": "3fecf124-8b56-4895-955a-d8d3a88ccd77", "comment": "Malware payload (Mirai)", "value": "2507ed7dca07f592283b883ef85259e7591114d35589177a1a94d666f872b050", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174389, "uuid": "641121eb-0b0b-4767-ae28-432cc9d0adca", "comment": "Malware payload (Mirai)", "value": "3aae07da99edf4fe0d901b4fe2d5e1ca85b49360", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174389, "uuid": "7e0134e5-5ac0-48a5-b6a9-4f6b685284e3", "comment": "Malware payload (Mirai)", "value": "7ae09278ed44a26213073f814754647a049c90afe9ea272572c1e5c0380d3657022e644c34b3c5927b5b9c040ba2ee12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174389, "uuid": "69b274b4-c19c-4c7e-94dc-a9d185eb6d13", "value": "T182D30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174389, "uuid": "c6364b9e-ac15-4cd5-bbba-3d7200cdc0ed", "value": "1536:VHQeHIjFlGz/r56Qpd/lFcAPWZf4VTyqsTgDFYAvTTu2/oAdmlN8Vwyw2FR40o5N:VHQeF6QH9FcT4YZMDFYA9gAplNibR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174389, "uuid": "447f1203-4b7c-41aa-83bf-5e01b5e00653", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174389, "uuid": "4a585ed7-69f9-4c99-8da3-314d914d11be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174389, "uuid": "8ce28a8a-7cb0-4756-bf33-0038815d808f", "value": "139e4f8f864fbb4e47d8090cbb692bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d580349-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703187927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "743b8a52-2776-467e-8b50-5e39bc137c8b", "comment": "Malware payload (RemcosRAT)", "value": "adc1deb672b954a11f494257f804a596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "4b1d2d92-b38f-4ae4-8ac6-e2c53ab3e883", "comment": "Malware payload (RemcosRAT)", "value": "257060c9a55f064aca8aa6ff7003b80d72c9dd08b63922241ec468b05ed205c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "8e0d4019-8845-441c-8f10-b36b65e12139", "comment": "Malware payload (RemcosRAT)", "value": "1557bb04482f0e265f863729141d77484d77c35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "e1dd191b-2b5b-48c7-b424-621cc47f4818", "comment": "Malware payload (RemcosRAT)", "value": "a1cd78949a33b97a263310ce4aad15deab22f01e76f9e3acd3368d1c9964140b8a914baa26855772e53615a87399c1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "aae7d679-a89f-468c-87a8-1130c39ddcab", "value": "T13F949E12B492C032C17212740E29FB7599BCBC212936597B73EA5E5BBE741C1BB36363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "4a9f6146-97b5-4f30-a50b-fec2ea550168", "value": "8a3b06a792183c402d038c6ccea86944", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "c9923e9f-a06e-435b-8cd8-3385ccf051fc", "value": "6144:JCJBSkHyP4DivRrO+d3cyU6320ho4nbJAj0N91EU7ZUFbz68AO2LjXH7Ocro6B3:JCJB/RuFhU6ho0ej0N91HFAAL771B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187927, "uuid": "f8e9a234-69db-46c1-abda-cbdba87fcde7", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187927, "uuid": "f0a76ef0-4633-475b-a78a-22f24459dc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "78892b94-5707-4a4b-a938-92d97a867b31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075311d0-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186440, "uuid": "81c63538-ca6f-48c8-81f0-61ce025d16f5", "comment": "Malware payload (Gafgyt)", "value": "cd94b8756be85a964b9a33fb4a12e58e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186440, "uuid": "465f4a01-016a-4e8a-ad02-832cc4da32cc", "comment": "Malware payload (Gafgyt)", "value": "26180b0396a7a1eb09838bcb33ba60e50af455e1938b6d5a29ce21c7c34b88ab", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186440, "uuid": "bf3621fa-e54c-4444-8c91-76449a212a0b", "comment": "Malware payload (Gafgyt)", "value": "d8ea638a006aac7196b8b0049c6aff1ebec44415", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186440, "uuid": "41f0c4d3-0200-4570-9238-643e7f00e5b7", "comment": "Malware payload (Gafgyt)", "value": "1e78a1c46a5fb7101552c4d95494735e7500eb03f9ac7be07e4ab52adaf69fe424d395f48e7de21dec0dd3bbbe887347", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186440, "uuid": "3c424490-1842-4dd9-80e1-d142908f1277", "value": "T128833A276391C67AC047A1F027FB9972E821BDBE0A36B15E3390BE615F39DC11A4A711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186440, "uuid": "6ba805bf-8c18-48e1-9721-7140881d6cb8", "value": "1536:aVnirf3qAhHvvX6YbESLAvM0gLVxoOOqjYum0Hi1pczCf3k:ahir3hPvX6YRcvapOqjXLC1pUCvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186440, "uuid": "aa4acbb3-9844-4660-b8dc-da2f7659b9d1", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186440, "uuid": "9f84acd7-3ce4-4cf8-8657-4e2a441d7ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186440, "uuid": "b2303d11-9360-4db7-91f6-a9d7cb8ebdc9", "value": "cd94b8756be85a964b9a33fb4a12e58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fd7091-9fc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703138715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703138715, "uuid": "e92e957f-8efc-4ab2-9a48-94d6e4ec2420", "comment": "Malware payload (RedLineStealer)", "value": "99d4641b7086bac33afb31109d9f147c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703138715, "uuid": "2a7379db-6d77-451b-9389-ee76688a90e2", "comment": "Malware payload (RedLineStealer)", "value": "28c4735fb049f602408b6275f7927604993a5c5afa88421af7d22a9af14af241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703138715, "uuid": "e875259d-8ed9-4c3c-ade3-43806ee267f6", "comment": "Malware payload (RedLineStealer)", "value": "1fa36410b3653f3b2e124b5843e2b4cfc3704761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703138715, "uuid": "105ca3e5-a993-4985-83a8-49efc1249e44", "comment": "Malware payload (RedLineStealer)", "value": "e5b52ebe0ff9c106f85e70eae3d36310975dbfdaf74bd26b89b84b221057a3fedc951e13560b96163186f5bd113601ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703138715, "uuid": "731329d6-25ed-4315-80a9-4d55c4fa8122", "value": "T165563313EB6054A7C9CE13F469F422A30542BC1257E4D6BAA68DA10A0F71FD9F4723E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703138715, "uuid": "af219f14-31a7-4204-a4af-0e0c247f8a1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703138715, "uuid": "7baaa07b-d681-4add-affe-f502b7197fa9", "value": "98304:e0j3Q8E07ln2S1scpCeFIu/gSbJjNMA6c0FOXztuMLmviV3ps5gtvvpt+xzuKR:e0jK07lP1k5u/1CFaLmvi9uGtvvI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703138715, "uuid": "cd620e6b-435f-4807-8048-18c72e04185e", "value": 6431232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703138715, "uuid": "3b2d235e-ba94-4982-9370-846d3ec988bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703138715, "uuid": "0c7012ce-855d-4c64-8e59-4db211d7265d", "value": "99d4641b7086bac33afb31109d9f147c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386cc53b-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186523, "uuid": "deeacd6f-5908-4a9c-86dd-4e12c108b54f", "comment": "Malware payload", "value": "9c07c3ae762048d955e608bee76dbb07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186523, "uuid": "114740f1-cbf6-4cd1-baeb-c20740b74019", "comment": "Malware payload", "value": "29105d4f65c90d9bb927de26d2c5fa5760b4dabf6279400eebf4deafeaecf7ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186523, "uuid": "79312191-dff0-4f34-a39c-d62b9e3ad32c", "comment": "Malware payload", "value": "f3c1f2e6d06cb9027af8f9e0f2be068b4b854610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186523, "uuid": "b1ca5aa2-0b89-4cce-ad15-461c7b8789bd", "comment": "Malware payload", "value": "601d56c8b4cb95396c98ff6397bb62ad188903903ad2e19ef49bc679ab910f259a9b1c4b0a97b02ea44806b2886ce403", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186523, "uuid": "e4807dbf-0e39-471c-914c-803244de8996", "value": "T112B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186523, "uuid": "a792d83e-e06f-4e98-a4e6-999f1c22b06b", "value": "3072:MDVLSItJP+Xsp4JlN3HjjmH1cuEgvniuN/:MDV+ItJH2l3HjjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186523, "uuid": "c5070d3e-c428-42ec-896c-849a59f38a6e", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186523, "uuid": "75af58dd-ae29-45ea-a168-e1c87baddd02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186523, "uuid": "62788303-fa09-4cbb-8549-d18aa8a49889", "value": "9c07c3ae762048d955e608bee76dbb07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b012b01-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186903, "uuid": "f60e1ad3-129a-42b1-97ce-274dca4a5012", "comment": "Malware payload", "value": "fc20d8015e51bb6eebe62c26ddc4a45d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186903, "uuid": "16d70d5f-889b-4c94-b9ff-edc7d55a6a61", "comment": "Malware payload", "value": "29f5abecc47f6322aa3a0f5093818af6ff71d5bd5e2cf6243e0ca691ec8449f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186903, "uuid": "38917036-6bb4-41f0-b2a6-4f6e99636426", "comment": "Malware payload", "value": "5637392b1c5cc71704c4edce460d1d02ab6545a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186903, "uuid": "d4fba77f-8e92-45a5-b602-59932a71ab4e", "comment": "Malware payload", "value": "546b7be1116f6c8e79450a02927574cef7499703f3380c0df895ce8c392ae7c2e2fb3ec1b6a0fb2878665d3e7994482b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186903, "uuid": "b690274a-1e40-421e-bff8-c96db2c2c225", "value": "T11A93F54BAB190B43C4975AF03D373BF0871DBEB112EA41C4601AFEC543B69B56116FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186903, "uuid": "70c07054-0515-44a7-b8d6-e33878cff8ef", "value": "1536:r+ItpSYxenV2jCDXIoUmK5U7sZ1whTu6YTDUu:yuJxMso7sZ1wgWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186903, "uuid": "32c89480-0bf3-4c98-8ff7-6fbe4b14c35f", "value": 90720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186903, "uuid": "7c481aeb-6c49-4930-8a16-bb54a455e2ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186903, "uuid": "50419295-db83-4831-b5a8-32c36f3c0f7d", "value": "fc20d8015e51bb6eebe62c26ddc4a45d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d296d31-a00c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703168599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168599, "uuid": "9cf64a97-adaa-426e-9006-bcaae2ce7fa8", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6bbd32779fe304a44a73568897f49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168599, "uuid": "e65d24df-58c2-42b6-840f-a017348390e6", "comment": "Malware payload (SnakeKeylogger)", "value": "2a2ddd46e762a33bd47b94a93f06a0a8560b868e8a37e5f1b9d6515ead3e974b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168599, "uuid": "6fe566c7-4549-475c-828e-c102a5410788", "comment": "Malware payload (SnakeKeylogger)", "value": "f77f48709630c9c04cc12de8b286f21ecd05b7d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168599, "uuid": "5915b70d-f904-4166-b91e-6a3b1439ee71", "comment": "Malware payload (SnakeKeylogger)", "value": "a4aac02fd52597c556e12ac6cc767ce8dc4fd6665fb2b13e9f76d5c3dd0fb0d58cbe3d3931a4a07356e2608511c08082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168599, "uuid": "4388a705-207f-4d07-b2a6-43df9b2ad754", "value": "T1F9F4AE0673E1877BE3E60738B4B61A24AF37EE476622CB0B1128752D1E737508D66793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168599, "uuid": "2fc87ce4-edbd-40e3-9d6d-abe63bd76e56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168599, "uuid": "049d6153-6ff6-470c-adb9-8d070033486f", "value": "12288:W8pYTbiR6P4mpQO9odLg8EJk0xcNuoOO+1/1CtXu02WB2fBNDark:9pY06P4qpzTCtXdJB2fBNOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703168599, "uuid": "75ae677d-22dd-4b15-b425-c8e446c9bc6d", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703168599, "uuid": "391b1a78-0bc1-4eda-bcd0-87027b2034be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168599, "uuid": "35e650d9-379f-4a7a-a7a9-805737fe2318", "value": "MT Marine Tiger Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95547773-9fd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703144588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144588, "uuid": "be5a1ff7-d6a8-4230-be02-41d22afa247f", "comment": "Malware payload", "value": "ca032100ce044e0bc1e0a53263ac68e6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144588, "uuid": "737cd6aa-9524-4450-83c3-0d0321f5a40a", "comment": "Malware payload", "value": "2a533047b555a33bcc5d4ad9fb6f222b601f9d643be908c940c38284aa4354b6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144588, "uuid": "41ad4a92-7034-4202-96b9-1a83eabc2201", "comment": "Malware payload", "value": "78db48c4a735802ea4b21d638b0f0aa37cca4150", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144588, "uuid": "979c77d7-116e-46c2-99cf-5f5f93d141d8", "comment": "Malware payload", "value": "e751271c398c3422b915822796ae3f027f9d0071c8eea6d18a82a4649429dbe49f1f8f4cbf54e921711734c5d7fd0355", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144588, "uuid": "9f0b7da8-d11b-4a81-9061-6749d304e278", "value": "T173F3786DD34B01698F625376AB1B0E5442BDBB3EF38552B1346C433533EAC39A1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144588, "uuid": "ca0cb35e-1a39-44a0-9316-555b6739ef1c", "value": "768:EwAbZSibMX9gRWjtwAbZSibMX9gRWj5zdOvkLHnBMsfZfHB8vTxHZeOFxd1c:EwAlRkwAlRg0sjBMsz8LxHVfd1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144588, "uuid": "270500e6-4b79-4756-ba94-e9d85c1beb97", "value": 172627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144588, "uuid": "e69231b4-cbe5-4a9d-8c0b-8a55a3ff44c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144588, "uuid": "9e0f90f7-653c-482f-8a7f-bbfba023b107", "value": "Angebotsanfrage.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d9904f-a010-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703170328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170328, "uuid": "32825f39-ce62-47a8-a71d-8a1134e5ff7b", "comment": "Malware payload (Formbook)", "value": "293c1c50eed94803b266e5f4ad0d3709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170328, "uuid": "0347f014-61ec-44a6-88fc-dfa9f865ffa3", "comment": "Malware payload (Formbook)", "value": "2a9a9d68950f957e7736dfb824c8707c256c675639c190dd1f04164eddd6e160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170328, "uuid": "92459c5f-8d14-44cf-bbe7-de4b2f24ad4e", "comment": "Malware payload (Formbook)", "value": "a7d8f2aeb26c69a041ef12b344767fd2b0ecaa72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170328, "uuid": "842e1c68-5799-4b6b-b070-7c42eaa08a5e", "comment": "Malware payload (Formbook)", "value": "39169c2850fadfe3ab0d0ff6a880c72e9c792c704fb005611a3fb0f036d157960789bd8f587ff0aca8f4614efadd55cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170328, "uuid": "bdbfa1e5-bb7f-4a84-90a1-ebc38e67c236", "value": "T18AD4120529BD9B1BCA7943FB5921671047F1B92FA930E34C0DD5B0CA29B7F225A90F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170328, "uuid": "d48bce63-047d-48a1-a28c-695716d378bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170328, "uuid": "cbd00a3a-17f0-4f69-8407-4a696b6c345c", "value": "12288:xR6MtvQ8FfRTBfQDHEuC88T66nJy9+Zfv6qWW:GY8kZ8Ky9+5v6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703170328, "uuid": "e750bd3b-6853-47dd-96d3-dac052da5bff", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703170328, "uuid": "e16d4f47-1048-4e72-9bca-fa38ee036acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170328, "uuid": "76818d88-88dc-4ff9-877a-d81bae59f28e", "value": "FATURA PROFORMA pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9753d3c8-a013-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1703171649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171649, "uuid": "6d75d18a-b70e-4ae1-baf2-2ec90a1fb024", "comment": "Malware payload (Amadey)", "value": "5c191fbf8a2cc24dc09e0611c5079630", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171649, "uuid": "8fd4be64-8bb9-4cfb-ac12-17cb5396885f", "comment": "Malware payload (Amadey)", "value": "2ab9df9543e120af2f8cc46ac0fa01623022e9c0497c081311793e09defd6200", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171649, "uuid": "662939ad-ed6f-43ad-9b5b-50523597cfb3", "comment": "Malware payload (Amadey)", "value": "b1b6b878c0a5892ea745e59c2b001c396441da9c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171649, "uuid": "6a5d459c-1e94-4ddb-8c6d-7739de42bb19", "comment": "Malware payload (Amadey)", "value": "612d3aa9c4aca965078b4ee554ff340717a0095df7ba59f9d6bd4e195427571176cc9710cf07411c4417cf4d6085e65b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171649, "uuid": "52748c6a-305b-48cd-9bf7-879ecffed04e", "value": "T19766124274D2C2B9C4470A343496109970E2ECDFC4EDDB0A4F85DC237DE7FA6199A7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171649, "uuid": "d50eb375-02ef-4d2d-9f04-5ae7ec36bfd0", "value": "d4b39939d931c069cd7b29321ef1fa9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171649, "uuid": "37a86794-2445-40fb-b6fc-c13ba0f2bd01", "value": "98304:MWlTmNGxnk//ZJVpA8DHfdsKYC60TKawKviLiGYK27rTfpIjvvNtIysXYCSQbzvX:MUm6QRbdsKH66wK5GyvWjttMXfag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703171649, "uuid": "19a9ed8c-ea8a-46cf-8074-222c9537876b", "value": 7079936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703171649, "uuid": "e600d766-23eb-4bec-957a-add7f82d200a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171649, "uuid": "4faf39cb-bdc6-43b1-a754-083594791350", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cfc3f8-9fe2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1703150407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150407, "uuid": "0da0cec9-6d75-46bf-bfa7-c3452c705776", "comment": "Malware payload (Pikabot)", "value": "b17832d27eb06989e5432d9ef0fc3d19", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150407, "uuid": "7af5434b-6d96-472a-83b3-6d692ad44aaa", "comment": "Malware payload (Pikabot)", "value": "2ac448d38d56a5cbb4ce0dd770ff4f40bedf3c1a70c2a2f205ab37748c93bfea", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150407, "uuid": "fee33e5e-4907-417d-96dd-d209d6da7db6", "comment": "Malware payload (Pikabot)", "value": "54dcfd1b4fbacb22fcae10c4b8bec0d6985680d6", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150407, "uuid": "050cb62b-910b-477b-aff4-94852e5d6460", "comment": "Malware payload (Pikabot)", "value": "4509d2a6c277679d190efed91eb8b136d0194dbfe16ac190a228562c92e624e5c7b1c5edf6a4a4846d07266961e1dac7", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150407, "uuid": "a576d930-5bba-43c5-bf4b-0e8894e051f8", "value": "T1164302CBBDD01A96CFC6A03ED19305C48881EED54F306F9E4FDAC6E105B592C3A5B626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150407, "uuid": "77fc799e-43a8-4a19-a6f6-6ededbb493dd", "value": "768:Ftpo5rGdejrnuriR/sWE3107hucVCxv6Hw2D8HUKsD5UVtO5d985mjJO27apw5vE:nOzsWe1s2x7EUUcVk5doYEpw5vIgabT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703150407, "uuid": "27aea71f-5583-473c-81c3-c19396f17085", "value": 56461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703150407, "uuid": "c6bb9934-322f-4c6e-9df3-e9fd06a2ff06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150407, "uuid": "43675bea-ac47-4a9b-9503-edb900b2b463", "value": "OK.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb3d181-a041-11ee-b7ea-42010a9c0006", "comment": "Malware payload (OrcusRAT)", "timestamp": 1703191204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703191204, "uuid": "3c76bb31-b366-43b9-b5f6-0fccfb159d3c", "comment": "Malware payload (OrcusRAT)", "value": "3a9cec4dc91e9070f66126db353daa3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703191204, "uuid": "3969867f-a3eb-41a0-a71a-e7f79da61c7a", "comment": "Malware payload (OrcusRAT)", "value": "2afae8de1839b3d0f9119f518e170e2ade9b4768af627c7d40d25dce4f2b90e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703191204, "uuid": "a0aa22a6-3705-4483-aec4-135daab379ef", "comment": "Malware payload (OrcusRAT)", "value": "93ecdf309396c541ed16c2041c8ed8be30d64e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703191204, "uuid": "4b0419c5-8d08-4de9-bb5a-3365aafcb8c7", "comment": "Malware payload (OrcusRAT)", "value": "4f2e522d1cc725573f24014de25e1b97211fa3b342050950f534b9e848582b72cf48568b15dc1ea790a6d7a676e917a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703191204, "uuid": "655e3680-7f4e-4c2a-9ea6-c0297f7399d2", "value": "T13F45C013E54AD999E592B2309A93F27C81337E9FC766051B6CD17D17BAB0380112FE8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703191204, "uuid": "d631de94-122e-4474-9890-055e3be85474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703191204, "uuid": "06eb6f1a-b525-45cf-b2d3-c6edd146c594", "value": "24576:WR4g2xvkun2PmbusWut1D4bEN1fYKkZ9EBo7GM52qOj4vjhJ7htehTl:WR4Hxv/b7WutubEc7qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703191204, "uuid": "a64980d8-8ad2-440d-beb5-d863a978e0e7", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703191204, "uuid": "239fad86-dddb-4a16-bf28-2d9dd0eb4365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703191204, "uuid": "afa814ca-f6cc-4e9a-9ddc-546a9d43da7e", "value": "3A9CEC4DC91E9070F66126DB353DAA3D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6282bd53-9ff2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703157387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157387, "uuid": "9568e58e-2dd8-47f4-9da5-dff3dc71bc48", "comment": "Malware payload (CoinMiner)", "value": "4737e1a615b8b7d377586394589844d4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157387, "uuid": "983c8a2c-52cb-4345-b2f1-ae9cf0b8b541", "comment": "Malware payload (CoinMiner)", "value": "2b067ba72193583c9a70e0fbe192f3a7ef7d9855f2769e9b26d1af78bae018c2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157387, "uuid": "a84b1958-4875-4ded-b166-f1054d68f466", "comment": "Malware payload (CoinMiner)", "value": "64d7c49646b2e716f273b528ef3669dbf806fcd2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157387, "uuid": "e77b9c0e-4128-4cf0-bfae-0f32295a5c8a", "comment": "Malware payload (CoinMiner)", "value": "9224bf22ebbf614ceee1af908efac6ad277ea5f785ad7e6bc9f25fd299d542d6d3717bc0e8fe33f09b6be74292edc8ab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157387, "uuid": "039b8f28-56e3-4d44-9982-c34f3286bf5b", "value": "T1ABA5231CED0F8ECFC22795F8E9A393D221C6FC81853E20D564CC475A6629E49FD45BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157387, "uuid": "3d0b5533-431a-46a0-a960-8556c6ea5b38", "value": "3dc2aca3233722a4e374d834738546c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157387, "uuid": "6d4f37a2-0d6e-4e33-8626-cb24fe1afa2b", "value": "49152:2thzjwpLewzG7pvwVPeS3EDWNKGJMFHRBNdnpgnfK:4zjEGvwVt3EDWgEMFHR1pGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703157387, "uuid": "9667d367-550d-4bd8-acf7-155ed23602fa", "value": 2254928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703157387, "uuid": "0e9cfb93-c4a0-4117-8de5-c3dbddaa3d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157387, "uuid": "de1ff229-cc87-4e62-bc76-438bea52bfd3", "value": "SecuriteInfo.com.Win64.Evo-gen.29484.26217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc545caa-a012-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703171336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171336, "uuid": "e9e3cdc0-53c1-4e39-856d-8e86d91c0d51", "comment": "Malware payload", "value": "9f066a62e22b98b0fad7fedfdee68b52", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171336, "uuid": "5a119325-9b31-41fa-aa3b-a470c5d64e5d", "comment": "Malware payload", "value": "2b7c1c57725451109a1a9217aa02507a0f37e67b46f91d5d153bbb1d0e4122b4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171336, "uuid": "984a8695-7229-4822-847d-d7faa5621683", "comment": "Malware payload", "value": "e82bda281cd56e2515f3b351f8cb7d074986ed13", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171336, "uuid": "58909af1-0d29-4f58-af31-14d510dec5ab", "comment": "Malware payload", "value": "f93f4c3671425c543b98e8a94abf252c96c4470725debc61f67842d41b5da163f59ddbb7726ce69606653d6e572f884f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171336, "uuid": "6246569c-7aed-4df8-90a6-1917a47e0690", "value": "T19F3633FCC8319590D814E67548F94DD427F82048E1A71AC2AF457BEECBC3F8A0B69799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171336, "uuid": "8bd28d6f-d477-4354-8ada-3a8ca7fbc7d8", "value": "98304:jV4oyAgZvd4DsMtu/oYUT5FWSQERe4QBUfX9I5CvKc4lROdy60zQ:RPiKDu/7QZQ2HQUfX6gN4lROdZ0zQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703171336, "uuid": "850f4b33-77a9-4488-82b8-46991f1d4747", "value": 5309767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703171336, "uuid": "f5125c2c-1274-4c50-beb1-0e7a025bd4fa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171336, "uuid": "bed66671-2cc2-4d30-8e2e-8ceabf001b27", "value": "netflix_christmas_offer_for_old_users.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0db1229-a020-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703177383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177383, "uuid": "f5dec3a0-8ccb-4542-b9d5-f394b4d9518f", "comment": "Malware payload (AgentTesla)", "value": "2b8d52006fc4f5c0dd8dac75f2d315ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177383, "uuid": "dba23c4e-7974-4f53-857e-a326c5b668bb", "comment": "Malware payload (AgentTesla)", "value": "2c112aa6303f06bac17ef65b8e3aa5cfd582e2aaf04e0036c39216d8965ad804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177383, "uuid": "b416ca07-eb93-4f9d-aca2-2a65a90a14e5", "comment": "Malware payload (AgentTesla)", "value": "2068d5fc7c011f5356c0e419a8d4e1836ac635d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177383, "uuid": "3faae2cc-9cdc-44e4-a4a1-0c8bd659ec3a", "comment": "Malware payload (AgentTesla)", "value": "fd645d063fe1f647ac786784375978c809fef5f2e1f2ca9cf8ba3a4a9ec6539fc413e86f2f100168e8a5219a0f2690c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177383, "uuid": "ef72c510-c3af-4164-95f1-68c481437de7", "value": "T1B735E056F58092B5CC29A3702471CA7407267D6BEB79648F6BCC3E6B3FB21E20176487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177383, "uuid": "bfe6e746-4984-49bb-a677-9acb4795133a", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177383, "uuid": "bcb3e1bc-93c5-48d0-81fa-f188d7b553e5", "value": "24576:ek70TrcN/imA7oFkT2F5RvrFyBWTipXFT:ekQTANahcG23RjUBRpXFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177383, "uuid": "164eebaa-1e12-4816-beea-5c549c3ac1f1", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177383, "uuid": "bf04d463-cf15-40ac-9fde-522181c4a15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177383, "uuid": "1702a566-9820-4244-8dab-309f286cfc83", "value": "rDocumentosdeembarqueCI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3e386a-9ff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703159981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159981, "uuid": "87a27870-597e-47b3-b111-d1221b1746e7", "comment": "Malware payload", "value": "1091c4bb74d997b4cf4f363aa79d3bea", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159981, "uuid": "ccdc8d3f-8e42-4d38-a331-3aa436956c9c", "comment": "Malware payload", "value": "30aba35de407ddf0a26015484c3772774e9b4202dc3a885e7bc1257602aaa2ae", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159981, "uuid": "484d75b3-93d5-423f-afdd-0e4a1ac82ab3", "comment": "Malware payload", "value": "ff4f02ee7fb7248957f49f48f2ce6f32bb1e91b5", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159981, "uuid": "7bef8d36-e9b9-4c56-8b1b-36ddeb3fa7c8", "comment": "Malware payload", "value": "66ef1e64b904cbd699bdc94d5ec9fd9040cfe5522fd56fde2962a9198f9f205b88974cbe172ce86330b086faefc7d7e9", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703159981, "uuid": "8caf77c0-2ec4-41cf-941a-4a653d9a971a", "value": "T13CB3E098588B8074998B302611DDF899EBC7979B97CB29EBCD3873D343AE49433025DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703159981, "uuid": "56b03834-22d5-436b-9161-eec0aa097771", "value": "1536:SYDphgEq74NnEtvQCAhR1z7pHLBgJbZb1nViC2+pQQ7kuUv/ivsBwDOMclmMFLRK:h6cNnYvVc1zx90JVV17HvsmnC9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703159981, "uuid": "61400955-56a9-4f73-b277-6354ce57ea86", "value": 114529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703159981, "uuid": "a7068d8a-4a81-4ef2-9358-c8772c460967", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703159981, "uuid": "530fc41a-f9da-43e4-b9f0-a1e0a757e9f7", "value": "Document.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2c9fbf-9fd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703144658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144658, "uuid": "5b5413cf-b9bc-4efa-93f2-bc36fa8ae202", "comment": "Malware payload", "value": "bed40381239eed4f246a50bd37f15082", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144658, "uuid": "284a3610-65fd-4fae-936d-f1060a0e93b2", "comment": "Malware payload", "value": "30bd571f2ed88dc3116526b8293b63f1a23c1b1ddf3cef1ca07d3ebc8677c418", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144658, "uuid": "a2ac2523-409d-4610-b8b9-f3fb0281f961", "comment": "Malware payload", "value": "e0e5ea6f0c23c98490ad9945859812a3f696c3e3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144658, "uuid": "9fc98bc2-455e-4153-892c-0635122ee4e1", "comment": "Malware payload", "value": "2a5bcdeed00566f73d42e38c8df9f4726bb1fc3d366e20e0ecc97df0425438785dd0d0083637a24654cda338f1eaaff1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144658, "uuid": "2bf305a2-82e9-49a3-a415-e2ed30be921c", "value": "T16214566DC34B0269CF620376AB671E5142BDBA6EF34452B1306C533533EAC3DA1266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144658, "uuid": "9b86eeb8-d678-4ab3-8c68-20560caa1074", "value": "768:BwAbZSibMX9gRWjtwAbZSibMX9gRWjgE1W2GpYZnFFs+NSsTz8xY8:BwAlRkwAlRY0MnFFs+NSsTz4Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144658, "uuid": "5b2ac831-8bb3-4245-ba21-9dccfdd60a02", "value": 209148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144658, "uuid": "3b97a158-e57f-4420-8b11-203a088a1ffe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144658, "uuid": "1839ee57-1cc7-41d9-a6ea-b897924aab00", "value": "Scanned-page.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19cfcf7-a03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703190618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190618, "uuid": "339173a0-3f9f-4668-9b6c-25741aae6a9a", "comment": "Malware payload (QuasarRAT)", "value": "6ddda01b781e92010749cae1248b6d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190618, "uuid": "27c7f4e6-75a2-4cd2-b9dc-af05228ed7b6", "comment": "Malware payload (QuasarRAT)", "value": "30eafdb7c2c580890c4fb2a7101db1d22c88bd723603ff37ac4f13928dd84b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190618, "uuid": "a2b9de9b-ebcf-4d19-8289-9624aa88b154", "comment": "Malware payload (QuasarRAT)", "value": "f33280d5dee0bcd5b5f07c8d38e50b3833288192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190618, "uuid": "9d9d5250-2249-4a61-b3a6-303ac2ce3442", "comment": "Malware payload (QuasarRAT)", "value": "537ef4a074e65c2ebeeddf433f01519adaab4f7ab07278e065c4bf65a54a8edf67a7190c698065d8f28e03f94883509a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190618, "uuid": "e5d406b2-008c-49cf-ba7a-b2f365cf5225", "value": "T178448D6667DC871BE3AE07BEF06041015BB9DD27F50AE7874D8885B82C533A1CE426E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190618, "uuid": "36fc64f4-b6f9-4aee-8ea7-bd4cab0ff905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190618, "uuid": "dc6908f2-8a41-4610-985c-f165d5d024d5", "value": "6144:RaaXMzUmOZoqSYjO8KHGwgImxbEWMgdD:4achqSYFKHGw1m3Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703190618, "uuid": "cb4e36ca-787f-47f9-9bb8-da390900035e", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703190618, "uuid": "093e84b3-7bcc-425a-91f0-6fa64be7bacc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190618, "uuid": "68676729-deec-477f-a395-3b0732587652", "value": "30EAFDB7C2C580890C4FB2A7101DB1D22C88BD723603F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6543ce4d-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1703177578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177578, "uuid": "b80b0815-af76-42a2-afb4-0e07d6b137cc", "comment": "Malware payload (Amadey)", "value": "40bbbb9bbddbf864e506c87fa8919480", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177578, "uuid": "0ec3a9c8-d59e-4beb-8dfa-d2b79ec9d281", "comment": "Malware payload (Amadey)", "value": "3686bcf5d1faa1034cc59cee288c1641034d7cfb6c227d00ee1e8837e1733832", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177578, "uuid": "29ecd353-c75e-4f43-947a-f103b0210d2f", "comment": "Malware payload (Amadey)", "value": "73854b97e459b4528176fc3b7e3fcac7209eddc1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177578, "uuid": "b5a45714-2df0-4d01-91a3-f7dc56a3d93a", "comment": "Malware payload (Amadey)", "value": "ec3b3b3e7997353228b71ad49db300d0a26a83e5854122f40dc4f70e0b3e18241563c1522cdcf79a5c8b04ca9c617174", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177578, "uuid": "78174f80-5c90-4484-bfae-a0f735db87a1", "value": "T180849E4352A1BC50EA664B739F2EC6E8B61EF1909F0977A712189E9F0CB11F2C173752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177578, "uuid": "ffbcf2cd-27a9-46a5-9196-bccef7dbf011", "value": "21a899cb2bf7f1bc566f7c47e1443114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177578, "uuid": "686e7bc5-e64a-43d1-ba2a-b56f9029d6a3", "value": "6144:SX8YLNmNngmM0g80fNV1P5hm8wB+0GfcObCckd+A2Ns:U5mNo80fN/RhmjXMA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177578, "uuid": "e83f604a-bb4b-451e-a8fe-402d192f2f94", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177578, "uuid": "8dc448fb-ecac-411c-8ad5-0e1d4d853fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177578, "uuid": "b8dca4e7-265a-459b-8c6c-2151f47aec25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deda7e5-a015-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703172278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172278, "uuid": "7194017e-f773-45aa-b109-66483f218de5", "comment": "Malware payload", "value": "5410b588ee9d2b7d4781f1cd55943e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172278, "uuid": "fabd1190-9f93-41b9-8abe-23d0f9521194", "comment": "Malware payload", "value": "36d0b2a47bff64b298cfdbc4d3150c3c93f23879fd52562c96a93f38cdc1e5bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172278, "uuid": "e139a3be-6287-4344-947a-391392b33aa3", "comment": "Malware payload", "value": "1a9b68046d0f68076d542d388099b089284c6fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172278, "uuid": "086d1b45-4ddb-48e3-8145-f0c1c860c9a6", "comment": "Malware payload", "value": "34b4d454ab9eed5cbca675869cd08359a9233bd1a774d799826d224124b06613030b76f834ee2a2f3debb41654ca7f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172278, "uuid": "cf726cbd-4fbb-4eaf-a303-4f8b665900d2", "value": "T1ECB533213DDB997BD982133290057AFA90F6D36C471163EB0351C604EF6D5BAEE2B90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172278, "uuid": "c9e0c838-4186-44cb-b37e-74531a79d8c1", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172278, "uuid": "c41762be-bd6e-4f33-ae87-408763bcaf83", "value": "49152:ufFV/RDkH1SzZxGA+G6ZvU9J6jK5V9WYxBefChynGWaxXSo:w/HVxUGDUj6VsZ0yGio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703172278, "uuid": "e2584e51-a66f-4b1f-9d6b-938f2b7c7a72", "value": 2284413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703172278, "uuid": "65aac8ad-150c-4523-84a4-523e2fb25790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172278, "uuid": "f37300de-8471-45c0-8cd5-742281bf67c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75a7e67-a010-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703170522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170522, "uuid": "27da59df-7e99-46f7-a729-03c7f4bb8a21", "comment": "Malware payload (RedLineStealer)", "value": "793b5b8ff80f4f2a8cdfe64981aff13f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170522, "uuid": "f37376cf-69c5-4688-ae25-e0e63c22466e", "comment": "Malware payload (RedLineStealer)", "value": "386ee2e2d6aa0eb23c4a9dd293c367145c2386b80c62b2fb8b9a9653e69f1ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170522, "uuid": "38ec762b-02cc-439a-a3fd-4f65097b57ef", "comment": "Malware payload (RedLineStealer)", "value": "6b2b045cfc59438004acbd6221d5e73ac2b25db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170522, "uuid": "bcc1073f-1ee8-433c-b670-e903292fc618", "comment": "Malware payload (RedLineStealer)", "value": "0b1dcdebdd854e2b6c7629eb450fc3b60cb5d03f07923af9a9eeb234509e2c73b37f62b36045994df2608c4d034d76e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170522, "uuid": "d0252a44-89ca-4a3b-a910-e1f75df7abc1", "value": "T1C6563341EBE45D27CCAD13740CF612270D5A3DE50A74A2AF94CC83562D32FE4AA563FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170522, "uuid": "501cd457-1b0d-4911-9b5c-088e6344278e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170522, "uuid": "9b13d41a-510c-4110-aba0-9df1c1a64bff", "value": "98304:tztzI/0924LjyLO4OTmbLpvaTIdT+HEqvBS3FV7O99ZsVp+N6D8zWpIuSWo3NNQ:7rrLjbTkBvh+Hn99Zs3SY8zWhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703170522, "uuid": "1fee9b85-eae2-4725-9fbc-771b69a8b5b9", "value": 6430720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703170522, "uuid": "34b24eea-a27d-43bc-b0be-2e559725bcbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170522, "uuid": "b5d5ccbf-be98-485e-a773-f5ef66d32982", "value": "793b5b8ff80f4f2a8cdfe64981aff13f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12683e96-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186888, "uuid": "110880b6-6050-4bde-968c-899f8ce8d6c8", "comment": "Malware payload (Gafgyt)", "value": "a6fd0f1bd68746a26efff326f6ca32c5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186888, "uuid": "bdfe36d0-e944-4921-befa-b4a6dec3d61a", "comment": "Malware payload (Gafgyt)", "value": "3b019e6997709d72cb7544e4d2a95d3b5b8d7d84f1827043b747beddaffe3685", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186888, "uuid": "d0264510-f7ac-458c-b5f5-6c1488441445", "comment": "Malware payload (Gafgyt)", "value": "fa754df11e8cc1ceec99195b67925c4d3e4184a3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186888, "uuid": "0024697f-689f-44e1-a478-0f2763d98737", "comment": "Malware payload (Gafgyt)", "value": "e02b6ea8d00657d062871fd4e9fb26cac44b9d303293b425081e1e28572c406cf21f4df3d9cdc0292311665d98dfd2b1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186888, "uuid": "3695ed3c-c0ec-4c5f-8546-d5c6ea03862d", "value": "T14DB33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186888, "uuid": "c5e2232b-5aae-4f68-8a5a-c51813ace5cd", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAL+TRCm7FnVqfJXFWbNb:T9a2aLqkrMasm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186888, "uuid": "90b7abff-bf89-43f7-b6c6-de9f42b7f510", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186888, "uuid": "9c73b50f-1626-48f6-85d9-90b5df96dfa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186888, "uuid": "84821bd4-a1a6-4922-9a4a-32a5e21b18d7", "value": "a6fd0f1bd68746a26efff326f6ca32c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28253fd6-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186925, "uuid": "b465cd05-27e9-45a9-b5ad-4a6e088fa496", "comment": "Malware payload (Gafgyt)", "value": "a240db2b7082f06cd04ecb42dd8c77d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186925, "uuid": "5c7e5952-589b-4296-a9e0-5c8751f94c8e", "comment": "Malware payload (Gafgyt)", "value": "3cde35a5a04a9e7e5ff02384afde62567aa8db6e105ca7be1cf82dc8dd099a73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186925, "uuid": "fb18be2a-54ad-49da-98fd-19b69d251b46", "comment": "Malware payload (Gafgyt)", "value": "7eb37027cf0a443b06757a7e112579b564dfbf4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186925, "uuid": "fa89638c-85ae-4774-961d-536d790d9ce0", "comment": "Malware payload (Gafgyt)", "value": "eb589b9a61441cc4e95a698ee872429657e3897f54333344b4b179f7f30367160855229c9a255645b19b1279eaa9e695", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186925, "uuid": "4c2d97b4-7fb5-4c93-8d1b-0d1a5cfadf9e", "value": "T1DEC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186925, "uuid": "26f9b525-52e3-40ff-ad6f-29d4e69e5118", "value": "3072:6jVlyaL5JCrIpv04sjbttiEiTmP46aQyfPlfKsNb:yoCJCN4sjbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186925, "uuid": "a9476ebe-0bff-4336-ac5c-3a05d7b4b3e3", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186925, "uuid": "7558e504-ec8e-41d8-906b-7bb621291f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186925, "uuid": "7671df30-baa4-4150-acb2-a3343a0a1533", "value": "a240db2b7082f06cd04ecb42dd8c77d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc0b5c1-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703128875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128875, "uuid": "dd5056a3-1240-45d7-994f-969afa1e5395", "comment": "Malware payload (RedLineStealer)", "value": "19c47b81c5a0b6c2791c0ff91e21e87a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128875, "uuid": "4e57ddc1-72a1-42de-b5d7-1b6e695f0ee9", "comment": "Malware payload (RedLineStealer)", "value": "3d55dc0c91391237f1616f37a2cc2924e5d4180be0213134a57d46a7e49e30e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128875, "uuid": "aa73584d-e3ae-4168-bd9a-009e8d091970", "comment": "Malware payload (RedLineStealer)", "value": "da11a842e1a43b82205a183481940560d11cd71d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128875, "uuid": "55e819b6-1f08-403f-a1fd-5ef30589cb42", "comment": "Malware payload (RedLineStealer)", "value": "e9af7361e6e7e988a80a882dfc1d79d4b62c03881a347b3038db1acb9f9950834f49a64fe425f7eae6f342cc4a7ab8ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128875, "uuid": "5d3ca78e-0992-4c8c-bbc2-68af03cf608b", "value": "T184A4D02262E0E871D15347324D29CBED2A3EB8F14F557A9F2798593F1E751E2C27230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128875, "uuid": "e5f1ec4f-954e-4399-a167-e4b2f398ce66", "value": "2f42c7240ce091676db27467fe8eb2d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128875, "uuid": "c7195d80-7df6-4895-af8d-262ca2d980d8", "value": "6144:tzAKtjTtmbwJd1GNLie4NTmtekcKeVGXN78+BVPQ7I7ga+X:lp9RmUJd1GB4JmtteVGVPd7sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128875, "uuid": "ae82e7a7-a961-4baf-b195-97026115ca93", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128875, "uuid": "cfc81043-c6db-47d5-950a-6029c8034b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128875, "uuid": "59e2c7c4-7129-4099-aad6-fe09650c9388", "value": "19c47b81c5a0b6c2791c0ff91e21e87a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a74b9e0-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703187922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187922, "uuid": "8139e51e-54a9-49a0-b9f4-9bd0d796d450", "comment": "Malware payload", "value": "ff42a13f896b426ebe48dfbb08a063dc", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187922, "uuid": "b0d47283-aef0-48e3-a06a-ef9da53e438e", "comment": "Malware payload", "value": "3db5c8ee159a2fc2700dd3c760c39f8dcf93c03cc2ae8601fe56028d0bcf3cbe", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187922, "uuid": "3c163e6c-f930-4af0-913d-20837dbc8ce3", "comment": "Malware payload", "value": "f7e89cf2d9560507452710ade4d0316eb0ab261c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187922, "uuid": "9f5af7b4-a621-4494-9f66-3e10b06a7ce5", "comment": "Malware payload", "value": "6774ea00a30192138e3c8c4e646f59af13c89be76bff5a9592f306ed9485a09b4143192b9136cba548923b4cf01a2298", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187922, "uuid": "6a2ecd1a-2b56-4d3f-a430-06de09adbce0", "value": "T1CBF4234C238DE513C948A5391DF6B71083F5D3F73A42D98A1B82F85F1DA03E98D39696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187922, "uuid": "f5c0d584-f02f-4e3b-8d11-cfe2c4153f6d", "value": "12288:0Q0J+q585uKq+VKIHKmgpjs4S99eyIyDnpeT+PUSLB8xtinA7EGSH:eJ+qBK/V9zASDeyRDpe6DB8xtinA74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187922, "uuid": "8e2e8e73-11c4-46d8-836c-513b4c301ab8", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187922, "uuid": "15a0a82a-9e5e-4107-a300-12d2a15748ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187922, "uuid": "fd4f4794-c3bf-472c-a42a-49ca1017d25c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30802e3a-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186939, "uuid": "d0c90bd9-c787-4499-8001-c112cd1a70a6", "comment": "Malware payload", "value": "68232b8d979d4dcd85d9e1b4507c2e18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186939, "uuid": "e19e9e5d-cb3d-44b7-847b-fbfe0d882380", "comment": "Malware payload", "value": "3dfd415aa1e7ebf949182efb19e2df7371184130a4a3ec23bbef08a0b62f7e27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186939, "uuid": "032ed936-9163-4255-bc4c-356a618d350e", "comment": "Malware payload", "value": "dc6301b2948139e29832a47da1e81eac08b1c593", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186939, "uuid": "13490db4-91ad-402c-8256-6754221b721c", "comment": "Malware payload", "value": "0219612c495bc536f46efa496b0c2b11183cb8470529b790144af258e7f02515bb2163029c8811e618528cdd3b413138", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186939, "uuid": "5e586214-44ff-447f-bf1e-336de9556bb5", "value": "T17AA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186939, "uuid": "e5a926ea-4654-4b53-82f3-f214e92ba58f", "value": "3072:VK1z13U6HzHoXRtmTUhQogREmmFVcqq0GnDZT:VK7DDeKlogREmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186939, "uuid": "0405ae5f-93f2-4c2e-a36c-d50da5ba464b", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186939, "uuid": "2f67fa7a-6195-4fb3-bd80-101abe196cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186939, "uuid": "c34c039f-6052-49d8-b6ce-0aad37013a52", "value": "68232b8d979d4dcd85d9e1b4507c2e18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b593f283-a00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703167835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167835, "uuid": "85ab58c5-1545-4f9f-b3fc-f24e2f7fa8d3", "comment": "Malware payload", "value": "e098f33f224214bea3ace102c290a686", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167835, "uuid": "1ff955b1-567b-4384-baf5-d5e94ac6acfd", "comment": "Malware payload", "value": "407abddf78d0b802dd0b8e733aee3eb2a51f7ae116ae9428d554313f12108a4c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167835, "uuid": "eecb2913-c82c-402b-a871-6a477b2bc87f", "comment": "Malware payload", "value": "35a5b342eb398d5fcb29349d96f9b35bc7af44db", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167835, "uuid": "168c6b30-4229-43dc-9383-6d596bbbd38c", "comment": "Malware payload", "value": "550a3ecfb3ebb2df1630f363b8f5def77f7eebe9f89b05ad9cbabdeecf7c2ed90f21a7e4aa8b9801147bc4eb886a1496", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167835, "uuid": "97d82126-e550-4330-b64b-a40815a35ae4", "value": "T19082E096FDC10064CC95CCB3606992EE251CED1C629122B133F9A546E1DD1F5750CFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167835, "uuid": "cb5f136c-97b6-4b59-aedb-e17fcd23fbcb", "value": "384:X2o2SzQ0rP4YHateMM/B+CH35blBn3yrHT2oMyvXKVRCeA9/Tn:XPTP4YHadpCXFH3yrz2o82b97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703167835, "uuid": "d6355d82-9e6e-4a29-a1fd-eceaf83366ba", "value": 18347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703167835, "uuid": "2d4aef79-36cb-463d-a7c6-ad692faa5662", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167835, "uuid": "a8dd6ff5-65ec-4fe2-8f8a-f72641278d2d", "value": "smalmload.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b232083-9fba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703133189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133189, "uuid": "f6c98e5b-ce97-4d71-8371-c5a813414b8d", "comment": "Malware payload (LummaStealer)", "value": "056c1811f6cff26fec0b032d61b4fe3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133189, "uuid": "2952c76b-6ce6-4dba-b327-1a440736520f", "comment": "Malware payload (LummaStealer)", "value": "412ce7b1609feec3be2cf9cde0687a3ad6af525390275189c2256eb42755fc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133189, "uuid": "333f3714-07f3-4bbb-bd83-410c49b72bfc", "comment": "Malware payload (LummaStealer)", "value": "b308ca41060160313a36fde1eb48bd0fb0034f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133189, "uuid": "75ff0330-9c75-4e0e-860a-951b43e4939f", "comment": "Malware payload (LummaStealer)", "value": "abf6d34c3476ba4b385f63dd3f57b8a38c57ac76e1f9b64414326bdc8fbe9bcd2f1a9b5d7f1be853f456ebbacd7b0793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133189, "uuid": "dd3f4603-eba5-4682-a415-1baa138b80ec", "value": "T139049E5A63E420A6E4BA53B498F203835A317CB25B7482FF12D4D57E5E336D0A532F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133189, "uuid": "be5f5f04-9703-4f92-9f55-47e8316c1d32", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133189, "uuid": "42f6cfa1-989c-46af-a045-4b135c22905d", "value": "3072:pahKyd2n31F5GWp1icKAArDZz4N9GhbkrNEk17oQU+ugT:pahOxp0yN90QEjnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703133189, "uuid": "ab2ab714-a39f-4dc7-b70e-8a94696205ff", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703133189, "uuid": "516a4a4c-68a9-4afd-a517-aaa65c2b9de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133189, "uuid": "19e09690-794e-441e-8c13-8938a4b06cbd", "value": "maybelanguagepro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017962c0-9fea-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703153789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153789, "uuid": "1ab505eb-2545-4ffb-94d3-00316a0df2c9", "comment": "Malware payload (AgentTesla)", "value": "975270990913a3442c5e70d02306f73c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153789, "uuid": "e87430ad-5e29-458c-960f-c4c2b31ed376", "comment": "Malware payload (AgentTesla)", "value": "41efd948f8f40776d8c3b28f6b0848a8c05710b2b0e60fc0824c10834391cd3e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153789, "uuid": "9215bab2-275d-41b1-9aef-f294a6432576", "comment": "Malware payload (AgentTesla)", "value": "3cb49da45d1c11bbf518c6fe6e67fc7677455f62", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153789, "uuid": "ebdac3b0-f116-4320-8529-f43827ed503f", "comment": "Malware payload (AgentTesla)", "value": "b4f10b283bd966f7bcbee98b8efcdc276d87e5076b6708243803c251f23e692a76c110ed2e62d4dc0e658f36e3b63880", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153789, "uuid": "c41219eb-afd6-4e9a-aa29-8900b8e38706", "value": "T19CA2D1841B4EA0BDDE57AA36D8CC851C1B783067A704106B2A498DB56CCDF4ED9BD8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153789, "uuid": "45ea9b24-337e-4763-bd6c-9cd90ee2815f", "value": "384:VZ8F8Ndx3+sy/ah5KtIwIfZWZdbxu8CystJsl6jEI1takA05aMh8wH7WIi/DlXt4:LE8Nd0shaIwFkTyMsWVbQUlWwH7N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703153789, "uuid": "690cb841-9f6a-4df4-ac0b-f4481a941141", "value": 22316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703153789, "uuid": "7947ddd9-582e-4c5e-9327-0ccc8af3c208", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153789, "uuid": "7891fe25-bf34-4efb-9e82-b411dcee1786", "value": "TUC.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83adf1d-a02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703183408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183408, "uuid": "56b8ef1a-14f4-4140-960a-b05912d0e024", "comment": "Malware payload (RedLineStealer)", "value": "e6e4ac4c56a7ff5f2c61a11ff95b5bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183408, "uuid": "a9647cfd-764e-4bb1-9ea1-b629855ba5bb", "comment": "Malware payload (RedLineStealer)", "value": "42d5c8af3500e1d4979045b84efe4fe7f901e8b5bcdb46a0a8ef9e2fcb7320ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183408, "uuid": "62b406d7-5e34-4ec9-a1d8-d49c97f1996d", "comment": "Malware payload (RedLineStealer)", "value": "08dd9aefbdb00c2186189c3ceb4356ce9cdd3684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183408, "uuid": "e229eed5-0e6b-40d6-ab64-207da7d277a7", "comment": "Malware payload (RedLineStealer)", "value": "c229b76109498ff752e09ca13e9e5a517a39a4c75fb8b81ee6a21dd6bf6a3151645417d1a37f33702d9094dd83258d8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183408, "uuid": "1960aec7-4f12-4e7e-84a5-dac435801f12", "value": "T14856330ADBA81873CDBE27B918F722432F24BC7605F181F519C8655F2971EA1B4643EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183408, "uuid": "4ccf2ee3-0cd1-4bf8-9558-cff68c45ee96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183408, "uuid": "4b4c32f6-da97-4a1b-bf2f-cacf409cc74a", "value": "98304:pMR9DpFqTyOPnBBPr2WI1LS6kB5oecIz9sfOBt32fPwZVQVzw7AZyjmp6fXuoeE:OrrqTymBly5taCgtGfPwXQtCuyjmth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703183408, "uuid": "93aa8779-cbba-41cc-b0ea-560fd4436666", "value": 6424064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703183408, "uuid": "9c7ab16f-1c2c-4ea8-b5bd-8834777483b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183408, "uuid": "d7928fe5-4f8b-418c-bd39-95098b8cb3d3", "value": "e6e4ac4c56a7ff5f2c61a11ff95b5bc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708e2163-a01b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703175020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175020, "uuid": "164116f0-13af-4cbc-b1b6-00f26e26190c", "comment": "Malware payload (LummaStealer)", "value": "39df45406b960f58c999ee316263b5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175020, "uuid": "9b4cb1b1-657c-463b-ae9c-294d2e5053b5", "comment": "Malware payload (LummaStealer)", "value": "4593936c60786fe21955a4eeab723f809c14fdc7b040e90240c49d1e7f977a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175020, "uuid": "381d635b-c62d-499a-9709-c0340e99cb92", "comment": "Malware payload (LummaStealer)", "value": "fb5ec8d1e1fac95195c46eefcf35ff1b2697dde5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175020, "uuid": "471d2fd7-6206-4be5-a5a7-d3ab1775833a", "comment": "Malware payload (LummaStealer)", "value": "d4d8bfde9209d06cece693cfbe29724ffe88a4e39f2cff761c3fec88d7a93dc0a76d506ce6e3635924fff8262b5b61d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175020, "uuid": "797dae37-0736-40d6-be72-18a1d6afd5b1", "value": "T1E3563347EBD88A97CE7E0B3D1CF215A10A21792126B0C23E7A49C54D5973FE0B8553EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175020, "uuid": "96fbc431-8126-473f-b430-f6c3a7b2fc3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175020, "uuid": "373c29dc-b7d0-429d-acdc-6707441caf02", "value": "196608:nAKEnQ8TlJFB6GyjYvoQ8bQ6xYYtHrqB1z:AzLb6gQQcYCHU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703175020, "uuid": "24cf5ce3-ebb9-4a9c-b513-3d45248cea7f", "value": 6425600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703175020, "uuid": "e02303d7-f08f-4e46-914e-260b164cab92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175020, "uuid": "0aa6208e-369a-48df-8d1a-687c1355ad8b", "value": "39df45406b960f58c999ee316263b5e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25828df1-9fe9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703153420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153420, "uuid": "fa90a5cf-7c27-4179-9aaa-c4f47d892b4d", "comment": "Malware payload (RedLineStealer)", "value": "c0593e1d3d6857ddcef0580428b254bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153420, "uuid": "10543449-0cfc-45ad-a079-181344bc4c5a", "comment": "Malware payload (RedLineStealer)", "value": "475450625080720ae71ba7a672f6ae2e9e7bee9b38184d8e47ab32a5d60124d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153420, "uuid": "411609e7-f47d-441f-bcf4-ec97e0f35197", "comment": "Malware payload (RedLineStealer)", "value": "141681da98d831a4125c44ce5dd759a5099da407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153420, "uuid": "8a5372d2-790d-458c-8d08-f06a4dc8620c", "comment": "Malware payload (RedLineStealer)", "value": "80aafbba33cf38af7edd118962c7d94100821f578e268729065c931dc46a38f308c5077b5fa232eac97f0da4a03ddb11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153420, "uuid": "a35d0cd1-2821-4b1c-a44b-bc95734e90b6", "value": "T13D03D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153420, "uuid": "e5172baa-9363-4a5d-8df7-34a1987b20a8", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703153420, "uuid": "14a84122-3e10-450a-bbf6-119bcc29208f", "value": 37927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703153420, "uuid": "56d120ce-daea-4c6e-aeff-0924140e67be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153420, "uuid": "3843f61e-6b24-4d69-b23d-f45480c62e3b", "value": "c0593e1d3d6857ddcef0580428b254bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39620fe-a01f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1703176958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176958, "uuid": "ce7c6598-a25c-4d1b-b880-75c613d54c49", "comment": "Malware payload (Rhadamanthys)", "value": "f7891882225dc9d0e22b07deabf36f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176958, "uuid": "737cf4f2-7b28-4098-a060-96964e3219a1", "comment": "Malware payload (Rhadamanthys)", "value": "479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176958, "uuid": "88e4b2cc-0df2-4374-9443-8efbc12ac7ae", "comment": "Malware payload (Rhadamanthys)", "value": "74bf78b98f3637236b43f16e09b3449fbba1caec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176958, "uuid": "dbab2895-221e-4223-b89b-1b8e90985572", "comment": "Malware payload (Rhadamanthys)", "value": "8325ca2706fff44e9f6aee07f8a1de42ad824f17106573620b6106b8c35131b9ac4becb40364f21570c5ad4d5645387d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176958, "uuid": "4841f388-d6ca-4f2c-9d39-d726a20a9a3d", "value": "T119A4BF5342F1BC54EA664B738E2EC6E8B61EB580DF4977A71218AA9F1C750F2C173312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176958, "uuid": "a184a836-d5fb-4e66-acae-7d610f917ab4", "value": "21a899cb2bf7f1bc566f7c47e1443114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176958, "uuid": "f14e8a4c-4c06-431a-a6a5-770d4001f86a", "value": "6144:TYlaLw74mUyID3anV6eybwxWKbbYm0bCh92h1nEGhlCWGjgEWJasFO+lrwcvNs:T9k74mJV6eykxfbbVECr2SjYZlDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703176958, "uuid": "54599bf7-9864-4e54-a37d-af5230550b8f", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703176958, "uuid": "cbdd103e-12c1-4fa7-9626-33275e3fb3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176958, "uuid": "c79cfe2b-b04e-479a-8a94-71fc34a212ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ab15ca-9ff2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703157418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157418, "uuid": "670498b8-4c57-487b-ae88-acfbe0c755b9", "comment": "Malware payload", "value": "fe4c6e8ab9bb5a9006b52c4c82141c12", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157418, "uuid": "63883bb1-bade-4482-af84-b14c6fe3064f", "comment": "Malware payload", "value": "49d4706d7004198da4cfa1f69c8db943ee40fb489553a17f80d92a9449621eca", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157418, "uuid": "e59f0cf6-d2f9-470b-80a2-666a29538e04", "comment": "Malware payload", "value": "95135065e3ffe3c71899c02fb3f7a760779859d5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157418, "uuid": "df6ea0c1-2ca8-4261-b4ff-497f0e84818f", "comment": "Malware payload", "value": "b04560182bf58ac7773966c141402b16e34ab944b35c53996a20ad656e7f02c99c217012ddc79489f7938b94ef00d9b7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157418, "uuid": "f3b00a33-4c71-4dc0-a63d-3be5b39e1831", "value": "T1A8B512117AC39632D0B60230A5BF67A55A7EBC205EB1894FA344729D3C711D0B3B9FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157418, "uuid": "2795ad84-b764-40c3-b954-fc46446a1140", "value": "49152:ARuEt/RHoSUM8/kwac5QINKnSLdSEL7XgfUWDrr6/bHx:zWBLqkm5QIpkE7Xnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703157418, "uuid": "203e0328-4033-4715-adaf-c18ceca8c0a2", "value": 2428416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703157418, "uuid": "4c4d751c-3a06-45ba-91c5-df3a7d18aa82", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157418, "uuid": "6e6ad7ef-dcad-4e32-9f52-a4ffa3089045", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bbfccf-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703128564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128564, "uuid": "88191a06-22d1-4c80-9de4-9c3f7d44989d", "comment": "Malware payload", "value": "59e1852e8e8643b0433e3682dd254a66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128564, "uuid": "35678174-6b81-4737-a42b-376526958a66", "comment": "Malware payload", "value": "4a5d86a0ecb495bd2b21ca768d089b5e39f5595172172881326fd0119f0be6ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128564, "uuid": "f06a02f2-53aa-4e68-837e-5ceae167c33a", "comment": "Malware payload", "value": "aff4a28d9ff8fa5991eb930923e83b6b27662e24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128564, "uuid": "4cfeeffc-b84e-4cf1-8e31-1907bafbaa8f", "comment": "Malware payload", "value": "fcb8902856f7ac492ca7c0edc03961174659404bf27974c829644769bbb345f034cd2f996d248faa292cba8ac15749c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128564, "uuid": "050acd9c-03a9-41e4-9187-76a54b50c272", "value": "T1E46633417B842958C082983076D6FADD71F53FFA1A48CD1D91E9EAFB987236C9336342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128564, "uuid": "d78ff260-e2bf-421f-8a6a-707fe6ab9a38", "value": "7106f7f21b5a6e69fd7cbbc19f3ecd14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128564, "uuid": "fac1b1f1-6a92-4def-8aff-4f08de35ddaf", "value": "196608:VD4JIKyTpWO7JPEcw9BRPGSrOe3stZLRjQ01:VsJIKWpWO7lO9zPGne3wZVjQ01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128564, "uuid": "b3142c0a-7fb3-4be8-8c4c-26014ef31e1c", "value": 6692256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128564, "uuid": "9bdbc547-a3cd-4339-bdfd-639f6508f21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128564, "uuid": "4705ccf0-183d-4d72-96f5-ef7c21f89ee4", "value": "59e1852e8e8643b0433e3682dd254a66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0b0b1a-a01b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1703174910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174910, "uuid": "425ca263-0f58-4115-b9ca-8f9ee53855ef", "comment": "Malware payload (RisePro)", "value": "7e267bec235e3a97a82cbc14780e5af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174910, "uuid": "d6761fdc-467b-493f-b80f-1b8f39f06e1a", "comment": "Malware payload (RisePro)", "value": "4c944e0a51e946066b93b760fef883d0b6bd62c474e95df8a80e0d72265e4e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174910, "uuid": "919a4eb0-3145-4cfc-a00f-d73b5cbceebe", "comment": "Malware payload (RisePro)", "value": "6d5ca2130635f96da163bd1e89f6c19950f65dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174910, "uuid": "1fcea034-d707-4708-ba2a-6bea8645eae9", "comment": "Malware payload (RisePro)", "value": "e4a2573c60520522cbf7746c499686c2a7f64289a3b9c74ecf5dda47c4e25cbf6286f3eaf6d2f2c5035d10b492f2619d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174910, "uuid": "55921c69-fc19-4e57-8244-8455974786a8", "value": "T16226120233D18026FF97A2364A66F7125A7C7A270463A51F13981D7EBE305B2563F7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174910, "uuid": "6504701d-2336-4438-a90e-4f15c1a2c45e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174910, "uuid": "39afe842-d8fe-4bb5-be78-70a77f9c97ae", "value": "98304:/jTQYxsWRfJGfFgzsnLZJCEah+oJJPvsSf8hSx4++:/3dxf9MxnLX9UJXf2su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174910, "uuid": "e7ede495-fe57-43b4-900e-7c8ea594a9e4", "value": 4836864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174910, "uuid": "46e51063-dc53-4611-a8f0-dee08bd73602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174910, "uuid": "91dd28de-3a0f-4d45-b2fb-03a5973b3584", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667b6b3c-9ff2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703157394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157394, "uuid": "ce228025-d7d0-4c1e-a4ad-dc18a21ada83", "comment": "Malware payload", "value": "b76f58f7fbb2db5d2d09ebd9eb0fd54a", "object_relation": "md5", "Tag": [ { "name": "pw-8888", "colour": "#E88C38", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157394, "uuid": "2df21d68-1cc2-4119-b213-a1a49c79539c", "comment": "Malware payload", "value": "4ccfd859d9e7ec07caad239bc6321cf1bc6cad12c37876c9cbb9ab736b225ce8", "object_relation": "sha256", "Tag": [ { "name": "pw-8888", "colour": "#E88C38", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157394, "uuid": "1f5a2ce1-42d3-476c-8945-f383540cd4bb", "comment": "Malware payload", "value": "36bc26899458ad11d5a23f47d753147103449a78", "object_relation": "sha1", "Tag": [ { "name": "pw-8888", "colour": "#E88C38", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703157394, "uuid": "6ef20d35-c3ba-4e29-b715-8743159d8090", "comment": "Malware payload", "value": "a9598b84a79dad6e30551e5395aae1a8bbfec170f349fa95d0205ef87b6f2a6b22c9b3221afee509e48919fd71f75a78", "object_relation": "sha3-384", "Tag": [ { "name": "pw-8888", "colour": "#E88C38", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157394, "uuid": "fb0e2d79-fc32-4b6e-ab5b-90b16f17490e", "value": "T127A5335F2638D15B0E6734A6F5C9B7BA73F84E2027A09E1FE16132E31C13E9B345A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157394, "uuid": "6b6030b7-f25a-474e-838a-48f2cb0bfa79", "value": "49152:j/4Ql+STmAI9G4p6NZllqqipi4Q3Dq3OashVlIVQgqf9UkPFf3W8h6USL:74EAPLp6JYje233qVPFfGDUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703157394, "uuid": "52e08ea0-bada-464c-97fe-bb313a32760f", "value": 2076491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703157394, "uuid": "f435da6b-39a1-4078-aa8e-13bb3bd15d92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703157394, "uuid": "25e78697-44e0-4d14-9b7c-c4465c970382", "value": "GeminiPC Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd05075-9fd9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703146588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703146588, "uuid": "e47431de-9b16-4433-ab3e-984161e71e8a", "comment": "Malware payload (Formbook)", "value": "54ae3b52eff57a8fc75697d2c48f3279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703146588, "uuid": "a2cbeb72-e774-4ac5-a3ec-dea942b48e5c", "comment": "Malware payload (Formbook)", "value": "4db703871896f05e8638b725b1aad90e68a0a7f0e935dcfc2ea3e6de4ea78374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703146588, "uuid": "ac881378-b996-43cb-b1be-07a20c16410c", "comment": "Malware payload (Formbook)", "value": "c43b518816a76144b993149759d0806f6c7e1c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703146588, "uuid": "9bf5cd34-4dd4-4e1d-969a-e95ac14d001b", "comment": "Malware payload (Formbook)", "value": "85ea5ea6cc10eeb4d1235b8df08fcfdc42917e17b139958fb5d5304404963daa767d62623e3d5d95ebf4386d2376c10d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703146588, "uuid": "27e28180-5052-49ef-9dcd-6a35b3fabfc3", "value": "T1AAE3490039C19076E5B7423249FAAA24467DFD720F665ADBB7C80E0E4B745E0BB35B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703146588, "uuid": "f500c089-0edd-47f9-b5dc-75e2d23a6abc", "value": "6aad837909ed5ba39fbdce3fd0d557c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703146588, "uuid": "4b065a23-c8a0-4c4e-b2fc-09de97dba3e7", "value": "3072:KYiGLZNi15nGRAlNopv+SQSKABCJSrvu9:KYiKu1sRfpvRrHrvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703146588, "uuid": "018f715a-100f-44b6-a06a-fdd27e35fd71", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703146588, "uuid": "9c19b19a-63e5-45d2-8e5a-f83d2355d61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703146588, "uuid": "49d1a657-0134-4d80-a5bc-f6d821df82be", "value": "SecuriteInfo.com.Win32.MalwareX-gen.3012.20547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af88da8-a02b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703181883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181883, "uuid": "1d087dbe-b6a9-4fb5-a590-377a7bf742f4", "comment": "Malware payload (Stealc)", "value": "1a95ca652fe5fa1b442b8d48de5ac925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181883, "uuid": "d84a7901-7ca5-4146-8def-1648d99efdf9", "comment": "Malware payload (Stealc)", "value": "4dbb6545ef35284ab068616f7da78bc94e0baff5c9e9c297b448f569ce914625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181883, "uuid": "18bdcf78-884a-49eb-b590-efc08384734c", "comment": "Malware payload (Stealc)", "value": "645d6234a1ca04842a57ef4bbbb2ecb73659459d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181883, "uuid": "b592bfee-cee3-4dd5-a0b1-2cbdc3664b7b", "comment": "Malware payload (Stealc)", "value": "4420e3b813836ddf0ea051de18a69fe2a97f5f44597fe324bdb84df866979f33d4dc00996b8162dcf17a3471bb9ef7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181883, "uuid": "1bf4416c-79f1-4613-8d46-918735e6eb22", "value": "T1BB444B5352E0BC55D9264B738E6EC6E8B61EF690DF5937AB22185AAF0C701F2C173702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181883, "uuid": "ee002921-05c5-464a-8ead-433ec809beb7", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181883, "uuid": "c809980b-89d8-4574-a3a4-e938fb6880e1", "value": "3072:GWb4nLAtSaHC0KXFcuMGU7aCbgUKtaY2Tryw+RNs7dNYV2Bk:3bILAAaHC31JHUoaY2iJshNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703181883, "uuid": "a348d077-6590-4adc-8a78-8f2d7543ee00", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703181883, "uuid": "848a8959-2896-438b-a422-44693a3f3ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181883, "uuid": "352aed8e-cda9-4d7d-a770-5659975fbee8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a58c73-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186895, "uuid": "ab9ea70c-ecf4-4b3b-a8bc-51e6bab80e1f", "comment": "Malware payload (Gafgyt)", "value": "97e57a4ec5527a16cc0726e613dcca91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186895, "uuid": "98d54588-37f3-439b-8315-69d1f0bd1c1e", "comment": "Malware payload (Gafgyt)", "value": "4de0a0cb29e5e8eab9bf5b3f605e7e2c8c80ce33e28240feb067d183c62471e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186895, "uuid": "49b06d87-432a-434c-a44e-8fb713ad9c27", "comment": "Malware payload (Gafgyt)", "value": "bc7f5b4e2d279d4b7eada283e7213ff9324bd340", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186895, "uuid": "111ea811-d670-4a94-b122-a4601fb8fe92", "comment": "Malware payload (Gafgyt)", "value": "ba68a717e62f60fe86ca916050f150607af9e15ec33193d8cb7e6daaa1281a04c2ee5364b38b3606f534be2e37ab6030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186895, "uuid": "fec102b6-6eb4-4c8c-b5b6-aac4538b2d83", "value": "T124A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186895, "uuid": "b5e7b0a5-7715-4ac8-95a6-74cd5b276796", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fBHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fBHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186895, "uuid": "f8706fc5-4b8b-4cc4-b48a-c2d59e38346c", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186895, "uuid": "c84daf87-f5e8-446d-81d3-def6975b97a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186895, "uuid": "03d52199-4f9b-4dee-ae4b-38591bed0fe6", "value": "97e57a4ec5527a16cc0726e613dcca91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc270854-9fe9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703153780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153780, "uuid": "89d3a91d-59d4-4379-a974-534641321aa3", "comment": "Malware payload (AgentTesla)", "value": "961c3b501d35fa2a5afa8a810fc84ea0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153780, "uuid": "4ed69f59-2a72-4f13-ac86-4049edd54ea7", "comment": "Malware payload (AgentTesla)", "value": "4e3eda8f479c8c752067d22390e95e250912a5f8e7c9664f89731860a6ec874b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153780, "uuid": "affc7faa-cd68-4e2a-a766-dfcf097013f4", "comment": "Malware payload (AgentTesla)", "value": "37c537f2eea9ec255474b954d86963702d7baeda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703153780, "uuid": "92bfbf61-cb29-4ef5-a6e9-b3b398a3de25", "comment": "Malware payload (AgentTesla)", "value": "67e6e305f1a323807e6acf9ea76eec84a2b57b93bfd54e545efff5f6cf16636879d71997dd1a33c998e71ed296b772a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153780, "uuid": "4b6bef8a-11fa-4de5-a6f8-f6c54c4aaba5", "value": "T1B72327A1DA563A29484B374AFCC34844B1688416753633F9ADD9038E630679CD7BFBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153780, "uuid": "e7182a91-ea9d-4d6d-8690-7553bc5d11c5", "value": "768:FBh/QQ1Fi0N/SfuTCG5m9KgYhaqcf4+dFrw6VRXHhR1nmkeObnGe:FP/QQRSGeeVdW3dSql1nmub5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703153780, "uuid": "53b1e53a-e7ea-4c0f-b587-2c5208a68cc5", "value": 47611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703153780, "uuid": "c9fe78d3-bd05-4fc8-a575-670f9499ef21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703153780, "uuid": "8150dea4-17c9-46aa-85ce-7194beca1fac", "value": "TUC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caa3b80-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703187013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187013, "uuid": "b5cab1c9-747f-43af-a075-ffd4f2698e72", "comment": "Malware payload (RedLineStealer)", "value": "decb9079be59c91e1fdb083b8ddea789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187013, "uuid": "5e83c3e7-4168-4892-b5d6-6244dcebf889", "comment": "Malware payload (RedLineStealer)", "value": "50ca2730d4feb93b8d6cf986a86b34912d83c10dd7d7259d3538d415c904af73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187013, "uuid": "3166d1c3-11c4-4553-9d34-952c508b91df", "comment": "Malware payload (RedLineStealer)", "value": "c49fe68121c83cdff4c3fb8f479a6beb40ea026d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187013, "uuid": "06f416fd-4292-4e87-b697-25aa0781c19c", "comment": "Malware payload (RedLineStealer)", "value": "76bdac5b3eba5ce98e836c35574ec381dcd82518479306cd47d8fde3f6d39f628341e4be5e3a60bd28eba0884f6ff598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187013, "uuid": "e97372ed-751e-4234-a09e-7344864a9e1f", "value": "T1B9563356EF74156BCDBA337404FB31A31E513D3241FA91BAEE84F9490EA16E474303AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187013, "uuid": "8eafaa8a-3d15-4cab-b324-7e629b7ff65d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187013, "uuid": "4d0d19b2-2638-4b6a-9715-8a6b10b9644f", "value": "196608:MKLGHst81fO319A0qdHJCVK8QtzapwUdfvY5:p/oGsTdHJ/Yw2fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187013, "uuid": "aef0e4ae-08a0-4a1f-ac73-f524bcdec8b4", "value": 6427648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187013, "uuid": "05231e1f-bccb-4807-abed-99d7a2b56896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187013, "uuid": "a796d81e-74b2-4bb3-9796-cfb32baa3ae1", "value": "decb9079be59c91e1fdb083b8ddea789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d465cd-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169520, "uuid": "4e99f675-aacf-40b1-bbe7-e30dac69aa08", "comment": "Malware payload", "value": "30988d50493e9d7874e4e359972d0a92", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169520, "uuid": "a3cde5ca-a849-4633-a22e-078418a837f6", "comment": "Malware payload", "value": "517e715bd51a90bda0baecdec47326ea776940ecaeb4a19e077aa75e9d388132", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169520, "uuid": "34bfa261-9681-4527-b8d9-831a630dd0a4", "comment": "Malware payload", "value": "493d56ecb5d9ac19879ef6b301a01ddf91aa3edf", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169520, "uuid": "a77ef7be-5d26-4a7f-91e2-3f73159eeffe", "comment": "Malware payload", "value": "26325382f922f68868207272ae67d275f763b15d31f1e313caeaf3f92e75ffb680230a3b8ef753e3c3f82b980fd30e19", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169520, "uuid": "6147f2b1-a2f3-4134-80ba-c8c7e20acba5", "value": "T1539633EC0529963847B778FBFA1727CBA6580838293778392CDF5CD203147D65D8B9A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169520, "uuid": "64e00b6a-4c05-4348-9189-9d3a247ce9e9", "value": "196608:Sd7V8NQD+AhdlS9GoEb4ziOHZuCbz/3NPwbNfAbd1VJ5+14h0If5w0:SZOuqAhINEk+yRzVP9X9+14uIfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169520, "uuid": "ed41e033-41b8-41d0-83b1-f1f48199da7c", "value": 9389060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169520, "uuid": "6fba331c-d140-406b-be2a-af8040deb4c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169520, "uuid": "48e6d91b-1cbf-4b46-86df-2f000eb5785b", "value": "LG.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15f7977-a03c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703189410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703189410, "uuid": "6bbe5301-f212-4513-9610-e194c879128f", "comment": "Malware payload (RiseProStealer)", "value": "0a1566ab1fba4f2021680b2f7c2b16ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703189410, "uuid": "c1fbee29-cfaf-4698-a6d7-234debf3c7fa", "comment": "Malware payload (RiseProStealer)", "value": "550e893759da573a62c1c16144f5e8fa65e6df3eabd53c60648b9ac6748c1b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703189410, "uuid": "0e6b851b-7c0e-43f2-a7bc-0b9e0b6448ad", "comment": "Malware payload (RiseProStealer)", "value": "de04cf07fa0e4d8c0e4bcd0d3293c7d26dbd5767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703189410, "uuid": "d43a838a-f790-4542-94ba-2439cdbc32ee", "comment": "Malware payload (RiseProStealer)", "value": "075a42cd75b320a3a1d50d5ecc89978eb7e3058bae316429c6bdfa4dd2155a3f36f6180dc8427749e844b0758704cfe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703189410, "uuid": "3faff215-4020-446f-9c53-5c582142d3c6", "value": "T166752303EBD198B6ECE437B078F716871A783C674D60477A2782A5690C22AE561313BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703189410, "uuid": "0a4b9342-eafe-47e8-8805-c87e2d77709e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703189410, "uuid": "3a2e87c6-e47f-422f-ba3c-1bc3c590dcf7", "value": "24576:pytg/aZ1fPmDXK+PqApNk5VV2OEgluKfDpfojwEDKxaAxmkZQ51A/y+9sXSTQH16:ctPfPsaGqA8xfEg9iGxnmdbAqNST+6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703189410, "uuid": "06051e18-ffde-471b-b9fa-f0c6d3d00f08", "value": 1656832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703189410, "uuid": "d918577e-4c63-47b5-98fc-c4dc7111156b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703189410, "uuid": "87a23658-c1f5-4ada-b885-92afe9eba6e3", "value": "0A1566AB1FBA4F2021680B2F7C2B16EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b8ae3e-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703174271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174271, "uuid": "1c6151bf-caaf-4930-b678-45704ab0f46b", "comment": "Malware payload (RedLineStealer)", "value": "78b7008ed5a0282d7ab117589f193540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174271, "uuid": "dc3083f7-5c22-49f7-b172-20e50edb5ec7", "comment": "Malware payload (RedLineStealer)", "value": "573829010e86ad1c19fb478ccdb0a422759afe038664cc7de2e41ae6f5d4d196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174271, "uuid": "afa714ae-69bc-4379-903f-d766f0b225ad", "comment": "Malware payload (RedLineStealer)", "value": "655ff2288ef80567eace3cee137fd4f229a4750f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174271, "uuid": "fb71c1aa-6b70-4457-a492-8f454a53d0b2", "comment": "Malware payload (RedLineStealer)", "value": "2f6a2b3ad7a09da890ac26b790d1cbdd0fe023cb6b924176063b3e367f309f450e191c0a5a2d56c98359cc6ccb507dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174271, "uuid": "9cb08308-2725-4eb3-94dd-89fe84559019", "value": "T161B4BF697AA38836E7CD1736E2D11204ABFA9546F403EF6D308922D00D0B3DBD54B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174271, "uuid": "cc54e7e0-5fc9-4138-93bb-33b3296547b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174271, "uuid": "0413a922-ebbc-47c1-b584-08bc82fa8551", "value": "12288:f+/atRxD09ox/j7tlzZUDaa5d2QqEzz8hRgwr3g:3cE/jJxZUDdStEGJr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174271, "uuid": "90618347-ea27-41e7-864f-b392d788d2f0", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174271, "uuid": "0c27e7ed-65da-4956-94ab-1fe82012b5ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174271, "uuid": "cfdff686-5a02-413d-9b40-859dfe5f7ae4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a43aa5-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174364, "uuid": "3cd7879d-f8db-45f0-81b1-1410deff97a3", "comment": "Malware payload (Mirai)", "value": "77f6dbb4a1c2a1ca81d8f59fcc8f995d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174364, "uuid": "30c0fc51-08f3-408d-809c-9a03a2b2974b", "comment": "Malware payload (Mirai)", "value": "585014ced765a6632cd3ff845187e4c46d58955728e0ccd55952993500aa1642", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174364, "uuid": "fdbcad41-1eb7-4774-85be-9789bd135def", "comment": "Malware payload (Mirai)", "value": "4ab8d151665d721c48f94c6b870c31b999a94152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174364, "uuid": "28f030e0-751f-4a76-ba07-56b68e558380", "comment": "Malware payload (Mirai)", "value": "f2c6d42d8f88359f748d7fcc48b9b04e9965f3c61b6e428ca3779216c0413a4319b62a4650a4f98f0eb250bbcab81fa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174364, "uuid": "674a6baf-32d2-4229-af39-44ef947e6b49", "value": "T104235BC5AA93DDF9EC110AB520369F328AB7E53E60A4DAC3C3E59473D902603E11735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174364, "uuid": "a60dabb9-53e1-46d9-8be9-a26c48c70327", "value": "768:zo8Gll0RqYIijCGW8V5Y0rmppCyJwDs8F/F2z4gl8cqpN/:znRqYIi2L6OSlFsz4w8cqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174364, "uuid": "9514e2a1-57a5-40c5-88a3-3c7d35bcdfb6", "value": 47100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174364, "uuid": "9f9c4f54-550f-4c91-856e-34d13fc47a53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174364, "uuid": "323a9dbf-0b3c-4881-b227-577791a5f301", "value": "77f6dbb4a1c2a1ca81d8f59fcc8f995d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4d8eb3-9fe1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703150161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150161, "uuid": "92e996a9-69d4-4bc5-a65f-514609ccb467", "comment": "Malware payload (AgentTesla)", "value": "16daec16a0d03e1a61c9a5fb78c557e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150161, "uuid": "df266024-3907-46c9-95d4-d0babd601a48", "comment": "Malware payload (AgentTesla)", "value": "588b4100c87eab6cb8bb73ffdfb5a2644132961b353e0465190daf43a8e3766c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150161, "uuid": "983a7c1b-1909-4397-bc76-bca8b10f6e53", "comment": "Malware payload (AgentTesla)", "value": "9fcabf5de732d6fc7e1ab3f36f27fcf9f8ea4b70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150161, "uuid": "ec6417d3-55f3-40dd-a6e4-df5e00f84ab1", "comment": "Malware payload (AgentTesla)", "value": "f29afcce4e6736b9429ca281d7ef9584a7aadffd264b4c2fc512fc3aa746353c5e530eb87dd487da2ec960d734377173", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150161, "uuid": "d0fe7e0a-e3a8-47eb-a57a-9c2127c26dcf", "value": "T1A8E4239833A85153C8FE2BBB1D3272C847B2B52BAD22F54C9CC054FC25D7B45962266B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150161, "uuid": "f171d348-182a-47c8-b89b-5f336acbafa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150161, "uuid": "495b56f3-f030-4f8a-b6ae-ef3ff6ddf937", "value": "12288:Y2/wh8tvQ8FJexPkn3x7f/Bj+jNe1PzQtfcej7fR49UurO33XpySq:zDPaPKBj+RgbqEcDR49Uu0pyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703150161, "uuid": "dd4b1240-f616-49c7-8a87-f0f6840abfa8", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703150161, "uuid": "f622d13d-10d7-4427-bfb0-46b241783c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150161, "uuid": "919ba081-dee9-4dd1-b6f0-52d911d5ff8d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.17006.32651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96faa5b1-a03e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703190117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190117, "uuid": "1f16005e-5dda-4209-acc9-f463121cb633", "comment": "Malware payload", "value": "117fa397305f58f7ceb5f8f479cf75bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190117, "uuid": "6673693b-1e10-4752-9bc6-9d856a658543", "comment": "Malware payload", "value": "5931fe55bf54700241b18cd3556410a4061518bbecf141e8e8f51d3bbf63547f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190117, "uuid": "afc9d289-67da-4a04-83ed-74921be38622", "comment": "Malware payload", "value": "6dc4f6ebbcad2a483cf1f24157372f7fdc0a1d9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190117, "uuid": "5a501d38-cf24-4ff0-8240-15498fec5c56", "comment": "Malware payload", "value": "9ed2379ffaa3abba2d34161465f219a2ccf2bb8c212507e1b3cf1817a100ae76938f60936f0d723c3602b024aed25086", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190117, "uuid": "23b0160e-c2df-4161-b55a-19720376b2f9", "value": "T11EC4F25F2AD9FC45D80C35FDAFAF6DE472A68D8149B8A2C890147A2D473CE13D506B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190117, "uuid": "1d26776f-bccd-4826-92ef-40f9dbee994c", "value": "12288:6J34GT1IUl21txvPd10pbivSjLXqFci83W83WMR7fC3k:uZIaet/GpcXWiboWMNK3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703190117, "uuid": "b80840d3-4da7-4965-94f9-bdd15d8ff16a", "value": 556168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703190117, "uuid": "f5d94edf-bbd7-4173-afb4-46967ee2ca18", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190117, "uuid": "810f9c76-d905-4615-8451-745f81f7b750", "value": "SecuriteInfo.com.Exploit.Winword.11.3602.1628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9fe046-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186449, "uuid": "fd13958f-cb7f-4917-bb4d-008c611b39b2", "comment": "Malware payload", "value": "7ecf0503afc729700426a1922504d069", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186449, "uuid": "d2e54dfb-4ca2-4623-8791-c0c176989178", "comment": "Malware payload", "value": "595416d1e4a777bbd87807e1dd215202170c31e6aa3288aba7d5390b9171fb57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186449, "uuid": "448d3d78-74df-48e6-9e1f-4261ef7b3dd9", "comment": "Malware payload", "value": "ad8b6a4ac570b89ada04079d83c8fdcc0a465eee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186449, "uuid": "ceb95b16-4cfd-4297-b42d-deebe18c7cec", "comment": "Malware payload", "value": "9de1d7baad88477e1511d8125a270c309005494204db1b6329a0dc7c8258828fd15de7881ac5dbb8c2d357a8e8eb5fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186449, "uuid": "099d12d5-5de7-45b3-9c40-f9082edafc37", "value": "T1DE83198A99A5AFB7C046F0B064B95D340B25BD511F1F1A986439BBD4027F9C9B00FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186449, "uuid": "6442f9a9-0e3d-4c24-b096-18165b72e555", "value": "1536:49+qLsCLyIuZg7TAJyAJXgdKrhR5mFrtAVvU8C14:49HF2FZg7cJyGXgErMFr/8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186449, "uuid": "91c9c0d3-35ca-4082-9790-08c38080faee", "value": 82572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186449, "uuid": "01e9c475-d4df-41db-9355-64d3cb090d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186449, "uuid": "7ee31244-ce50-4e81-802b-4d1f1113e995", "value": "7ecf0503afc729700426a1922504d069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8873f4b4-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703135117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135117, "uuid": "7e108a4c-43cd-4500-af88-510ba6cd300a", "comment": "Malware payload (Socks5Systemz)", "value": "1c5469973b7408ebc5d8eb6539acfb5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135117, "uuid": "4f6f1438-fe40-4ebe-9141-192b57773437", "comment": "Malware payload (Socks5Systemz)", "value": "5b583b2635fddcaf996c29335efea4fe8ed5762b4cc11329069ea104aa74694b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135117, "uuid": "6a53f610-c181-4c7f-a78d-6fe8e7f78edd", "comment": "Malware payload (Socks5Systemz)", "value": "27e423d3a3cc8796f0a6dee2a6e510b53fe55ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135117, "uuid": "09afaaa8-12da-43c8-87f1-48c1e01eba5c", "comment": "Malware payload (Socks5Systemz)", "value": "402d3d4e4e762fe8280e4d03631ee8772ceca875466b4281b7565578436430a7472a461ef42c9e00fd0c2320f17f0a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135117, "uuid": "563703db-9973-4e1c-95ba-d2085fcd88fa", "value": "T1889633048A952C76EA0384F6159B731E872AFD0F70A0C6523A5C64CE6774EA1F346FF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135117, "uuid": "2930abe9-2dea-4e2a-a09f-cb7525bb089b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135117, "uuid": "072b213c-f631-483e-b19f-cde5fded2432", "value": "196608:ftb/VUWAhrS3GeZAvR/yeAUU2ZNcRKUS/iFEzJjXWwZ+F:f4WRav9yvUU4ORKUy4EzJbW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135117, "uuid": "d2d597c9-8172-4b40-878c-1a33b3df28e8", "value": 9027581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135117, "uuid": "e9435639-4cf3-4c82-92c8-f9653cf17e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135117, "uuid": "e2d9f856-0578-40a2-8ca4-8808f4520b82", "value": "tuc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36109848-a026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PySilon)", "timestamp": 1703179647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179647, "uuid": "9231c647-921a-48ca-b07a-74f9d0413b78", "comment": "Malware payload (PySilon)", "value": "4797f14ef4a490f96479d4ea720e5c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pysilon", "colour": "#DAD253", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179647, "uuid": "d09cfa37-58c9-4691-9ad4-6f1a53200730", "comment": "Malware payload (PySilon)", "value": "5b85773c3aaa690e09ea60b802b9c7a628f2e4823f6a945773938d196f601fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pysilon", "colour": "#DAD253", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179647, "uuid": "c2a52374-27ed-4aa3-820f-e67d0a6b0b04", "comment": "Malware payload (PySilon)", "value": "4f766fe3607ba2b8e5bed172510bb8cc7e7c4741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pysilon", "colour": "#DAD253", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179647, "uuid": "874d52c8-1286-4692-a0ec-0a2775c04e18", "comment": "Malware payload (PySilon)", "value": "dc081f1cc9b81a24e922fc44a576b8d324cdf72ce36206fcb9d5efa1373e9864ba3e587c35bf9aa326409caf9e16f041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "pysilon", "colour": "#DAD253", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179647, "uuid": "ca0089dd-676b-4737-83ad-89857cc5a573", "value": "T1F2C7331A7361149AE5993877F1C6E9740936A8914FA1CF0E87503FBC2D93A907E3BF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179647, "uuid": "53876d92-f471-4e42-ab2b-5b5343204e24", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179647, "uuid": "ab2ea7ac-3b73-4832-95f2-175d181a77dd", "value": "1572864:D2MbiJR5Q3jZ8JSk8IpG7V+VPhqF+E7bwjCSKWQScs:DZbC+MSkB05awFMuSK2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179647, "uuid": "bed58e82-2fbe-4509-b75f-a5187242dbad", "value": 57838754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179647, "uuid": "053d6ecc-c2ff-463d-82d8-ea239ef93d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179647, "uuid": "30065ae5-4398-40ac-87e6-be975776eb53", "value": "nudes.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e303b8d1-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174353, "uuid": "6f10d28f-69cd-432f-9468-848286aad4ec", "comment": "Malware payload (Mirai)", "value": "b191b78327f710aa012070a985f196c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174353, "uuid": "dd9f0036-6fba-4250-a42d-4d1650c6ba06", "comment": "Malware payload (Mirai)", "value": "5f43e45593c2c93f969580a6492d67bac6abb4edc7e139edb5f2e5b7e2aab9fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174353, "uuid": "d5ea5797-69cd-4d90-bba6-7c281f5af9d5", "comment": "Malware payload (Mirai)", "value": "4efad69b8c4c07ce8c036d45e46191dabd55cb6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174353, "uuid": "9cd9a6f4-518b-4ab3-83f0-747f25e98568", "comment": "Malware payload (Mirai)", "value": "bd40d9b19bbb475536ad502459e81cfb6281423abe0b65ab71041590e1e6d9f7859ffe41bb249a01f40b15b7e9ad95dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174353, "uuid": "aacfcb21-fe93-48e2-99cf-e77a468205f5", "value": "T1CBC31945FC415B23C6C612B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174353, "uuid": "d492fcb1-baef-48d1-a43f-18126ce1acf5", "value": "1536:JCDwI4fG50nVg/QDE89+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxGR:MDwLYhQDn019jc4r2/Ztt1qYbu7wSbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174353, "uuid": "0c7e6b72-826f-449b-a6b8-9c7b3143e1ef", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174353, "uuid": "ae0405d0-e814-473f-a01d-b2844d558cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174353, "uuid": "a3ac87be-57d0-4670-bfa6-5ba89fc76a30", "value": "b191b78327f710aa012070a985f196c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35acc762-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703177498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177498, "uuid": "bc3f8157-f115-450f-8cff-1f4b16019e13", "comment": "Malware payload (Mirai)", "value": "50578ff2e8ed25b9fb0a4b2ca0d30d7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177498, "uuid": "9f073443-fdd8-4958-94f5-dff80a5a354f", "comment": "Malware payload (Mirai)", "value": "6023d3a78873210abd5c7cb3c4cb08d0004d29339ea8e6e602724602ba402247", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177498, "uuid": "f76adc46-8dfd-4185-9d78-920299f239f8", "comment": "Malware payload (Mirai)", "value": "1496997051268e2f151816d46533a07150372372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177498, "uuid": "2d6d89f0-592d-4277-8caf-d9e968b2f3f7", "comment": "Malware payload (Mirai)", "value": "66d5c98caef9f6e827545d82ac17b7b631f078acfde43f0fa00388d5427cb0114eacc4eec40c6db6d3084107dd9b250d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177498, "uuid": "a3ff0aa9-8c7d-4765-a149-9e7ce877f8a4", "value": "T138C34B46EA408A13C4D52776BA9F42493323E755D3EB33068D18AFF43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177498, "uuid": "7eaf31ec-0c8d-4db3-b333-5acc6d880b44", "value": "3072:mQcjorKiz1twQ/N1lCJCNx0bjRi7xKPXxM/9jB:mQcjorKiZWONPCJCNx0XROKPBM/9jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177498, "uuid": "cd2dbea0-4302-4731-aecb-a0687d84aa09", "value": 126551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177498, "uuid": "efdd3714-2e84-4890-8eb7-f92b8659d873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177498, "uuid": "8cc9495b-575f-42c1-b8e1-fa5f5901a956", "value": "50578ff2e8ed25b9fb0a4b2ca0d30d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a534e8-9fa6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1703124930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124930, "uuid": "4e4dfbb7-aa89-46f9-bc17-3af5c63be1e4", "comment": "Malware payload (Rhadamanthys)", "value": "32b86751d376ef214a26e50eecc6e67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124930, "uuid": "e79702e5-be34-45bf-9b72-03e46b4c1623", "comment": "Malware payload (Rhadamanthys)", "value": "60710a8b3e9d7b6985e6a2eab5c7ed57e2ee776db285ba69cc5b53c36110770f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124930, "uuid": "7bd03124-b8fd-4b03-82cc-7d87f52b851d", "comment": "Malware payload (Rhadamanthys)", "value": "b6b7a830578cfe154b6c27d18ea7761630bb5363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124930, "uuid": "e8b66ce1-aa0c-4d43-8f62-eeb7b2e959a2", "comment": "Malware payload (Rhadamanthys)", "value": "fc626c0ef2d09681798946b705a4252bd8f4ffe3aac8d13c3606dda0d363e4280891273603088f1b2affbe575cba3812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124930, "uuid": "611b85b5-806c-4047-8382-4a0d77a25bbc", "value": "T1AFC4E4D156E2CDA5DA0DB67F39C3ED9A4F2E323D00C293945D27DEB90A32254B60BD24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124930, "uuid": "081ea84f-b6ff-47e6-b7f5-d7322131f2a4", "value": "46702e615a96538f4944f7d15b37d4d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124930, "uuid": "1a5f72dd-43eb-482f-bbe0-c72c30bbe090", "value": "12288:gE50GSHrG6W42JcycysY0V3D9wCV+QnXGwnUP345WRgG3OkGGs/Lwmm:h+GSHrG6W42JcychY0FD9wCVPHw3yeJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703124930, "uuid": "89b56aca-b730-4536-a9f5-b3355d150ac5", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703124930, "uuid": "9dc436c3-6ad0-4839-9ee3-a7a9f07b7d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124930, "uuid": "1c8deeae-c58a-4ba0-b3a0-b8b3fdaa698a", "value": "SecuriteInfo.com.Trojan.Inject5.153.2749.31023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad488520-9ffa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703160949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703160949, "uuid": "732f923a-b93a-493e-b129-4e5c02b214b0", "comment": "Malware payload (LummaStealer)", "value": "4a2bf6ded687551d7d2b7720180c2cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703160949, "uuid": "7b829b3d-1bcb-4868-9b9b-4ae1ac4a51ab", "comment": "Malware payload (LummaStealer)", "value": "61d8d265f47495f62beee9a94d93553e2487327c25e4838ec4b8cbe2e2243781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703160949, "uuid": "ed42667e-d638-4873-9de8-75ac12181840", "comment": "Malware payload (LummaStealer)", "value": "a3e092697ee73cd57e3fd83ff825c82219bb40c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703160949, "uuid": "99df0195-46ab-4042-9405-6fbc962e312a", "comment": "Malware payload (LummaStealer)", "value": "a0efc8ebbea457cae1b56fd3d1e392e8704e8272f8da6398c74a6c676e2ed3b957d7d57f3a4aa8f6e0dc247aaa73dbfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703160949, "uuid": "7fd5e4e4-00a8-4c4f-b1e7-249fae71319e", "value": "T122344C4343E1BD55EA668B738E2EC6E8B61EF290DF1977AB12185A9F4C701B2C173311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703160949, "uuid": "2789f32f-30fb-4d65-a52a-3204e9bced29", "value": "1426636332e9a7e1eb281ecdb464fbd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703160949, "uuid": "9dfc0091-990a-4b4f-984c-84010d649150", "value": "3072:t3BhLWpiLs/Pr/sTck4VinS3yxMk/7RJFJUuAlDS2FYFjp/WR9i6dNYVDBq:BBhipiLID64mBF/7pJZ2FydCiANs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703160949, "uuid": "d9d58311-c67b-4258-abb3-8a51b1bfd464", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703160949, "uuid": "46e14d74-3e23-444a-bb8c-1b6c27790769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703160949, "uuid": "710b3e01-b4ea-4457-bf78-b976ad3960d8", "value": "4a2bf6ded687551d7d2b7720180c2cd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1daf4893-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186478, "uuid": "555e833b-728a-4415-9a17-c210eb33a682", "comment": "Malware payload", "value": "4da49bbfadcb9c2de48c7c2235d7a5a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186478, "uuid": "57cdfa63-2bf4-47c1-be6f-d0dd55de244c", "comment": "Malware payload", "value": "63090f8a421300a1d5493a2878a16a048d52f57246864168b6289364f787c48d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186478, "uuid": "61a883c0-4fef-464f-a1e8-424e3a9ed7f9", "comment": "Malware payload", "value": "7b7460cac187a377f7c07c745e9bd8c7f9616537", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186478, "uuid": "2ae72754-e0c4-41cb-a741-d3a1ff9d2e83", "comment": "Malware payload", "value": "dbedd2ace04285f3caeea78d57a92ba93aa548d5be7929cad0158d60281b375ee81edade821f060149846b01dfd1c647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186478, "uuid": "6bc62c32-769f-4b4b-8af8-cd5d3e47ba22", "value": "T1F8E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186478, "uuid": "ac940d4e-3743-43ef-9437-ce158ccca5b6", "value": "3072:Cv/WwsLgaq353qHiCOvhOpPqkDQHbeskmhxQwoVSUNu:KPLaq351hOpPqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186478, "uuid": "dc0dd1e3-236f-4e3b-80f2-5c88ff8154f4", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186478, "uuid": "50c2b395-e0fe-4012-b3b1-3ad0956655d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186478, "uuid": "e46fb3d0-1ed7-4811-bf7f-c28a22708a3c", "value": "4da49bbfadcb9c2de48c7c2235d7a5a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4095ea0f-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703128554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128554, "uuid": "9f3dbc60-4f2a-432b-bc5c-30fcb507000f", "comment": "Malware payload (AgentTesla)", "value": "1950dac203a522e79d42bab022e338a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128554, "uuid": "705b4038-d66b-4f2d-b993-d5e3f8b6a977", "comment": "Malware payload (AgentTesla)", "value": "637cfd5ea9f4b73bd1a3aa3448469013892aefb5d66d28852f27bacdeffaa9b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128554, "uuid": "1f94f1ff-1482-4c92-972e-4529b3badfa9", "comment": "Malware payload (AgentTesla)", "value": "5981b4df288ffc533bad56129e0eca44069b3dc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128554, "uuid": "cafe7d64-b6d8-4395-98ef-36f8ae3fc5a3", "comment": "Malware payload (AgentTesla)", "value": "fa5f759897f4c64b3f39f2bfc9f35969d583e58ce37483173ce1193a4c4b6c38cbc109a8d841ea4167222b5867e6ecbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128554, "uuid": "b4b34545-35d6-4fd3-82f3-2e5bc2a85a3c", "value": "T1F9E41384B694E067D5EE7EBB2639614807B2760F6D21D38DDC8126AF17F73818B12393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128554, "uuid": "2b3f457f-ff4e-4bb5-81a9-923eb8f9a423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128554, "uuid": "99415ac6-64db-4ebf-9cf2-4d3a908bd4b4", "value": "12288:H21B8tvQ8F7QucmAVbzknu0LQTLtzBXgGyG7R5ecZgiB:rRsPrXN/7XecZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128554, "uuid": "5491d4e5-44b6-40b4-8b13-32f700344882", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128554, "uuid": "18b6127c-2a9e-4786-95f0-b36042ba81b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128554, "uuid": "b1dfca01-69e7-468d-a9fc-c536b1159b87", "value": "SecuriteInfo.com.Win32.MalwareX-gen.7467.17078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4f4909-9fcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703142616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703142616, "uuid": "b449afd7-0d7e-4585-abea-31139b78e60a", "comment": "Malware payload (RedLineStealer)", "value": "c7ee41d9d24aec8333ea56f2d7a7b368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703142616, "uuid": "7a970ce4-c886-4900-b940-577a277ddcb1", "comment": "Malware payload (RedLineStealer)", "value": "6739b519f402f11573adaafa9d86bd7cf08d880f00a2601e122bb872534dbaf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703142616, "uuid": "8a19ca65-7cdb-4b35-b9e6-5a20c4bd8aa7", "comment": "Malware payload (RedLineStealer)", "value": "4d44372b5f93192d9c8527e301b68a48dffeed40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703142616, "uuid": "f86cb0c9-13a0-4f3d-9a22-0a6353a53a49", "comment": "Malware payload (RedLineStealer)", "value": "868740f670422fd30878fec24c2c3c7179c9cbaba90e2d71abacb714c8fbfe80e3ebef8967483f00bf6a49e43374852a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703142616, "uuid": "2e3f834d-230f-4df3-8992-de1e4b2bc457", "value": "T1B364E803D2E13C55E7259B768F9EC2EC768EF5608E497BBB12189A2F04B11B3C163719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703142616, "uuid": "2051f92f-4cf2-4896-a7fb-24573360b1c4", "value": "20d9789eab84c00389f370a41b11aca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703142616, "uuid": "98bfaa7e-8dfb-4749-8e72-0d34dc30f986", "value": "6144:M9r8eFDJSkvkVQxicea3+WwYKtOvreRNr:M9BGukVvrtOviR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703142616, "uuid": "4fddfa7b-64b3-4c7d-b5c3-8e31e7a1b988", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703142616, "uuid": "a68f9ec5-cce7-42f7-a513-0b924c3a9990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703142616, "uuid": "a7b4525a-dc6d-4047-a03b-2f56953857db", "value": "c7ee41d9d24aec8333ea56f2d7a7b368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866b908e-a003-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703164749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164749, "uuid": "02ec9c88-b939-4043-a928-7fa8d5b6a4f3", "comment": "Malware payload (RemcosRAT)", "value": "3cb09d651b69cca0805c11154f590dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164749, "uuid": "6ad759ab-e9e6-4225-8dbb-3482c628b51a", "comment": "Malware payload (RemcosRAT)", "value": "676541d2dde33127bc679ee895fb5743c8d43f407b279f0fde2d6990583b8eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164749, "uuid": "f40ae1b5-31c8-49e5-b7b9-8d104967fff7", "comment": "Malware payload (RemcosRAT)", "value": "539d787f85eea6bdefad0e8ff97aac4f52ed822e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164749, "uuid": "41e97761-ea6b-434e-84f3-fd9b9eedcbc6", "comment": "Malware payload (RemcosRAT)", "value": "c830251d55ba1df2112a190c9b3520f3b76b0060ac342596c20664590b8577da606585098d9876d0419928271b65e47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164749, "uuid": "302c2855-fe90-423a-940c-caf3b3fc6835", "value": "T14675F063E169043FE22A1536CC1F8099582E7F206C1CE886E6F53E485FF47B3857A976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164749, "uuid": "7c4233f4-2f88-4d7e-bd9f-ec4d998be013", "value": "1f1558dc318775658cce6932cf4c21fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164749, "uuid": "a75f9b8a-d91d-4da5-a994-be1d78bf002e", "value": "49152:Kf1bPEuYM3MOsXOarzpO2UCF9qVr9YWpEK:Kdbcux3LsJrzpO2UCF9qVrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703164749, "uuid": "0b1c60ca-a44a-4427-a25b-f63e0613a61e", "value": 1688064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703164749, "uuid": "9f2b9055-30a1-4776-b056-deb7607eb5b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164749, "uuid": "d36f4e70-e615-4494-9475-a73ac769c1bd", "value": "SecuriteInfo.com.Win32.SpywareX-gen.21740.30024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c726fbff-9fa6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703124914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124914, "uuid": "7fcd0177-6b59-4f4b-a9c7-984b63e037dd", "comment": "Malware payload (LummaStealer)", "value": "7847d509a02440c8fc998b7e6eda93bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124914, "uuid": "f637720b-a728-4c3a-9f18-1925de0b9bb2", "comment": "Malware payload (LummaStealer)", "value": "699f6fd3dbb66eb98762e3eda5fc9b5f0e11051f9690354bb05432fbb87d0ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124914, "uuid": "e6a005c3-c89c-4b79-95c2-06026120d88d", "comment": "Malware payload (LummaStealer)", "value": "d2acd41079c0e790117747adee70ad38c39abcf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124914, "uuid": "b2591552-9db4-4159-8454-93396fe9b72b", "comment": "Malware payload (LummaStealer)", "value": "b75ec1c4a54b1ffc447148b5a6f75afc0d761c995980f484ed0cc87d9b601e40d52f121dfab412b6d8acd7f8c009df4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124914, "uuid": "dc0a45ab-000b-426b-91c7-a42ca1cf5a93", "value": "T122563307FAD46C63C9A627B030FA26931E663C685DB59276A74CE20D1D71B90BC7039F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124914, "uuid": "393158a6-4031-4d4f-92f7-7e5c911fec39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124914, "uuid": "431731fb-0072-49e4-b513-7874ca796740", "value": "196608:FTzbr+NmCzt7r0a86Mvwnt9EOd8idjfYrO:9WR86MInV8sjoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703124914, "uuid": "41dd9f12-2c51-4fdc-9a8b-1c71f35ef2e5", "value": 6431232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703124914, "uuid": "9f416b1d-fe5b-4cc6-964e-9a6368b1298d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124914, "uuid": "e1100421-2494-4ca7-8a74-db4086f01c3d", "value": "7847d509a02440c8fc998b7e6eda93bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d618de85-9fa9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703126228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126228, "uuid": "56792484-4179-4b90-b411-91810461f4eb", "comment": "Malware payload (RedLineStealer)", "value": "24d81523b3033dddc3bf6526d86f819d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126228, "uuid": "39e939dd-6f8e-48c6-bfdd-366eea8bbe33", "comment": "Malware payload (RedLineStealer)", "value": "69d2b581f741bd5b54f9854172b78b93c7a661d89888adf463c83e6ebe216c7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126228, "uuid": "e570c56a-5abd-4873-8f6e-80436b1a54d0", "comment": "Malware payload (RedLineStealer)", "value": "4bce8ad92f3160155bdee17e04068bdea0594705", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126228, "uuid": "13e97cf4-9d63-4544-ba4d-cd134eeccf0c", "comment": "Malware payload (RedLineStealer)", "value": "2b09093323f4889ce3460396563bf9cfcd1737fe0818b965c89cc349913da6db40471587433da93436e796e849b9a257", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126228, "uuid": "f00a3a63-8840-4a48-a62b-3102856edf1c", "value": "T1BA849E362D634872CC6FB0B2F8ABC50E7B5FBA43465653F3150923219793A980DA794F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126228, "uuid": "183cfb93-4baf-4fda-861e-95e227af0202", "value": "ec29083df1aec6a6221dd2d98de08acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126228, "uuid": "d5303c5c-2b6e-4efa-975a-a10322c4e68e", "value": "12288:5JMbnn6WTGU49SM66cS4jI5ZU6L322rZRU/EB1X7I:nMuWr49SM66cS4jIbU6nxPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703126228, "uuid": "2c15c7fe-54b9-4b0d-9ca6-e3d1ed91e034", "value": 394574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703126228, "uuid": "a0b1b05b-a27e-4cff-b2da-31de622133ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126228, "uuid": "d36cee19-940e-4411-ba97-6d7703600eed", "value": "24d81523b3033dddc3bf6526d86f819d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732addab-9fb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703131216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131216, "uuid": "f6f25c4d-db03-475f-a210-b70fa62915fa", "comment": "Malware payload (RedLineStealer)", "value": "21b39fce29e844fe09d20f233d73c0f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131216, "uuid": "6b231bf1-b558-4d4d-be5a-de2559800d4f", "comment": "Malware payload (RedLineStealer)", "value": "6b534fe9e8749a7937f1902441b8c703b25fdd95cb76651ff02ae8d6b16682f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131216, "uuid": "69b330ff-7baa-403e-b0fc-fb5e57eeb95d", "comment": "Malware payload (RedLineStealer)", "value": "4811003288d170a6bf8819c1248486516bf84315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131216, "uuid": "37b2bd3e-60b6-4265-b71c-2e97fd579f21", "comment": "Malware payload (RedLineStealer)", "value": "19d014c8d40d162361d3742f9706b0dd7490c191c90d00db70090d9ee37d4886d9dbf3fb40ef5804fcfae791b99e51ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131216, "uuid": "48d74e2b-8397-4a51-a384-87cb6d820915", "value": "T15A56334BFBA90951DEBC27B4457613B2193378A325A6D179D60CA80C6D33BC4A670B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131216, "uuid": "abe35dc4-2c44-4dad-89b4-d1d5d2919444", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131216, "uuid": "67506a86-0187-4997-ad0d-4a52b04d4ee0", "value": "196608:ZUsAu5gwLR3+CgQWLcVvUVXzEZZhuLGrl:ONbAxXWLqUZgZsLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703131216, "uuid": "a7301f32-d412-47a7-9dd9-120ea7efbf6b", "value": 6422528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703131216, "uuid": "5743a3bc-e2ac-49de-bce8-0cdb2c9f089c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131216, "uuid": "f87545a5-7f8d-45c9-90aa-d4806f29c793", "value": "21b39fce29e844fe09d20f233d73c0f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2263a928-9fa8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MarsStealer)", "timestamp": 1703125497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125497, "uuid": "92b9ccff-96fe-45df-8a70-b8039c7bbf01", "comment": "Malware payload (MarsStealer)", "value": "7c3cdfd4ec2ef7074aa6cba65aedec95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125497, "uuid": "2dfe06a2-41b2-46fa-b5dd-ac4852c2e55a", "comment": "Malware payload (MarsStealer)", "value": "6dea57ecfe1a092b1c434f571276426140f18b514b79128f8daee7d61cd85c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125497, "uuid": "c9207b5c-e130-4186-8cc4-82e5bcde80c4", "comment": "Malware payload (MarsStealer)", "value": "b248fdaf6f4bdcb0c470059065069c931c9b6362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703125497, "uuid": "cc51e8ad-c4f0-494d-ac82-3e3983a08494", "comment": "Malware payload (MarsStealer)", "value": "eeb221ec628801e808417e6fbc32a30102ea079d82ae57144ac6310f7203b1b69803b86a18920bc9d539a1dcd0f25202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125497, "uuid": "f718c0e4-6fcb-4b0a-a97a-0163f76b3cf1", "value": "T1E6B6382439FA5019F173EFBA8BE4B9AADA6FB7733B03645D105103864713A81DEC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125497, "uuid": "be525477-6381-40a2-a25a-69bf17a04867", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125497, "uuid": "5c0ba6ad-895e-4c58-8f2f-b0a187fa88b1", "value": "12288:fuI/t26BoC4OIrOdSj5KFbkj2jUUDJLLUp+ezD3iH:TuOdSf2IKRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703125497, "uuid": "064dce05-44d5-471b-a4a9-ff520752efcd", "value": 11000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703125497, "uuid": "7c9ca398-b5a7-4e92-819d-3558dc935b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703125497, "uuid": "a8465bda-14f6-4872-b775-5be522a56bf6", "value": "Ghost Hunter Vena_d-34UG1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3a9d77-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703187921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187921, "uuid": "2fd94efe-43bd-444e-bf5f-f06be7d3f528", "comment": "Malware payload (Socks5Systemz)", "value": "b44504848be909607e24f2d2913c14f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187921, "uuid": "b4799268-29db-4f39-bb31-43ea4feaef59", "comment": "Malware payload (Socks5Systemz)", "value": "6fce23009b75e85d41a51fcf214c8d7ad98adc0c4026bee05291e8fc2dcb72a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187921, "uuid": "129705d1-cb0b-40c6-877d-f80689147dcc", "comment": "Malware payload (Socks5Systemz)", "value": "56d41b4967c5e7a6bf5e716de58faff518ed204b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187921, "uuid": "12c0b39f-a6c5-49de-97a2-06684e17070d", "comment": "Malware payload (Socks5Systemz)", "value": "c2f893e416f4f985efdd76adcfeaed98de60a3b90441007cd0854cd1e5abc2f1a61944af82240623cc90b139575cbf97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187921, "uuid": "a1e2f24d-379d-4e4a-a4ff-ee08023915c1", "value": "T19E66331713D9E023FC4026B15C7B9A55EAFB6F08856D7D1040999FDFE726ECA830AB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187921, "uuid": "94c641a6-e1e9-411b-a63b-ab326c3da152", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187921, "uuid": "c0ca2e7c-d102-4094-8ace-f17197117c15", "value": "196608:MMcSu/IH1Dnim8eRHueGaZEwZGJLNw5oi8GI2UNF:4Ri1DeehDIwZ0Li8GFUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187921, "uuid": "79fdb308-f16c-4aa4-af83-d7b86c2966a4", "value": 6884983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187921, "uuid": "7c9f73ce-71d4-4996-a7bd-adf44886eaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187921, "uuid": "8caed39b-57fe-4e03-81bb-da788e8f2f29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52ac187-a04e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703197093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197093, "uuid": "96f54d54-a36e-464b-beda-833dc1a8a4e6", "comment": "Malware payload", "value": "efb22bb779ea2cfcc3fec031aaa89d89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197093, "uuid": "40c8a0b1-2a38-490b-9306-e3f218827864", "comment": "Malware payload", "value": "71506bbd4f497fd25187151211f8b0beefe48e4bb4fe84081de9c0d2bfd61472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197093, "uuid": "31ae5a93-41f0-4653-98d8-c8b2b63a1815", "comment": "Malware payload", "value": "fd87411b2b36061e6ae6d935069ea15cd9b8ba00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197093, "uuid": "cc761ed0-3318-4f56-9fa8-309a7040c640", "comment": "Malware payload", "value": "1375932eedea7391751b772bbf81b5dcc041c8a1f5f1e96c93658e13c1745e0f98d2c1b38ed30dba6f0bded25634ee70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197093, "uuid": "c4a08118-8d67-4322-b65d-dbc6f1c03db4", "value": "T11A66336596A0C277F8068279CC72A789CA35FAA12B59D7E2309C3FD24F7F472A453350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197093, "uuid": "4d476986-c051-46f4-a254-c65a3c2036b9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197093, "uuid": "7ffceab5-2214-4e57-96e9-80a69203733d", "value": "196608:EwDjImo2P0187y9klWkG5b1IUZIsySlp6UnHPF:ZjIUP01LcWkG5b1IUIklpTHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703197093, "uuid": "b130cdbb-dca2-47f2-a231-a4b4b460f092", "value": 7099555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703197093, "uuid": "d5f96606-5db3-4c56-9154-59f0b9e250ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197093, "uuid": "7d923bec-720c-41bb-9bbb-81ae6ce0bd07", "value": "SecuriteInfo.com.W32.Agent.GCOX-9154.14498.28414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b573347e-a00c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703168693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168693, "uuid": "4092df14-c04d-45ad-b70e-50af3d41e1ce", "comment": "Malware payload (AgentTesla)", "value": "badb259a950a1825787d7fe7479d9787", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168693, "uuid": "56646a01-aa7d-4abd-bf75-7766eb648f4b", "comment": "Malware payload (AgentTesla)", "value": "715c5a3ad22226549fbcb358acac3117f11e4f7acf4f5bce0eff2117130eb1f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168693, "uuid": "7c69e527-dfc9-4342-96ef-d6e7522c6475", "comment": "Malware payload (AgentTesla)", "value": "d5809962238f3daf34b36188219f235d10be8f96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168693, "uuid": "adae83c8-10d2-4a73-82b2-c082c78be371", "comment": "Malware payload (AgentTesla)", "value": "e2a1f9c36caabbb02f3002dc2ce3f7588aaa957d9b7eca2a59778775412cfb84c5d1c361fac0fc8a95e9026cace55080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168693, "uuid": "55f7b450-6038-4783-b669-438b43a74789", "value": "T1CBE4120932689132C9BE6BFA2D32315447B5765FAE35F38DCCC424AE1AF7B40892175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168693, "uuid": "124c9fde-cce6-4551-b83c-e061d1ea2db8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168693, "uuid": "d7d42434-9726-4382-9232-bb7630e85c04", "value": "12288:f2Rz8tvQ8Fri8oCd1hO0rvlKTAfUaMhJwLF+nkZhtKWJfSz:Jtno2DkuVMh+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703168693, "uuid": "2dce2e01-9e80-4c73-932d-1951b38d6c20", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703168693, "uuid": "4307b856-c52e-4281-94d0-81b3ec2685e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168693, "uuid": "e93986c4-8b4a-4aec-9117-60f77ae27cce", "value": "Invoices No. 112 and 113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc6e76c-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703169431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169431, "uuid": "6923fbda-7bb8-4217-9ad8-a61ae932c578", "comment": "Malware payload (SnakeKeylogger)", "value": "e4e808a72f8178a789c4f5cd3b2592b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169431, "uuid": "677edb17-2094-4465-bde4-d495e1b79d30", "comment": "Malware payload (SnakeKeylogger)", "value": "71aaa5510b2558e77807ee92dae0b7eef3c3f473be2078860769b58641b1c118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169431, "uuid": "8bdb8dd8-5930-42aa-bcab-66b423fbb6a9", "comment": "Malware payload (SnakeKeylogger)", "value": "c5424faeeb22e4d6a8ce4fa86958444f51c46230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169431, "uuid": "4598f700-a56f-452a-beb9-98a130424e37", "comment": "Malware payload (SnakeKeylogger)", "value": "4a62b55b3b491b32931ee94354b597ce0555355d0d8dd426c35b87f5002b1dfecbb5e87ecae08e076e7739798eee503f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169431, "uuid": "840d2176-4811-497c-be52-9b2aed64e9ae", "value": "T11EF4BF0673D6C77BE6E6077CB8B61A249F36EE476512CB0B1228782C1E333548D66793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169431, "uuid": "b89cf15a-c818-4491-b57b-e50494a9c0ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169431, "uuid": "53179ece-7170-44aa-bab9-000c35956df7", "value": "12288:68pYTbiR6P4mpQO9gDPLg8EJk0xcNuoOO+1o1u4Aaf0+06JyQW:xpY06P4qgUzku5af0l6JV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169431, "uuid": "c05c8383-98b6-4ffc-aff3-1bcc37eded04", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169431, "uuid": "66b1f2af-7130-4350-bc66-7ac1dd74e459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169431, "uuid": "85ad28c5-4363-4956-93dc-201644602454", "value": "New shipment detail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4d8081-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703135021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135021, "uuid": "bdf0f847-37e4-498b-814b-94fddc045dc9", "comment": "Malware payload (RiseProStealer)", "value": "0ca674838272bfab18bdc4a11e8bf40d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135021, "uuid": "43ec8ffe-d92d-4497-8573-16689fa95fbf", "comment": "Malware payload (RiseProStealer)", "value": "744ab2a17f6e344cdc68857fefd34a260190232f2ccf6abc0cfff384ddfdbbf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135021, "uuid": "02e09023-f102-4347-b5d7-2d8123c82673", "comment": "Malware payload (RiseProStealer)", "value": "04e2371f0aa3ee0153077729f1017ffbcd1e6b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135021, "uuid": "0dd41b08-40d9-4a09-996e-e91eeaadacbf", "comment": "Malware payload (RiseProStealer)", "value": "818ff5c04ca726d58e83d583b798d85dddaf2b74fe573f23234b61ec19c607a4a59b800bcc665a0b9bc7ad7e42d2b7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135021, "uuid": "9db2e25f-a2e5-4911-a0c5-b84fbe2224e8", "value": "T11E756C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135021, "uuid": "eaef6428-e826-49ff-9321-a0fe838dd1d3", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135021, "uuid": "838ef238-480a-497c-90b7-f7cd47fa6505", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135021, "uuid": "78063a6d-c0b3-4c83-b0c6-ca08dc3623ec", "value": 1690767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135021, "uuid": "011834b0-45d0-489e-a84c-6277fffc198b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135021, "uuid": "a70ad629-1061-4cfe-8992-17e447aaddc4", "value": "rise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762af507-9fae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703128215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128215, "uuid": "09ec3105-0df8-40c4-809b-7c793bb700ca", "comment": "Malware payload (LummaStealer)", "value": "f890aa33adf1107cb4c8f4e5e36a4357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128215, "uuid": "1ebb7a70-5866-46a8-b323-0468c51b5b8a", "comment": "Malware payload (LummaStealer)", "value": "7487e2180a7d1ff612b8ca71e6cc0aa7fe61911e9c2080da64579285e4e2721c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128215, "uuid": "96949eae-4688-45c3-8d97-c41adce8683f", "comment": "Malware payload (LummaStealer)", "value": "eb228bed1a30477c97397d6cd00b45104a3a578f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128215, "uuid": "08096a97-9042-45e0-886b-4cceeeea77b2", "comment": "Malware payload (LummaStealer)", "value": "765ee669489edb4bd6bc4e111aa4df51af3bb0f35f525e0b30abae3486075c6c08e74214b62ffce10dcb561b0a7773a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128215, "uuid": "81e05f29-a0e9-475c-83ac-d77b13b6e70a", "value": "T1A65633149BE414C2CEED2BB058F553232A363C9157A5C3FEF1C8258E2A36BD66D4439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128215, "uuid": "e28e832d-a74e-432d-8834-d13bc6e129a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128215, "uuid": "ac53e345-a96b-4ddf-83bf-8c29c830027e", "value": "98304:3b2YxHM+MY/aaM9Z39McaclgCQlfup6xek59bQ2uIUdoAoV7IvwhUjmpgeS5ooz:3bFM+M+n0ZVOCCxz5O12Ao1euUjmSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128215, "uuid": "281e0b47-f44e-4e83-a4dc-85d0608eee52", "value": 6430720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128215, "uuid": "159be147-c8f7-4859-a014-260c25388b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128215, "uuid": "18bb263f-8b2d-4d78-ac71-b4428ccab1ba", "value": "f890aa33adf1107cb4c8f4e5e36a4357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798f668f-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703187920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187920, "uuid": "7bf28b3a-5fe1-4056-ad1e-720994bdc738", "comment": "Malware payload", "value": "c8549dfb4b6f8c2c4d274bd695584ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187920, "uuid": "1cc4b0eb-edab-4aa7-b44f-8ae656352281", "comment": "Malware payload", "value": "780d10cb30ea3654df1530ca1fa4a5dae4d7d01f80318e416ba56f7e7a5be55f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187920, "uuid": "1286349c-2dd7-4a03-829c-fd3e29c5437a", "comment": "Malware payload", "value": "23a68e43f1f7d8f21fcc7e1cec87f92eb407972c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187920, "uuid": "15a75a75-7c2f-41d0-8f56-ac7995133998", "comment": "Malware payload", "value": "19e4d77c277d2d981c692c1f0b089a503ac7502ad6302668c2ae861c993538f92c48e07274bb293256112dc82310c333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187920, "uuid": "a1e6335f-1ee8-4f57-b419-9278c8045993", "value": "T14664124271B6EE59C8AC9470E9E25198680EBD52C0D31F17944BFFCFB4F974A02A4E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187920, "uuid": "51d9d281-bb48-4a65-8252-5324b8443dac", "value": "903da1045a01db94c1ae4ff05ccbc0da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187920, "uuid": "35dc27e8-f7e2-4f0a-8245-68502c54fbe1", "value": "6144:DM72DvWQeCs52A6z3rU/bozhgy2JN5bCOR/x5u5uOz6BELKNUVA2yx5Iq:vk4pz3SUzhgy2Jri5u66BELKqVA2yx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187920, "uuid": "0df90407-0908-4cad-b6f3-4f12c46b912d", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187920, "uuid": "d31e8d0c-3090-4110-a535-2c1fd9a37f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187920, "uuid": "7726cc52-0cc2-40f8-80e9-e3aa20ad05ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d398291-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186880, "uuid": "ba4e17e3-7671-4724-8fad-5aed5528bdff", "comment": "Malware payload", "value": "cdbb9eefe930c68c5d223f2602e84014", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186880, "uuid": "7a59f681-44da-4bc5-912b-4e53d2eaa78e", "comment": "Malware payload", "value": "787d66b845431f5358e1ef37970cfbd355737ee0d396c7d40083396248ed8680", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186880, "uuid": "5c51bcee-552e-4a72-ad0b-5800396a034c", "comment": "Malware payload", "value": "ded5c401f7bd00f5bbc7155900facfee1914a471", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186880, "uuid": "b868896a-2b79-44b0-9678-fac8275ab36b", "comment": "Malware payload", "value": "cdb2f819982f9410bba89e1cfc847804fd9f0f71580e1a1ab735ef8b63ea45e8a809cb3cbf07f5b25fde0995ac516526", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186880, "uuid": "e387d500-b53c-4bd4-bcbc-3ba4c6553c44", "value": "T179E38536B7619E77D80ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186880, "uuid": "7dd51992-ff1b-4118-adea-d377c0fbeef2", "value": "3072:dgZc9h1jlnLA2PiXYeyCcxVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZxVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186880, "uuid": "c9cc36b3-1f78-4ae7-8969-799ca5cd5aca", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186880, "uuid": "27b0a5f0-8e9e-4ce1-8df2-2d9e79ca3382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186880, "uuid": "18e3e2b9-a96e-408c-ba29-2de582653dfe", "value": "cdbb9eefe930c68c5d223f2602e84014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76a4e9-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186501, "uuid": "e86a4fda-f03c-4e55-97b4-677590172ea8", "comment": "Malware payload", "value": "86419bfbf4ca063240b720f900dfb753", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186501, "uuid": "a51e33e2-7178-434d-a71a-ccf91a9bb89c", "comment": "Malware payload", "value": "791d904246f11366dad66a832863fa51e70660705e9e0584ed0ba889986092ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186501, "uuid": "d795b0e1-457b-4f34-8644-7c463f582713", "comment": "Malware payload", "value": "d7c18ac2fb13426ea98e39354a519febac623bff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186501, "uuid": "406f5817-9a37-48d2-a880-62e96568121b", "comment": "Malware payload", "value": "ce3328c903611f6de1f7a6aad63065c79be31a51319dd1a20702bcaa715eb4059aa3879a8ef438231b58b3928748c6a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186501, "uuid": "b67ae04a-b28a-4489-ad74-2ece04c88214", "value": "T1E3732B52B781DA73D10310F212E2EF260532FE7F2866E95AE3A57DB4DA390C09611F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186501, "uuid": "2d7eb8e3-09ab-43d9-a5ae-7d55c8f6741f", "value": "1536:LJCaWbNSwUdctHB2QvoBlSdcLKx7ya5/tEmZ6:LJCa4SwUdSHBCBlic2x7yIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186501, "uuid": "ad435225-c46f-4275-a2d7-4dddbb24af26", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186501, "uuid": "58709f21-b31b-4864-9aad-38d8b3987db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186501, "uuid": "776b7d8d-c868-4736-83a9-99dff5e01f9e", "value": "86419bfbf4ca063240b720f900dfb753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9715e9-9fbf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Redosdru)", "timestamp": 1703135391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135391, "uuid": "527d063a-103b-46d5-924c-2d3f010b436b", "comment": "Malware payload (Redosdru)", "value": "80760823613c10e36a139126aa3ea270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135391, "uuid": "efef38f3-2e28-48be-9aae-3dbe986cb4ef", "comment": "Malware payload (Redosdru)", "value": "79c061e457eae6fe5e1ed54eb37e968e8d49d130b8723e2bd8fa8ce4329f81db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135391, "uuid": "8402aebc-728d-4606-93bb-8d6530c25ee3", "comment": "Malware payload (Redosdru)", "value": "af499582b50d25e7f70ce1fe9213725c615d8ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135391, "uuid": "6a099f78-3bd1-4777-88f6-ec3550874f38", "comment": "Malware payload (Redosdru)", "value": "4ca800f14fef503dde37ded4df6008626de4291ac1bcdfa1eb2578750e276e6eb44e80546694fd3bb31a1fd4797cc5fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135391, "uuid": "6cf1721a-df94-4508-b40a-4dbfc92f894d", "value": "T1851229472B8394BBF791E57E41AEA7BFC52A53532B56FB12CBA8DC900C22100F519347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135391, "uuid": "d021ce12-4044-4830-853b-02de13053c52", "value": "b90ff77ffc4997b42f3450b12342ffd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135391, "uuid": "cfaaf852-bf7e-43c0-8626-0421ad860653", "value": "192:yen/1accZe0hxfSEWnmmyeMfj4BSoP1oyn7Tb:j0hZSPnmv8BSe1VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135391, "uuid": "0e4e6d78-47b6-4c57-8c1d-5e38a5d4cffe", "value": 9316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135391, "uuid": "d1b78159-6214-4c7a-8365-476cf00de1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135391, "uuid": "c1073ceb-4b9c-41d6-a8fd-0a64bdb46e8f", "value": "DNS1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df10db25-a01d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703176065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176065, "uuid": "3f096742-a77c-40e3-9f2c-af7c229de695", "comment": "Malware payload", "value": "111b0a101726bea37360d7e819f69f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176065, "uuid": "942ce271-20d2-4fca-89f5-b62ab1c23787", "comment": "Malware payload", "value": "7b0958f809d16c6d8c7c593efcc22bdb6f10794bd93a25ab8235a897cdfa33fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176065, "uuid": "b60cd565-2d87-4232-8991-4d3012aaeca7", "comment": "Malware payload", "value": "c39055042893f1686d0a093685bd75754244e6b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176065, "uuid": "3a762842-3842-4e1e-8426-b3dadacbe098", "comment": "Malware payload", "value": "a71e0ac0b059a27e7bd8f5ef9bf06b95c0cf38adb5495570e36d42421270ee4091fd0d1ab1c3605a7f20bc7ef9b079b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176065, "uuid": "937fe5f5-af1c-4b24-8a80-f3594bc5c796", "value": "T16CB533007FE9C0FDD22302709A6CB7B853FAE34D0B0655EB6360C39D1BBE59D8526969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176065, "uuid": "375f800a-f7a3-430d-9947-f01bd03d5926", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176065, "uuid": "d1254eaa-0ade-41a7-a81e-cbd4a4470cdb", "value": "49152:mcBdwW6jnQVS+/h6SsAYu101gXO5XdkBLXk1RHGjriBa/tKi4xRZm:mkx6jQB/hNsawg++BLXMhGSktIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703176065, "uuid": "b93296bb-0af1-417a-a34a-6366ac963ddb", "value": 2310307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703176065, "uuid": "cefd7cbc-7f4f-4b1c-8b20-b46973093dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176065, "uuid": "bdcc6921-a729-4abd-b500-681b8ffc69d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e102240-a01a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703174587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174587, "uuid": "ddbbd007-6fe9-4243-b4f7-590ac46a1adb", "comment": "Malware payload", "value": "fb048e303e4588da42cf11f348bbfb45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174587, "uuid": "5f09c655-0bd8-4289-bf0e-5eee7a73cec5", "comment": "Malware payload", "value": "7b8d5d1e6f9b798bf0dcd37512dacf9be2f0c74daa03836d985e3fd4a5d8110d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174587, "uuid": "b715854d-a01d-4659-9abd-88962d588f7b", "comment": "Malware payload", "value": "fdb2b66544b363124cdcb21f79575880e35c7c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174587, "uuid": "d3713e58-a314-4f5f-99e1-563bdce0b7cc", "comment": "Malware payload", "value": "7e6ba51601738a66ba8e33ecc7c5515f46e64223d7ab17507a46b6c506292bb60bb6542a50b96068c70d57cd7ae437ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174587, "uuid": "5d79dca8-eeae-4d0c-8853-4c8576e5b74a", "value": "T131963304B3B25CE8ED16947EEA445392A2B1FC260360E4DF47F0A6665F477E4AE367C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174587, "uuid": "470bd7ca-ba1f-4722-a6c8-e6051af16f5b", "value": "22fb7e12ef0e3575df1d5b6564aa32c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174587, "uuid": "c27573f3-9f2e-4e58-80e3-689a13c9f35a", "value": "98304:bWCnUFTCKU8qHRxUXhLpKvEFMNCvE5BqxiHnqu2eeeOkPM8vakbRVADwmDIMbG0r:bW/FbecxxutOkbCkohcMaVpogCT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174587, "uuid": "6594bd83-1bd1-4ddb-98da-08645e94bf0f", "value": 9389056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174587, "uuid": "bf499f66-c8eb-4fa4-addb-cf966afc11e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174587, "uuid": "06c1dc0e-7a78-419d-a24c-0292813e3e83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab3b129-9fa9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703126236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126236, "uuid": "e50e5010-df0b-4e4a-ac4e-098e6c5fda58", "comment": "Malware payload (RedLineStealer)", "value": "42464d83d6f8b2ce1a88cf6c7c721c09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126236, "uuid": "361fcb61-0d53-40ed-8637-551e28acffe2", "comment": "Malware payload (RedLineStealer)", "value": "7bf0a62c650e7f8407ea480d27f3a1629064c6c03db6b578e442dba7ea35490b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126236, "uuid": "4820f189-7f23-4220-83db-8fa9685b860b", "comment": "Malware payload (RedLineStealer)", "value": "20a54e4ac19b79f8bb9fd49584b42cb56a9e949e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126236, "uuid": "581ea5fb-2449-4172-ac99-eb5275cf97cb", "comment": "Malware payload (RedLineStealer)", "value": "45ce00accdb0d8b7f3b8f743699a3a3c79536d49a209f6f9ab5a674d8f60e626f7429a85b0d19dbd845b946fc2b1ea37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126236, "uuid": "414a8d66-f0ec-4b7b-a3ed-a65a9a5dbb5e", "value": "T12BB4AE96734184FDECE72F3145A0AA70DE7CF7291BC942ABD7280ABABD1035051B5B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126236, "uuid": "4be7db79-2746-4c2f-8c2c-d9b923afa3fd", "value": "12062d8b6887d7a0da34142af6a26a3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126236, "uuid": "b9b07c58-278a-4870-a01d-3258a65ac204", "value": "12288:HdKgCUUXiSLZQ88Xd6CWyc5obe6WzCSi3PR2CKNI8+aAcI/OMF:HdKg3ciT7Xd6CWyc5otSi352C2I8+aA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703126236, "uuid": "70c8eab2-05ce-4b0d-9b60-456138ea645b", "value": 529280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703126236, "uuid": "a585f963-da73-418b-bc87-d3cc56844b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126236, "uuid": "09bbac27-53d5-498a-bd4c-438ecab4dc64", "value": "42464d83d6f8b2ce1a88cf6c7c721c09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2d15b1-a025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703179336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179336, "uuid": "00361a59-8140-450f-8dc5-d5cf307bb4e8", "comment": "Malware payload (RemcosRAT)", "value": "97a4612d1b6aa2af0e448fadc551b536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "otpbank", "colour": "#8C05D6", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179336, "uuid": "9c2b60b2-e56e-458c-9417-08f541953da9", "comment": "Malware payload (RemcosRAT)", "value": "7c81d05dd82233e0278c83ca0b1a3b3ad9f0fa4b8b56bef98bba964752369754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "otpbank", "colour": "#8C05D6", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179336, "uuid": "deff0152-a572-4b76-aa8f-00ca81cdf1a4", "comment": "Malware payload (RemcosRAT)", "value": "0ab9dec647eea4c11be01d3a681fc68831a97084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "otpbank", "colour": "#8C05D6", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179336, "uuid": "11961fd0-754c-4bc8-9be9-aa22b318982e", "comment": "Malware payload (RemcosRAT)", "value": "a51efa148c45e546f1bdfee9af8c236e70685b34f55af9288570490464703510a11b150ce3c46890d3fcd0335ad4134a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "otpbank", "colour": "#8C05D6", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179336, "uuid": "0fa3e2bd-0cc5-47a9-9ac3-87c1c795c4aa", "value": "T19BC4232B3154C9BFC1621E34D9E34ED1F7F36646E2A1E166A3103F4724246EBA2BD5B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179336, "uuid": "ced4621f-0242-44b3-96c1-be19c6a2f62e", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179336, "uuid": "2787c5ea-6538-4147-b6a6-3c716038449a", "value": "12288:RTqTV5wkZc4xmOUqWDXqGq1oeT5IUUJb5EeSQDRJ5:RTqTPwkZT8Dc7F4G14V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179336, "uuid": "ec24c288-54eb-45b8-99a2-99746be0eb64", "value": 548728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179336, "uuid": "44edda9a-fa8c-43f5-b7bd-7ef834ff2097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179336, "uuid": "3a5bf57a-fbba-427b-be85-f1a6b2270b54", "value": "OTP Bank - fizet\u00e9si bizonylat 20231221.pdf(61KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3d422e-9fba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703133219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133219, "uuid": "bda270bd-2ce1-4d27-9118-d02925d306fa", "comment": "Malware payload (LummaStealer)", "value": "2ceb1885f44dd4e5637bce3544e81626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133219, "uuid": "ae81fa60-ebf1-475f-87e5-c3603b5f3259", "comment": "Malware payload (LummaStealer)", "value": "7d4f79c7789da8b65e9a5cbf2434187e2b6ad190339becdbafa6b32ce2e989f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133219, "uuid": "63858792-1822-4a3d-85af-7293a473e521", "comment": "Malware payload (LummaStealer)", "value": "7a7158e2b42402e19e2bfb5c0f82d3e03dbdba58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703133219, "uuid": "fc083ac5-280f-422d-9db8-40f014438be2", "comment": "Malware payload (LummaStealer)", "value": "5757f0a94bf2efbf50d96e4e699254c6b63967cbf78b03259f5ae2fbe38bd5e7cac63f66bf065e13f69773fe2e5a5e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133219, "uuid": "b538d661-3cbf-4b8b-b25c-60f0f4993650", "value": "T18DD6334152802AC2F4AA5774A5F11627EA717C24DB3AF4FF0541EDBC8DBA3188A7731E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133219, "uuid": "0c48490e-f62e-481d-9eb1-c376d4378c30", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133219, "uuid": "ddf52317-344d-499d-a937-3170a643932d", "value": "196608:6wxXK9HmkniiqyqDmGmpIxybuJT2yjK8fGRxnx5mb2htbaSNSMzdzKPeaL:bXKEknilDmXET2yiRxnG4WSxdzKPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703133219, "uuid": "fb147857-8b12-4c00-8ba7-a92fcdca0cbb", "value": 12912128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703133219, "uuid": "d1409f32-c765-44e3-b95e-e419942b7a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703133219, "uuid": "e1bbfc08-6bab-4045-b4d8-c9dc5752cedb", "value": "animalsophisticatedpro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fc0f3c-9fcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703141118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703141118, "uuid": "ca02da55-a3fc-4dff-9bc4-849135ab1a24", "comment": "Malware payload (RedLineStealer)", "value": "4857540f4f21679f1dd4209ab6a6ba72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703141118, "uuid": "d16b4a5c-43cc-4dee-b32c-d10e93780b17", "comment": "Malware payload (RedLineStealer)", "value": "7e1a176d5f2a191b4b4266335be0f1f6986dd3e0c745a3222eb028e8746702ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703141118, "uuid": "f1b7a70a-a687-41bd-acd7-74a79b5eb97d", "comment": "Malware payload (RedLineStealer)", "value": "028e36712a2a530209c9f0ab2756e037f792f387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703141118, "uuid": "e07e1d18-081a-43d1-96b7-79cc0fbee9b6", "comment": "Malware payload (RedLineStealer)", "value": "b765c9bea8ac0ea083f7a683d7f2cd1ff8b3a6f7f8f933f96b5e40a5e34cb3b1f3d9aaea81d08b71cd71feb23705fe8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703141118, "uuid": "98252e7c-6881-4a6f-8a69-8ea1ee5d11cd", "value": "T170563311E7EC986BC8E5277574FA466316317C990BD4E2BF9F44808A2931ED0E8317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703141118, "uuid": "438775fd-6640-45a7-b56e-def9e965f466", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703141118, "uuid": "ca970ecb-2341-442e-8a0f-62bdaf3570c2", "value": "196608:savWfOaItYfI1DCLEMSQfj9MAldjR7fyz:s19I1eLEM/LPdl7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703141118, "uuid": "c216fb71-38aa-429c-8682-b264e10b4da7", "value": 6430208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703141118, "uuid": "0e360134-50ca-4e33-b11d-dd790c2eeef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703141118, "uuid": "e3c7a4b0-69c4-4908-ac2c-06f100207ab5", "value": "4857540f4f21679f1dd4209ab6a6ba72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99edfe2b-9fa2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703123121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703123121, "uuid": "aab42155-26f9-4776-a03d-abb4f4546c38", "comment": "Malware payload (RedLineStealer)", "value": "eb591336a1a8c61faf248e784166a19a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703123121, "uuid": "1fa907cc-2142-4dad-a637-50077849680a", "comment": "Malware payload (RedLineStealer)", "value": "7f81b931493420f34c52b63c21f8ed5faa53a08670de7517ecc16470bffac190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703123121, "uuid": "edc35fe0-8aa4-4932-81db-045c548b747d", "comment": "Malware payload (RedLineStealer)", "value": "f2fcfcf816f4bd5a734e030d53e74693d295360e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703123121, "uuid": "6281b9a7-afba-4e0a-8e22-e2ee4da47fd4", "comment": "Malware payload (RedLineStealer)", "value": "d9cf6711e69d453d8def471de3bafa12d7851f25c85757440acb207a0f44ea67015f44754dc8ce35ce03a7e2f5644dc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703123121, "uuid": "5197a328-3fa6-424a-bc0e-3b62551666a1", "value": "T1EF94AE3392E17D94FA62CBB29F2ECAE8779EF2508F5977AA11584A1F14B01B1C173311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703123121, "uuid": "562b584a-6975-4a5f-b533-10522cfd3884", "value": "6aff1f4d738e9d17912a05ebd3caee8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703123121, "uuid": "aa403ad3-b302-4ca1-9727-67738a891d3c", "value": "6144:tDVLs/fpj2yuH05kgX9G5jI8SAcPrHVAnXQ/tLAl5AxNZPCj:tDVY3pj2yC05HzdrHegF1Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703123121, "uuid": "9d35d619-2de9-4ed5-bdcd-4c5ab0ad42e9", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703123121, "uuid": "b59619b2-01e2-429d-a575-32489c7c58fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703123121, "uuid": "6687f195-5434-4bcd-9265-5416dd777ac8", "value": "eb591336a1a8c61faf248e784166a19a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0bbd50-9fe2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1703150401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150401, "uuid": "8e836824-33e3-419c-a055-6c4ee98dda20", "comment": "Malware payload (Pikabot)", "value": "034108d6f2cff66503f4bfdd68f627e5", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150401, "uuid": "5bc3ce0f-fc8f-4774-aca3-2fb56f9bfff1", "comment": "Malware payload (Pikabot)", "value": "80c557ee62d399eef2c9f74bbf7f43682010549dd09d1c35e4ae852271978890", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150401, "uuid": "451f903f-0d5f-4e1e-824c-5b4cd968bc4c", "comment": "Malware payload (Pikabot)", "value": "a7962061acb346324697a98380ce0b779ed89d2a", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150401, "uuid": "fe213689-1355-4531-8d88-2773d2aac38c", "comment": "Malware payload (Pikabot)", "value": "9959c263b1a35de0c925704b032e9ae22dbf2fdce4521e45adb9ab3789ee2909cbf64882595d638b94b8cabf7a454157", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150401, "uuid": "b6b42c04-7c97-4dd7-a6df-644c7c6cf5aa", "value": "T1CE33F2A462CD2752E1FB2B17F3EF6849D3BC51DADB1217E7EBD9067A29C26303192011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150401, "uuid": "e9cd9adc-3840-4109-b205-adc6f0dbf9fe", "value": "1536:BTSDupaxuL0JGLz9eSXZbtme5qmXZ8VCB2Yu:FSJkLaGsSXdz53+VUBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703150401, "uuid": "3092a2df-2167-476b-ae66-a1f131f6fbc7", "value": 55118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703150401, "uuid": "54ffac43-026e-496f-ad08-708033c5f798", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150401, "uuid": "3b385e37-dc9d-4140-b609-243bd8d4d65b", "value": "EQD.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cf4a74-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703177522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177522, "uuid": "6b51aacb-9dd3-42b8-bbd0-ed82082b0bda", "comment": "Malware payload (Mirai)", "value": "59268e82e2e9a3649b168e0b57b7ba78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177522, "uuid": "e12229be-e101-4a67-be51-475e32102fec", "comment": "Malware payload (Mirai)", "value": "81ac607dafc4ecfed2da7da767027522de6b5572443997f9ccdfb27bcb28b5b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177522, "uuid": "14f660c2-69ff-48a9-a56f-2c3c0fb429ba", "comment": "Malware payload (Mirai)", "value": "4b910a4e74aecf57382c3094ac31967ca9e6ed8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177522, "uuid": "3078b9f9-97ad-4b24-9fa3-2d849a70b945", "comment": "Malware payload (Mirai)", "value": "a1d45ec6768ad1fca52611876b04fb2d1e3898fac0414f47ff8827fa9298dc8ce5579b0656ccad82d87aedb2206ab817", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177522, "uuid": "31faa2f7-4567-4be5-9471-2d938396ad2c", "value": "T11B334CE6F900AE7DF45BEBBB84230909B532B74540920B37637BFD93AC321A45A13D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177522, "uuid": "9152d4bc-4da9-4400-af94-973b485d3943", "value": "1536:fLR6FsN8Yf/uCrNF8qPp3aO0yhwnraoFC8d:p2EF8qhqxpraeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177522, "uuid": "c49af5a2-b133-48b5-816f-744444b8ce04", "value": 53320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177522, "uuid": "d2bcec8f-6305-4c53-a4ca-7698a508d2a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177522, "uuid": "d757db50-31cc-4a7b-b916-300cf1deff62", "value": "59268e82e2e9a3649b168e0b57b7ba78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30756ebe-a00c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1703168470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168470, "uuid": "78739c5d-fffa-4921-aa46-00669b30aa1c", "comment": "Malware payload (Phorpiex)", "value": "a6f1e6b5775a94219b69a6261b36244a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168470, "uuid": "ec34673a-2c8b-49e4-914e-936b6bff6d60", "comment": "Malware payload (Phorpiex)", "value": "82d16b1428721a69501776eb26e14ecf76fe6e82a1d19c5fae6705a1cc0a4319", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168470, "uuid": "249a925f-2883-4f9a-bd1e-67bfaabb1665", "comment": "Malware payload (Phorpiex)", "value": "d06367278656d2df01112a0aff5ec845d952a201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168470, "uuid": "41c5d8f1-5f9e-4a28-850e-db36b6d4c3fa", "comment": "Malware payload (Phorpiex)", "value": "406d47d49ec747db144ce3399e1b2cc6ee2c39aaab1a361f605b7ea0814b3158812410cb43340d1660ba9147371f4a79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168470, "uuid": "85cf19d5-fd05-41df-98e7-29fad2d075f7", "value": "T12462C50D69D4482EF7F13870537DE20F49BEB8A23661AD8FB750B2863875392C5E056E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168470, "uuid": "c5331fa2-ac78-4277-9aa6-db9b16d41212", "value": "057c392adf7e60f53994e6bacf1e292a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168470, "uuid": "e698e33b-bf3f-41ab-9607-2f13bffadb72", "value": "384:DhnP/tVA42CM9c7JVTJMQWS+c73Q+VXiC+:DhP/tVA42V9cbTaQ8y3Q+tiC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703168470, "uuid": "6bc2899c-8920-4296-9847-04af87927364", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703168470, "uuid": "d836bd02-d4a2-4376-b46e-986b3b0ba64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168470, "uuid": "472b5c15-e669-4eff-8300-914121d94d1d", "value": "a6f1e6b5775a94219b69a6261b36244a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23967b20-a032-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703184770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703184770, "uuid": "ba96aa3b-65b0-4877-8adb-a81d12087e67", "comment": "Malware payload", "value": "46431992aa566007949fc4acbc058856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703184770, "uuid": "8d8673a8-c74f-44d7-94fe-4e9066a1f7d7", "comment": "Malware payload", "value": "846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703184770, "uuid": "e62c0480-3719-42b5-8f97-3f161b6707af", "comment": "Malware payload", "value": "533e0cef48e51095f1460fd52cc542923d23d29d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703184770, "uuid": "42f17d25-ae32-47ca-9b5b-de14075cae09", "comment": "Malware payload", "value": "08fae207f81bb85d50b9c1290b68e6881603c8f23626916bf631838ad585cf6dfd87f3620ac63cb56a6eb2344d839ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703184770, "uuid": "a9749a5e-d9ed-4f88-9d0c-4096d73e9fd6", "value": "T129C6D096BCC755FEF6E5387C28BD3B1A53BEF51D6244EB221F092882884614D6331C6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703184770, "uuid": "4cc3a984-e967-489d-b73a-a376eb3d3220", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703184770, "uuid": "15148ff6-d05b-4b35-b028-1ce06b04d216", "value": "3072:3+fKfLxPq+l/AGDF+FUN9TgPC543HaHJSp8Bb8EGF9N7:OfKfI+l4GDCACS4Kz8EGF9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703184770, "uuid": "67616db1-0e5f-43c1-bff4-1a64194f0b9a", "value": 12010240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703184770, "uuid": "13d94459-12a9-4136-9dd1-8b1df28cce64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703184770, "uuid": "1d09c36e-b65e-4c9d-9431-2adb1b7d5995", "value": "OperaGXSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70526f0c-9fd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703143237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143237, "uuid": "5e3d9be1-0056-4b7e-8686-39204a749bd1", "comment": "Malware payload (RemcosRAT)", "value": "bb446580a3dbda7c6d33409087b48963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143237, "uuid": "1a1dd1ec-0635-43e5-9925-b20c53a95d62", "comment": "Malware payload (RemcosRAT)", "value": "8645e36eb1542409a86fca23f57dfc5d56aeffa19c4a1c8d94a97e5310762107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143237, "uuid": "e0198a05-036e-44a3-bd1f-879b0c73813d", "comment": "Malware payload (RemcosRAT)", "value": "f5a6d4888d0de42e86bfcd28f8d04f2984eb6411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143237, "uuid": "a2d9d2d2-6f2c-43e5-90e1-1e1bb7b1a80e", "comment": "Malware payload (RemcosRAT)", "value": "4f8eed56260ec8590a412b4e61836f697199e7f1e5ab0acf0f890ae2f460661e380f720deaa9ba9de74c91dc8cd9ce8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143237, "uuid": "b368d10c-179f-4975-a2fb-60b7b398bffa", "value": "T1DFB412106AB9AB16E6BA43FB9521122183F5B90F2921D21C4CEB71CD1A6BF011FD1F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143237, "uuid": "d8d0cdd1-0566-4142-ba8c-8bb819e7f766", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143237, "uuid": "f5d7e7df-3445-4844-958a-90cb097ce094", "value": "12288:KROMtvQ8FuujQOikfVyaaYCG9YGEnh4Xvbfn3Q3XUal:dYTFikctYC7GEmf3QnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703143237, "uuid": "1a2c1e5f-3cfd-4820-b302-d9208f9ee830", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703143237, "uuid": "1d931e82-ec6f-4a0a-8cd6-a027de885cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143237, "uuid": "1ffbd1bc-a4c2-48b5-942c-8904db1b5ba0", "value": "bb446580a3dbda7c6d33409087b48963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f1d904-a005-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703165636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703165636, "uuid": "d8237877-9524-4274-a51a-637bbfee83e1", "comment": "Malware payload", "value": "b308bfab83ae3aa3f1271eaa731c9322", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703165636, "uuid": "f72bb4eb-27c6-4208-b183-c0a67459fd99", "comment": "Malware payload", "value": "87a7016b48e6bdb37e3182773aecc818c4d46a22ccf9dbb3fcc7959446bae6a2", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703165636, "uuid": "85179c0e-347c-434a-8305-5a7935d08313", "comment": "Malware payload", "value": "bf5b490a17703ac0e065b70c6e6f196b8c388c40", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703165636, "uuid": "77ab6ec3-b9ad-4c27-9b0c-a8fa0372310b", "comment": "Malware payload", "value": "89aef56921b429bdd37ac7ded0bde8494b615702a2d4460ccf9133424edd0f41cfee20bd3e9055ee362e86c9a0c1c8f0", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703165636, "uuid": "d0daa793-9867-44ec-9052-94a94b2c5201", "value": "T11C4633D8883B7472DDADE5F16A1B68E034084A07454C896DC0DF62BADC847DF60BB5BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703165636, "uuid": "85b0cccb-8d1a-47ff-98e8-2b6888724353", "value": "98304:vjMoQ9egjjoXsymU5aRyapJWnVAinUN3FRb0K6Lqo+M7UFmA9c/kaIVkipPO5t:vjMH9ho8HUy/inURTgqC7CmAd7VzIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703165636, "uuid": "9b29d45e-3d42-4b2d-9631-819cf080ffb3", "value": 5772804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703165636, "uuid": "5afedc2b-1c57-4cb9-8082-3f118252226c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703165636, "uuid": "9b6a203b-5b21-45e7-9f26-c109f7edb382", "value": "BotClients.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a9dc8e-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186463, "uuid": "88cb6047-fa71-4820-a0d0-347e65ad76e4", "comment": "Malware payload (Gafgyt)", "value": "7c5fb1ac2c1973473627d508b79ac630", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186463, "uuid": "646e0553-4ea5-4da2-bf8f-e50c72ca84f8", "comment": "Malware payload (Gafgyt)", "value": "87eb6ffd7faa65040ddb4071cc3c0d71d357efea217a7e69d9a55bb0f6aaa284", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186463, "uuid": "3c6fafcd-d8df-4d5a-8300-31c422404f52", "comment": "Malware payload (Gafgyt)", "value": "b8c93a9a17042a82a9d81e7ab2fd62c894482c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186463, "uuid": "e37143e3-951b-4a58-bfc5-2aa6cad3c7db", "comment": "Malware payload (Gafgyt)", "value": "42012dffde55c24243c5ec9617e0ecef7915c04c1b836047c940a8e2782da153ce3bdf62d3cdc3d7bcda6aa2aee52f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186463, "uuid": "392eb833-ce00-4128-b1b5-3cd6d72ddc88", "value": "T1B483E784FD559B1FC3D372FAE759028D763A1FA8A7EB30259934BE9023F5BD02525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186463, "uuid": "1eac6d58-adf2-4c59-8159-3734168f2236", "value": "1536:sC2ruOIXs+NGmd4fIVDJZPJmoSRBv8+B52u5OOF4nb:5Ot+NGm8oDJOocvh2lnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186463, "uuid": "7cad35da-a0b5-4982-8e99-fb34d67cf3b1", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186463, "uuid": "c70f5908-2924-4e67-932a-6199e3424d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186463, "uuid": "e70fb79a-4c8a-4717-bea1-4ba89a40fb28", "value": "7c5fb1ac2c1973473627d508b79ac630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce231907-9fd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703144683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144683, "uuid": "319f968d-e2b1-4d3a-a1a9-190f730a2f72", "comment": "Malware payload (AgentTesla)", "value": "b7ed0475c29451b6029a9c341de38f42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144683, "uuid": "e79d636d-dd65-44df-bdc8-c42559245359", "comment": "Malware payload (AgentTesla)", "value": "8923d948d703222567a78747905de70689889573e6b49baad071b06cdeb09125", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144683, "uuid": "8ca80f6e-432b-40d4-8123-3f0b8dda2653", "comment": "Malware payload (AgentTesla)", "value": "3a60aa7c05ab92d01b1081ce8b1580407d0e927e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144683, "uuid": "5634d016-2a26-41ab-a0df-615dee54a176", "comment": "Malware payload (AgentTesla)", "value": "de3ddf5fd69077c36f4470c98a26b405b60d0dffc5a7d52fbd5a23d901745fa4c6b36e7c4aa49f303c769c3afcbbd850", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144683, "uuid": "46e9306e-2c9d-47af-b4a1-a3421016c62b", "value": "T10774232170D154F3EA62863288F7B7BDE73DD424E070611B27686B7B15312C1B66E1BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144683, "uuid": "657c7a3d-2ab6-493d-9288-5e99d29328a1", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144683, "uuid": "f5b20ed2-d4b4-48f2-8921-92a102d55b7e", "value": "6144:bhjmiL6OW9bfZylJp65AiScMWjNa7mpD187mbV0ZkXy0oFPrMPDdlHcGbomF:RjUBep6R4k4mpD1D50ZwlQzaxNcCjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144683, "uuid": "5801ebcc-b011-44b4-bb1c-c19a4e78429c", "value": 345257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144683, "uuid": "5489dfaa-15f8-49c3-bfda-f66c18152112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144683, "uuid": "bfbe68fd-05b8-40a7-930a-8bf6afa1512b", "value": "SHIPMENT DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56aaa90d-9fc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703139329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139329, "uuid": "dd266aba-3bbf-4fb7-b318-4053adf69f81", "comment": "Malware payload (AveMariaRAT)", "value": "e7810b7bd35dfb1131242377570a8705", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139329, "uuid": "7359b917-1f5c-4b93-8abf-4ac1a7559fa9", "comment": "Malware payload (AveMariaRAT)", "value": "89e0d97c3f6b79962f97e02152cff003f17d940f973d762874576dab2bc3a312", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139329, "uuid": "0e78d32a-725f-47b2-bdef-fcda592ddb1c", "comment": "Malware payload (AveMariaRAT)", "value": "3809874c9b8ae6e05484d83120a9809b7cb0a8fa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139329, "uuid": "5a78df82-d589-4de1-bfc2-6e4bb6dedaae", "comment": "Malware payload (AveMariaRAT)", "value": "3c7440651d17b72efa0e6d08b1864132f525d0af0047532893178915869447ec68a64168eb658c849b027c0630996192", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139329, "uuid": "f8b0a9c7-faf7-4c2c-80bc-f6dc51821f06", "value": "T1E8C41250367A872FF77D17F7A512010847F2BA6FA660E35C8CE172CE2992F416A46723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139329, "uuid": "28797c23-9db9-4a19-9d80-2cdb42dc5d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139329, "uuid": "0d5d6437-f1ab-4f97-9387-239c67769ae0", "value": "12288:HRxMtvQ8FgK0i2AWL/pq/OZS8wQ607jA8cu4ZdefnOW5dOW:/Y+K0iYpQgNNL4/u4yfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703139329, "uuid": "9e93bb00-3a6c-4eec-8198-c8a49ae381db", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703139329, "uuid": "c5ca6b29-b99d-4617-b0c6-1591524f71c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139329, "uuid": "61cffeb7-ffe3-4097-88ce-dd7f95515365", "value": "PO54623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b79ac6b-a04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703197211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197211, "uuid": "79efbb75-0298-4136-9fd1-a3a965a144d7", "comment": "Malware payload (LummaStealer)", "value": "a301c51a020f072ba3699270d9ad70aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197211, "uuid": "c1fd0365-5c92-4507-b652-65210ba45c50", "comment": "Malware payload (LummaStealer)", "value": "8b2095f22cba2c9f35cc78fa2e31c9311af42c70b29ee0847ac92d0c3a5a3f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197211, "uuid": "c4aa9b70-33b1-44d5-840e-f0836df3d7be", "comment": "Malware payload (LummaStealer)", "value": "5700eb938ef22f3dd7513d0246c8ec3854d46db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197211, "uuid": "471fa0a0-c891-4d7a-993d-4b18792f6fcd", "comment": "Malware payload (LummaStealer)", "value": "77f87ee1a245269b3669422551ed19090e12e49e9e9de98f91071dd26bf26becc2757cba69d78722ccf1328d1b7e3da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197211, "uuid": "2c8d3546-066d-4d85-82fe-2169b33b360e", "value": "T11203D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197211, "uuid": "c6828e2b-914b-4d7a-93a4-95b21abae3f7", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703197211, "uuid": "da769937-cfe6-4165-bb16-c5a64fc456c6", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703197211, "uuid": "88de2577-1277-4be6-a762-79ebdb509f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197211, "uuid": "1afcdf99-7938-46b0-b40e-88290259b0c5", "value": "a301c51a020f072ba3699270d9ad70aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9785b542-a03e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703190118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190118, "uuid": "dd8bffd0-0d14-488c-8e63-3d54c74aaa5b", "comment": "Malware payload", "value": "622aa452b25a356a7967d677605d3d42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190118, "uuid": "d9487df6-7009-40c5-865a-14d216082d48", "comment": "Malware payload", "value": "8d3b28cf71bf7dfc78ca8c38b570e3e4100ba78959c5cced2fa3ad89be5b38a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190118, "uuid": "1aedd605-a53f-4685-b4c2-c92e1ebcca9b", "comment": "Malware payload", "value": "7134cd5fb81f5629061ee17978e828824ebfc75a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703190118, "uuid": "b575f1ca-d524-42f6-af75-d9e40ea07a97", "comment": "Malware payload", "value": "93ca8bdbaa9ef4f97266a8dce98f0d9dabdf2e5c083716f4c512afd15fa08f6de65d7792ec06c774f3a666886e621ea8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190118, "uuid": "85705a37-6b91-4cf3-b6af-05a3a0a6dad9", "value": "T143446D5E6F9AFC4AC90C35FEAF9B69E53695CD41487CA2C8D018762D873CE02C912763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190118, "uuid": "ca994423-55b2-4410-85ba-949bc865b6a4", "value": "6144:pkfnnjPXqvkhswm/dhgEzyriGtC3nk9R6rNFTUk:6PqMhsldiEOdQ3kb6rNF4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703190118, "uuid": "99c8fe33-1920-4c05-adc7-9566ac182121", "value": 272008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703190118, "uuid": "7fd16014-dfb4-4e51-ab54-2832fcd261fa", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703190118, "uuid": "31993049-acfc-4681-b816-307d3795b2eb", "value": "SecuriteInfo.com.Exploit.Winword.11.14271.15089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7243a653-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182754, "uuid": "dfd19eb1-7df1-4858-adf9-ecf26dd5a6ab", "comment": "Malware payload", "value": "64bc07c845da95b3759c6e5ffe2ad2fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182754, "uuid": "d1248900-a2de-4ac6-a46c-6aebbe172615", "comment": "Malware payload", "value": "8ec2343e14c4fb4344a6b41f3083f1207e227c9feb2c6597b10918acac96d82d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182754, "uuid": "c7914583-38a8-4176-a23c-ddd365a4838a", "comment": "Malware payload", "value": "21a188eed00ae93b6f567db71997575b5227c969", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182754, "uuid": "73bde9a0-8ab0-4251-8411-0af9900c4feb", "comment": "Malware payload", "value": "ea5199916e1ebcca32f3577facc14804bd0003cb9bc98db0d1098f8a62b82d1e6e0872a8897e1d9431242349ae9b5d68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182754, "uuid": "5ef6b207-f8f8-4c85-8af0-4735d640f550", "value": "T17065E111B6C2C062C0652630DC5FF7B6AB65BD308D68765BF584FB3F7871182DB1AA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182754, "uuid": "7905aa46-ccc4-4d19-b2bf-bacf4b362e46", "value": "a5ee92095edb5993095c9c7315eaded3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182754, "uuid": "07a64a93-8088-4fdb-8f51-3c12fe5820b5", "value": "24576:mRNrsR3lFPtWYLeYeXV1i/kmTckZ2xi91uTtvj4iqAFPezYayH:qSRWYL/eXV1i/kmeE91qj4iZ6YayH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182754, "uuid": "760310d7-2e8c-4eef-bca5-9952412febe9", "value": 1522172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182754, "uuid": "31e7bb9c-2702-495a-b4ef-2a00c2f71b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182754, "uuid": "6e190b34-92a6-4b79-8098-478e71d948e5", "value": "SecuriteInfo.com.Worm.Lodbak.30488.29677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c51b64-a015-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703172321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172321, "uuid": "883c69e8-1c12-49c1-bfcb-51086e4698d3", "comment": "Malware payload (RedLineStealer)", "value": "31b10ae1238c794129e04a85b1ac89c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172321, "uuid": "2653c538-a455-40c4-9174-3573f76dc517", "comment": "Malware payload (RedLineStealer)", "value": "8fc1a753ea9a8eb24b38a61c187c705116bf0c1ee434b8da5bab4273c3ef67d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172321, "uuid": "501b191f-a7f1-4ad4-963a-6c2e5ff35c66", "comment": "Malware payload (RedLineStealer)", "value": "20c9043318927381f29bc631f5aa7fe29779e097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703172321, "uuid": "43bafa62-88cd-4411-a856-dac68304d760", "comment": "Malware payload (RedLineStealer)", "value": "3214e5c70053ddb9592c88f4cfea470614b1501c3f1287eb1c65a532933f893d8a5eadab1e4a678b6460e40a4d77b9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172321, "uuid": "2e363c36-1a33-4864-aa30-54b09e61e37e", "value": "T120563382FFEC2856CCF827B009FF22130392BDC565B9D5A56F89580B0DA6FD56460BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172321, "uuid": "6fcac9dd-b2e9-4c00-a0e3-d86ae5e0de7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172321, "uuid": "a65d4f94-5866-495c-a1f8-264730bc01e0", "value": "196608:f0j7/NLb39l888ZH0kYiy5p//rfyNJvdzH4J:f0hbcqkpy5hjwJFz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703172321, "uuid": "58a489a4-44ec-4fb2-a3b9-388199d6cd9c", "value": 6433280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703172321, "uuid": "d25dcd03-31da-46b8-ac76-c06360024a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703172321, "uuid": "d93a849c-142a-47f1-a17b-f8f0e2168bcd", "value": "31b10ae1238c794129e04a85b1ac89c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62f04e1-a01b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1703175218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175218, "uuid": "6df7362c-8568-4dd9-b084-fd71b1ff1d6e", "comment": "Malware payload (Rhadamanthys)", "value": "dff334fa8d2c701dba4139875f14c9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175218, "uuid": "b58d67bb-a073-4c18-881c-504d6bb07901", "comment": "Malware payload (Rhadamanthys)", "value": "8fdeb093bec0bc7dc01ef7f0aa61476deaaddbf42a8da2d711e21693fc3ecbd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175218, "uuid": "0af01033-80f5-40ce-b413-3477c2ee7415", "comment": "Malware payload (Rhadamanthys)", "value": "2589dbf58d1b16b02405e528bc125f48aa643ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175218, "uuid": "3b233714-9840-4724-9813-56b20fcd5ce4", "comment": "Malware payload (Rhadamanthys)", "value": "346d7fada8b0152f715c9552758fc5a76efbdcc2b1675b5f5ec1acb6c927970d57fc60311e9e4cecb4e3e5eddd85baa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175218, "uuid": "ddea576c-4c78-4ae9-811a-4b84116595f1", "value": "T165562318AE8C351AE13A24759A23BD3CB07B6F7B56225E04B5BC53D7AFB24484433277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175218, "uuid": "b15b624e-ec34-4869-bb17-c414452dd417", "value": "a2b52377798765a91e307d887f9408b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175218, "uuid": "51d99f17-9d23-45c7-8a57-063aeda75dc7", "value": "98304:XmQNg/7b+DOWjg5/3xxVAjls6CIcvA/ArCvxU3qthfzJ6FKLN+VzaN44KNPn83Cp:Xev+FkYJCjvWAKmIfzeKL8aNGNPn83Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703175218, "uuid": "d43b55e8-98bf-43ba-ba8d-a80ba87db4e5", "value": 6094752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703175218, "uuid": "48230803-8b4a-481e-922d-9400c1550425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175218, "uuid": "8ce5ff98-4b9a-4631-8d5c-c13e77132174", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff46fe1-9fa6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703124929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124929, "uuid": "a135a451-7ff2-484d-a124-2eb59a47e3be", "comment": "Malware payload", "value": "e7634ffda5b6451985efbe2570961b6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124929, "uuid": "f250f173-4611-49f7-ae04-cc5cca05ff1e", "comment": "Malware payload", "value": "90f382734962793750bf2be0d0b9db41cbb2a44765ad267c626138f0ad6ac6a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124929, "uuid": "7ccafaa0-484c-4125-8fdb-5bcf923c8d4a", "comment": "Malware payload", "value": "f3288be1b6a619e7eba4c2c994294b1592323466", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124929, "uuid": "386aa3fc-088a-4fd6-8cd4-1539fd367c21", "comment": "Malware payload", "value": "cd9f63edca1120e2225626a859804b4baba2eb5dd6492e70f950122f5ad671c600a55694465f26fbfb135b71e80227a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124929, "uuid": "546b6783-2627-4be9-adc5-0be5669ec05c", "value": "T1D9C5BF01F3A38071D54621B5709E7BABC93C36444F1C9AD3B3DC1999FBA01E229FBA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124929, "uuid": "30e6995c-bec0-4e76-9b87-f84def57b08c", "value": "c485a1b56dc5416beae842f19b8fee02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124929, "uuid": "8f9488a1-4172-42be-80c2-987ccd9b41f8", "value": "49152:XrN2VoMXed2OYycHi/v0JrFkM+BdPJcM+BdcX3yZBQcmYDqRA:XrsA2OYzi/+MTMjvFER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703124929, "uuid": "18c7cee4-22f1-4e25-b8f6-9ffffe1f3cb8", "value": 2572800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703124929, "uuid": "952cf4a8-4060-4667-8ae9-8299564f6351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124929, "uuid": "ebaeea80-e182-4a9c-b660-37f004ac84de", "value": "SecuriteInfo.com.Riskware.GameHack_AGen.9541.27786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96145f6-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703135199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135199, "uuid": "c2bc2d2c-1a0f-4329-aec6-4d1bfb7b9cc1", "comment": "Malware payload (Socks5Systemz)", "value": "322f9a2b78eac3b750c76b6bb3f5cc26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135199, "uuid": "d8671091-9fa5-40a9-b0a2-f7d02d1d44fc", "comment": "Malware payload (Socks5Systemz)", "value": "911429dbe0153e6fc3c71cad24342b44a49d351046bbab05188668b3a26b6755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135199, "uuid": "9a74de81-b8f9-43ca-af37-285896aa9c6c", "comment": "Malware payload (Socks5Systemz)", "value": "62f13df76cd1fd30d0e61060fac2de3d459b6772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135199, "uuid": "afd69d3d-0486-4679-8776-463576875d6b", "comment": "Malware payload (Socks5Systemz)", "value": "0f5f71ae187a1d9b91f582d680753ecf32cf89d8beeba130da8bd99bb1db1e32d7e44413d4e5c216fd1e62ae01e0e187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135199, "uuid": "6e5aa173-e36a-45aa-9569-5ac246f608f2", "value": "T158963317B1928627D8EADB3E08F577081D1D661038B5122938A8F5C8BFB1FAD850DFB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135199, "uuid": "562663d1-c2ee-46e4-bc53-d0e76bd678ba", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135199, "uuid": "9295976d-d15e-4641-bbc9-6459c6ad418b", "value": "196608:n8RMMtae6oi+TdAAfikxBTODEznD+KkhRaGbY3ThW3mDztFxPRlF:yBg0i+jnzK2GOdW3m1B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135199, "uuid": "fa7cb506-1484-4412-927e-f3897529b5d3", "value": 8738665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135199, "uuid": "99494c8e-5b5e-4405-a78f-9648c003a5a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135199, "uuid": "a9cae3e4-9dbd-456d-80ed-c3dee88f9956", "value": "tuc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b905bbff-a003-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703164834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164834, "uuid": "020e3740-1d45-440f-94fb-73e7a22d6c08", "comment": "Malware payload (RedLineStealer)", "value": "c82ff91b8832ad71365b4d180f022ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164834, "uuid": "9e4de151-772f-43b8-bbea-d35d62716f25", "comment": "Malware payload (RedLineStealer)", "value": "920a025dcda15e391aaf20f2bcdbf99e444b1b49ef8b9963a925af82e0a68ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164834, "uuid": "c48ed3b7-6fc1-424a-bea9-bf14d869a1f5", "comment": "Malware payload (RedLineStealer)", "value": "ab27b3534d270684908631ad8529d81c37437290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164834, "uuid": "5e5f3141-3eef-4ca8-b70f-281065ce475b", "comment": "Malware payload (RedLineStealer)", "value": "7aeec8adb5895060d9dc5da351756ced880e3e417a1888a30dfbf7ff02f617ec050505c358dcef7850e9f3ad08c4e456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164834, "uuid": "d27f1d67-e1f2-4e54-a8b5-0317c4042974", "value": "T1C503D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164834, "uuid": "8fd63628-baa8-42d9-9f3c-1729ec4fe7f5", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703164834, "uuid": "d6aafdad-3f16-4a43-9ee3-56b3a4dd0478", "value": 37736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703164834, "uuid": "007f3e08-c993-4ad3-94a5-1b4bac936511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164834, "uuid": "90af9782-4446-4a52-a243-3211a778313a", "value": "c82ff91b8832ad71365b4d180f022ab4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bde0d1-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703135190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135190, "uuid": "873da939-bb89-49b1-8457-d5e0cd944e62", "comment": "Malware payload (Socks5Systemz)", "value": "0b63adb3e3ef96b21b28030e3d83035d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135190, "uuid": "495ed24b-433b-4825-a9ba-dc4970e1d948", "comment": "Malware payload (Socks5Systemz)", "value": "930bed06faf3901edb03f37ad01b44e7510f112b98e898e0addc99c31a146d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135190, "uuid": "2356fc30-6387-4b85-8c61-29ca50fd2dde", "comment": "Malware payload (Socks5Systemz)", "value": "db317e0c00990e898b65392940fca5a5da3abfa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135190, "uuid": "7db559cc-185d-4388-847d-28d76eea60c1", "comment": "Malware payload (Socks5Systemz)", "value": "0d5ed61d1784a853850a5aee6fde5f165372d625c28c6846ca46438b6132fb21c84ecbf89de1d8f34c0e04d8cd749530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135190, "uuid": "835b98ff-e96b-45fb-ba9a-dc7c10dc93fe", "value": "T13B9633BA110B9D74E012863CED7105158B3E19125066F61A70ECCEEA7F5B7BECCDA782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135190, "uuid": "b12eabb4-16c7-455f-ab36-fd67ac9324a7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135190, "uuid": "146a7b8c-73e6-4a95-b0ea-bab36d510bcd", "value": "196608:T5c9pzvsxq5f3V66mrDI3DfCQWGxYK02UG2tUJyYEDxko+XF:TyfDsc5w6mrD4fCHGSqOAyYEDxA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135190, "uuid": "0f845380-8119-4632-99c6-8f7a68f4e125", "value": 8927704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135190, "uuid": "f4484a37-86d6-4d98-8b2a-68982043507d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135190, "uuid": "c8b659c1-a225-4797-9f66-7229f5a6501f", "value": "tuc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7843e0-a025-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703179439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179439, "uuid": "33fa4cf4-2335-4d3e-9b6b-da89f948d08a", "comment": "Malware payload", "value": "95c42a2d5ad90fa8967b67c7eaf4236b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179439, "uuid": "42d4f12c-ece6-49de-990d-11e343043ba3", "comment": "Malware payload", "value": "934b63f0694bcdeba01cc1655b66bf684f52bad15fd9ac285f07e9caf385ba8a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179439, "uuid": "770a1878-f1f7-4cda-a731-a7d25b51a2bd", "comment": "Malware payload", "value": "d2a8d7c26da9c55b0266b0a021a8828f9b98945a", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179439, "uuid": "54a247ed-0b4b-4e6b-874c-1157719d24cf", "comment": "Malware payload", "value": "5111cce934300ac3bd4226dbcd69261f9a70089186e0e53dafe9a53a5dc6923557d1805709b94826caafad62906ae983", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179439, "uuid": "3d23b9fa-58c4-43a4-9d6c-0a19b64a7bde", "value": "T19A93322073809626D8594A78EC96E3B85233BD04CDB2475B3CDC7F1F3BB32955A12B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179439, "uuid": "3dfcd5ab-d178-4e93-a88d-713e27d47332", "value": "192:up4dJxwmN5ObF9wUiDS2SMAx4Yvc8IBWf+riWe:Qw3N50eRPS/4Yv1IBWf+riW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179439, "uuid": "ab812df8-89f1-44b3-a933-a82f3318bb72", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179439, "uuid": "1da2f7c5-4731-4e7a-acd9-8bbbac46258f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179439, "uuid": "1834dd2b-af8f-4826-a1d3-e5509859e9ca", "value": "nS2R12309RV0014.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbac477-9fe1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1703150135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150135, "uuid": "5d102bb3-a408-4cda-b264-52874487947a", "comment": "Malware payload (Arechclient2)", "value": "6fea5fced6907510c8cf57e8f0c5756c", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150135, "uuid": "99921d69-3d95-4c81-af5b-5bd74c1b74c9", "comment": "Malware payload (Arechclient2)", "value": "95d6d6f5a0983971c8a5a9104f2b34729e8e764febb8e520c0576de86f17c6c8", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150135, "uuid": "484baf36-d188-4539-b338-fbfb8d4227ee", "comment": "Malware payload (Arechclient2)", "value": "794080c6a2dc58d14cc7e64cd9f967c08a07b41d", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703150135, "uuid": "394d171d-f2ba-4321-b837-a74e557aaad1", "comment": "Malware payload (Arechclient2)", "value": "7064402de15949df4a61c67cd85242882bf3d584f7878b2e63e3958baae0975fe90ecd9bfbb94716c17cb81b9f3a5247", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150135, "uuid": "e1cb5700-9249-4a22-971e-3d673168d67d", "value": "T143369E223AD18E27F29F0D3EC2DA9504B3B5AD123651D31B75BC322D4B3275318E69DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150135, "uuid": "28688dc2-67e2-492f-bbd8-118fed5a0394", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150135, "uuid": "aa61b58d-8b72-4892-acb2-9747ff813ea5", "value": "98304:zJgjK5c+d60x3Cd28xQ027Rr6LMCh6D2LW4p+B3mk4zAKrO6G65VT/xs:qO/Fy08xQ17Bs6QjQ30rHjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703150135, "uuid": "63fd017a-237b-4dae-840b-069055cd9562", "value": 5305864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703150135, "uuid": "3dfc01da-c045-433a-ab08-649dde015c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703150135, "uuid": "d435a522-651e-4ab1-9262-845c7a0351f1", "value": "6fea5fced6907510c8cf57e8f0c5756c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81533fc-a025-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703179435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179435, "uuid": "f34a43ab-ceef-4366-90b3-fc3423bf64e0", "comment": "Malware payload", "value": "eae32bdb24528d4037f6858e378fd8c3", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179435, "uuid": "c7f51ab4-2b9d-4f8a-aecd-02ae1644c682", "comment": "Malware payload", "value": "9785a09c6c14bf63bf025c64381dde6c1a869f4085dfd0014ed963e25761a347", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179435, "uuid": "60cb2ad7-989f-4091-951c-63348d82ff33", "comment": "Malware payload", "value": "00fd806094f2a5661fc843fa9fe1963050df83a8", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179435, "uuid": "f8590cf8-cdb2-45bf-9655-ec3625668a93", "comment": "Malware payload", "value": "f9ebeba99d41286080c13b7633c245fc86cb5ac063d3f9916786c7fb89dd000997dbd18963044f8de6d981d3fc8b2518", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179435, "uuid": "5abb8689-e210-4969-91a5-b1d532ecb7cc", "value": "T11323E3E08A853719C9CE277A9F404874C1688CDE4F165E19ADB507BE10C7788B77FA2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179435, "uuid": "89b4968c-124e-4a5f-84cf-3979c75ceb7b", "value": "768:Cfh/Drg00RVLSntGoTPUKdy2f8cBKD8/kkBGXBw7I70W2RDRumdSXG:Cp/DrAStB/THKD8/kIfW27u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179435, "uuid": "8d61a7da-35c2-471c-84f7-4a65d4791f4b", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179435, "uuid": "092998a7-6970-48bd-a55b-a65b89b5465e", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179435, "uuid": "67c20368-3d27-4fdf-887a-b86ce9ad80ae", "value": "n228750794 AWB 6698324651_20122023006571.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9def0986-9fb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703129140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129140, "uuid": "3ebc40b5-9a80-4140-a1cd-741c4f53203c", "comment": "Malware payload (DCRat)", "value": "aae07ec6e35b9f73d5a12c284ec690f9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129140, "uuid": "dfb2382c-be16-4db3-9a25-d8aef5da44c6", "comment": "Malware payload (DCRat)", "value": "97db1db4a8cdf8656fa956bdc1f649f734d17fa74048363389ef977b90e64c9e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129140, "uuid": "24f743a0-bf5b-465c-bc02-59127be0b44b", "comment": "Malware payload (DCRat)", "value": "bae49d8881bf777835da4b30365ac3fe5d02ecab", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129140, "uuid": "99ab1ef0-5220-471e-b976-e26da1ee1e56", "comment": "Malware payload (DCRat)", "value": "f610b500ea46b3125a2d26da54c7fbbf82354559d5b2f503d0a71f2c706406b443f5c63080755c5f22995c483c3a0594", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129140, "uuid": "2935f747-d8c1-4ec8-8737-d1672983bb43", "value": "T14D95AE1A75925F73C2649B32865B013D82A0D7363652EB4F351F14D3A90B7F1AEB22B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129140, "uuid": "e276bf78-4a98-4c5b-b809-0ff8a5b9a858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129140, "uuid": "d1bbecfa-437a-4b2c-bac2-929481bf33d2", "value": "24576:oMx9RlEEO5bqyZfnVHDC21IMc+mSUDW/8QX1JHYFij2JFsveEAn1p2L0yBEpFY8b:9xRCDW+4yUQX1lYrOqKL0yBkY8NKWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703129140, "uuid": "c65a79f8-bafe-4e0b-8210-56321cf63e08", "value": 1884672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703129140, "uuid": "443fb483-b07a-4871-aa26-290a3d458687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129140, "uuid": "de924aeb-dcc7-4321-be37-396230b898f3", "value": "aae07ec6e35b9f73d5a12c284ec690f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaae832-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182748, "uuid": "bd9866e1-4f9e-463d-8a0e-f24dd52e57fb", "comment": "Malware payload", "value": "6547331ab0eb2e3ace34ac0c869465dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182748, "uuid": "3b6db325-aadb-4b15-8a29-9e8e13d311e6", "comment": "Malware payload", "value": "97f3d76eca4e0fdf1270588fca9ec7b4e67d9d43916875ea6b929a5f071c944d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182748, "uuid": "1031afa7-a8dc-4ee9-a720-d386e5045d8e", "comment": "Malware payload", "value": "651f1543e3fa3a083c2c21cd539b888933061b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182748, "uuid": "f8ee76ec-7559-4075-abcf-6ab7016a0386", "comment": "Malware payload", "value": "c3d09a376ac9a56a53f00fa176a11ae2b9b9016219af331a9f16e229ed2f2fac3bf83a9c711041b50a3229ec59411b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182748, "uuid": "e3770a09-62c6-4f6f-a1f6-d558654c4645", "value": "T14F74D6D1B7E1910AE0048372D4F98D34AD092E7465B4891F7F8B3F462BB5EF3E4A0296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182748, "uuid": "4ad7cbd1-2a86-4d40-b920-89fde34f748e", "value": "6144:Gunwm/Mwounwm/MwqUNNfGOfbPRG/FEkCEwSZeUqUQED:9nwIvnwIPNNfGOfbP8EkCEwSZeUqUQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182748, "uuid": "62327828-fb5c-4535-88fb-6f4305dcacaf", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182748, "uuid": "9e76865a-ee64-4f0a-9245-72f88159494a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182748, "uuid": "7a73b060-6fa7-4ec6-bf95-778a9c2074ad", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.18299.21024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806c43c7-9f99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703119212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703119212, "uuid": "dc4fbc5a-5a2e-4cdd-ab0c-e8fc1c83f891", "comment": "Malware payload (RedLineStealer)", "value": "a46ef8906b749c42ab8a260ee551a9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703119212, "uuid": "6d22e800-7b12-448e-b631-67882457ef46", "comment": "Malware payload (RedLineStealer)", "value": "99d96ff0355fdbfa9a1633f5d2dfde806238bc50f0cf452ef58924679c584f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703119212, "uuid": "ce3f60c6-99e1-4004-9fea-bd4071779f05", "comment": "Malware payload (RedLineStealer)", "value": "b38a6a7e6459d450ebff6f102671e97009b41a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703119212, "uuid": "6c804c82-8fe5-4e1b-9a85-50c2489dea33", "comment": "Malware payload (RedLineStealer)", "value": "d522091b63a480bfae54b63773a6db855e804697a5120cdc52626beb4ff7cd95fe43eb9b514c58157084a7a9ca467fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703119212, "uuid": "2c829352-7e9a-492d-a276-d9afcbc9a947", "value": "T19D563312A7A85C63CEEF2B344DF72647057832D2B49052BE270C584F2872BA1A4757FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703119212, "uuid": "f08c46bd-5908-4efa-beed-91f92df963eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703119212, "uuid": "281dccd8-2b77-4328-a095-f6dad78f58b8", "value": "98304:FEWENB2nwroKCoDfbZfWimigKT+79Qlmm0Cto9lQV/CONTqPKpM2SYos+L:FEbB2nwhCoDDwqT+7ObtYlQRpdqPKNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703119212, "uuid": "d33dd9fb-54fe-49a2-b457-3d8c894bd5fc", "value": 6427136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703119212, "uuid": "b727e62e-4708-417c-b3ba-03f5ffe16872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703119212, "uuid": "e819b13c-a990-4fa1-8e5e-19240e37c126", "value": "a46ef8906b749c42ab8a260ee551a9cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f46a85-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186515, "uuid": "593c236f-fdc0-4c8c-88ea-32a74d8525b4", "comment": "Malware payload", "value": "f880fb54e7d2d98eccb0dab42794d46a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186515, "uuid": "c2c511bd-e25a-42d5-b1f2-0552ef08165c", "comment": "Malware payload", "value": "9b344c8eafafa0886e809b71c75b2b2dc1b517c8ba9ed12d971889d4edd2f2c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186515, "uuid": "87915226-9580-4412-a8a6-20a5e79456d7", "comment": "Malware payload", "value": "1cd60697649ec894801e4aa86143dcc131eb5723", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186515, "uuid": "c1091165-fdfe-4d37-8904-164f43fe48f7", "comment": "Malware payload", "value": "f10889587e61d6c389896201228d5edc1e6b6f76cbe7220aeaa01f86f43c24e803ca211a520ca71225f96cdd198f6845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186515, "uuid": "663e6b60-714a-4ff2-918f-a67e40c8f31f", "value": "T169B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186515, "uuid": "3da3c331-5c00-42cb-9e21-c6c3ed89c4b5", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZkoamm/QcuLB1niDNb:YuFX0GIk1MHyph1amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186515, "uuid": "08708db5-972e-4981-940b-d5c0b93e1fd1", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186515, "uuid": "f0afcd6e-5185-4c4c-ab63-462c6c51de81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186515, "uuid": "6613189d-e679-4ec7-aae7-1d9239404d38", "value": "f880fb54e7d2d98eccb0dab42794d46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5e417a-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703177506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177506, "uuid": "642f63bb-0f81-4347-b8d5-354c572c701e", "comment": "Malware payload (Mirai)", "value": "e147cf36b3a295337080a97187d013f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177506, "uuid": "3ce3bf81-2355-4a89-865c-a6ec734797de", "comment": "Malware payload (Mirai)", "value": "9d18915185d8ebdea40a7250792f77438a830e1f9857500de5c6bf9d9a800e74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177506, "uuid": "7fb7e261-bc4c-4d64-a88e-1d4b8a86334c", "comment": "Malware payload (Mirai)", "value": "dd7a8d06bdc29cb211cc3cd43d9645a7afa5d7c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177506, "uuid": "df76bbca-d2b7-4538-98ff-7683a7afdee5", "comment": "Malware payload (Mirai)", "value": "760d7ac1a165b88b7efa4f342430699238dfe613a93fd003d9c480b3538f42dfddf7e2ce2ed087222931b97b42710b09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177506, "uuid": "03e7f813-f0dc-47ee-9f1c-53aa7a7d4028", "value": "T11F531A56BC81CE01C9D52376FA1E118E331367A8E2EFB2139E106F6077CA86B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177506, "uuid": "2a9fa29b-2c36-4b0c-b5ff-d084046accac", "value": "1536:AAngF6K5jU0B/r49ECdHj5MkyTJ+sBeiUzWIFiKBym1+sX:u62jFrAEEjKnd+HBym1+sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177506, "uuid": "eb501c1c-ab5c-4bdb-96ff-0d1b70821950", "value": 62856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177506, "uuid": "f7e0c22b-5d6e-4855-a4ad-68aeeaa1a6d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177506, "uuid": "d696b2c4-0fd0-4a77-a431-1fb3acc1db54", "value": "e147cf36b3a295337080a97187d013f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be3a5ec-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182743, "uuid": "673aca0d-33a4-40d3-8df7-119c2ddbfb03", "comment": "Malware payload", "value": "b00bc4b900132a5a0072ee02ae27ffd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182743, "uuid": "a84444a3-5ca8-48be-bac2-bcff6a9a4c52", "comment": "Malware payload", "value": "9e6ba2efb37cc146e37f427acc7f478faab606b62a71bff81387f7ca9881f2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182743, "uuid": "b2399b66-9e5f-4479-8d47-c9917202b9e9", "comment": "Malware payload", "value": "f44ff8e806557428b106709e910d19624740dbdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182743, "uuid": "8ee9fc06-be01-461a-a92f-5a25fb2d08c4", "comment": "Malware payload", "value": "e1d3ab03d4ba1337de836a441f47c2e6379049cb8ee9e09576e87ddc8f349cd77687885bfdc321154d607fbdae025186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182743, "uuid": "fab85e6a-4d49-498d-8b81-e45ac3a1d1df", "value": "T17F548D02F562C0BAC79F173149A76B37F2B494458B61CF97DB68CE5C2E361819C2B227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182743, "uuid": "60493a68-fb0d-4f51-bad6-a2c5efc7f1f3", "value": "3072:SUI+U+TfoAZ70PW8aPfTQAVRccI60lbwr8jfeooE75i5cizxEwV:tU+l7L3PfTpc6Wbi0Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182743, "uuid": "28ee4cd1-949c-426c-9e6e-9110b703fe99", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182743, "uuid": "a01366b6-6563-4190-8987-dda2d161d7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182743, "uuid": "fdbfcd29-7fe0-4c57-ae02-54841fda1802", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.15825.469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955c18ed-a047-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1703193980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193980, "uuid": "4b352ac6-2c3b-4a1d-92f7-0f6f63b8766d", "comment": "Malware payload (Cobalt Strike)", "value": "fb521a291f7e440dd5d519863ad273b4", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193980, "uuid": "3996cce1-5cbf-4d82-9261-c333f4e8d310", "comment": "Malware payload (Cobalt Strike)", "value": "9efe830686c8849fdd7bb62ebce4ff3659788c6b48b636040443009c02fd0d71", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193980, "uuid": "9f7a6402-4db9-4cc4-a054-80ac8eb26ec6", "comment": "Malware payload (Cobalt Strike)", "value": "b859aeef79f485665adb0b4bf29098c05aab974b", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193980, "uuid": "378ab092-c7a3-4125-9ab2-dc1d93d30f83", "comment": "Malware payload (Cobalt Strike)", "value": "70028e6efcf02e96636b79c39903bfb8c38154d946d073fdd41f29680673558e6b1bf6f3a9d6f058e7dcfcafee3b4a9b", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193980, "uuid": "8fdbcf56-fd22-4e34-95ed-b9f2855237e2", "value": "T17E52E659E51368B2E5165CF088FBEBB59F73FAA24CB08438FF5CE8952B10720795B205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193980, "uuid": "02cbbfef-6061-4268-89cb-ec9ca08f75da", "value": "019b571cd12272b16e59c82a4a2ecb9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193980, "uuid": "bde09a95-c847-4e30-9ec3-ab03a93b2f05", "value": "192:f3bwK//GwW0UynyoyNRzQGio/zZSOX6NOasZQe8DgNJ:T1ejnynANmyNSFfeRNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703193980, "uuid": "932b95d0-70d2-478c-a851-7cbb292f1fbd", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703193980, "uuid": "77e36919-7e7d-43d7-94a3-c139d8df8c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193980, "uuid": "306d6301-8ada-4f94-a27e-ff3b453bf992", "value": "dino_http_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee58ed1-a046-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703193540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193540, "uuid": "2f5476e5-de21-4bcb-83be-56de24be77a1", "comment": "Malware payload (Socks5Systemz)", "value": "5166f546a52d33cf24a27e2c9e560bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193540, "uuid": "b832e668-3b87-4d3f-b37c-6522effa5e76", "comment": "Malware payload (Socks5Systemz)", "value": "a080de20aa321af83e8570c5bf58f3f3644b043d807a3acabed4e546eb49a6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193540, "uuid": "bf2c03d0-e1d0-4163-82e6-4a8472d9085d", "comment": "Malware payload (Socks5Systemz)", "value": "ed1a2a278c8f0fb555dac4a70c203777188eaad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703193540, "uuid": "6ac4d257-3d5b-46c7-a37f-cdb8f7abfcaf", "comment": "Malware payload (Socks5Systemz)", "value": "0372238c799c36fd8708f9c3edf73f87a2046242a524909a2e8db8299add2f7ba1270a4635d4344c7d9b05bd996e84c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193540, "uuid": "ca0c717e-ff54-4d64-b04c-6539cbb4b44f", "value": "T1AF663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193540, "uuid": "e409df5f-356f-4cef-9b8d-a1c5f17d6cf1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193540, "uuid": "ce5a7054-3478-407b-9c38-eb6ea36a5b46", "value": "98304:M4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:fh7teThPZidcKj8fPz6+4jb1KswNdDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703193540, "uuid": "badc248a-0c68-4571-82a9-379cb440b5cf", "value": 7054359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703193540, "uuid": "6882b4c4-3466-4ef0-a35d-837c3d6d3e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703193540, "uuid": "46f2fa59-a5e9-48f7-96e1-f8f2fa266743", "value": "SecuriteInfo.com.Trojan.Siggen22.47135.1689.9732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac52d9c-a043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703192110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192110, "uuid": "d89b39c5-19ba-4011-9c2c-9b547eb5e78f", "comment": "Malware payload (RedLineStealer)", "value": "34c0a386e4a80eda74f0646b87943e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192110, "uuid": "261678eb-61db-465e-98e8-bfe104570f65", "comment": "Malware payload (RedLineStealer)", "value": "a119e29e28a305d1333be5415f8b59c3bd958c2287e098a5b9d054c19459ae82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192110, "uuid": "c67fe863-acff-49d5-80a2-d3e3d89827c0", "comment": "Malware payload (RedLineStealer)", "value": "af2244495eae1a491c50b95031c938dd2d4710ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192110, "uuid": "626cd9cf-8b14-4023-9418-87f0d58264a2", "comment": "Malware payload (RedLineStealer)", "value": "71ae63c362d3b0d60a9041201f4b3d438128d35a0b2e4b562f5b4771c234e92ed0b0e0eddc75d1726a982a16d72605f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192110, "uuid": "a2f378d8-12f6-4312-8934-10ba1ebec3bb", "value": "T1C8443A1352E0BC55D9664A739E2EC6E8B65EF590DF4977AB22185FAF0C701B2C273302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192110, "uuid": "e844dd6d-5933-4857-92aa-dfb885d3a774", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192110, "uuid": "d27ea288-9113-46eb-8fa5-8d4408c8257b", "value": "6144:TbJLAxaHC3Q/QkZ6IKzjuPWLLc0R75JFNs:RMxeCo9Z6ruPYA0RHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703192110, "uuid": "f850841a-a4dd-48a6-b183-b43a030b2a14", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703192110, "uuid": "9d29dae5-9e66-441e-b2bd-642173167c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192110, "uuid": "957b6542-77f4-4466-a111-27eae5ab758a", "value": "34c0a386e4a80eda74f0646b87943e6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78548692-a017-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703173315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173315, "uuid": "ac6d98e3-9dae-408c-ae67-994f2d956ce2", "comment": "Malware payload (Stealc)", "value": "6d00a00418d42936bde999a9af271f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173315, "uuid": "1901edb3-ab0c-4303-a4a3-ac3011cc0dc8", "comment": "Malware payload (Stealc)", "value": "a1625cc33bad1965ca705ae3fe136e57cfad5165968fd51a3367e08bc46542fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173315, "uuid": "cf57d4d8-ae46-49d6-b8ba-9560b41bb178", "comment": "Malware payload (Stealc)", "value": "3c20c8072561b6fa16ab83b3c839a9001fd04c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173315, "uuid": "8e106667-35ce-4665-9584-6f3ecaf9a4ed", "comment": "Malware payload (Stealc)", "value": "013a50222a332107de0aede015f02bcb60ef1bcacef39723b04b11db4f9be934f3821b16883560c8efb018bbeddc78b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173315, "uuid": "abf9ad21-d149-42d6-bfd0-9c85640bb5a8", "value": "T1A3343A5352E0BC51EA264F738E6EC6E8B61EF691DF4977AA12185A9F0CB01F2C133711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173315, "uuid": "41307c5c-6440-478d-9c64-e00f0889eca6", "value": "21a899cb2bf7f1bc566f7c47e1443114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173315, "uuid": "dace43ee-9855-4afe-9b8e-90ddf8b52070", "value": "3072:4EozBL1fqd4FyRSZz5kvvRM8Gp1Xv/R1EUzPdNYVDBk:4zBLQbRS5628Gp13EUz1Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703173315, "uuid": "09467e02-1c7a-4cc8-b889-a462a1c952d1", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703173315, "uuid": "58305a14-c66b-4a49-bc75-844c5645e14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173315, "uuid": "286cccf2-c200-45b5-ae70-451674f360a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487ef61f-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1703177530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177530, "uuid": "c1d7fe34-6208-47dd-9de9-6e0cda2c369f", "comment": "Malware payload (Adware.Neoreklami)", "value": "688b11202058af0746ee63a8462bc680", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177530, "uuid": "648479c4-ce00-46b8-8df3-7c9a130059d9", "comment": "Malware payload (Adware.Neoreklami)", "value": "a19fb2f90c6f5ffe1d7eadb0141f5534eaf6242386e42f0cb7b005752f2bc1ae", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177530, "uuid": "a3d0bfb4-12e1-496e-869e-5924cc9dc792", "comment": "Malware payload (Adware.Neoreklami)", "value": "b240b0fda2306ec3445e946669a987d8abe1ae1d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177530, "uuid": "4eba0a61-fb9f-4250-b076-52f519ff877d", "comment": "Malware payload (Adware.Neoreklami)", "value": "0f7d33f22d513fba37aca9c75730688eb976bbf1f88dd142618bc6cf487dc9c7847cd4a4dc9827d025579f03ca3e19c2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177530, "uuid": "91b9195a-6089-4b9b-9f50-a4519fc05d7a", "value": "T13276331132ED94F4E800A873493BBEF664CBCF564B118C376389C9AC7E6EB544635E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177530, "uuid": "49eebe8d-ef0f-491c-a0dc-789a2093f830", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177530, "uuid": "b558ab0c-bdb8-4e76-ad9c-35c282e1fd9d", "value": "196608:91O0oi5cDo8BHAFUJzcTROxtID/OxSiyt72e5Yo:3O0oi5cHAK+D/Yst5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177530, "uuid": "d56258a0-3284-4f1e-a923-d4ab3473bbe0", "value": 7594395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177530, "uuid": "e1bd342b-6939-4ffb-932c-977e791b27e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177530, "uuid": "80c156fa-912e-4c50-ae63-6e9b58c78476", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522354cd-a03a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703188284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188284, "uuid": "b5d6e74b-25a0-4a9b-a5a0-ad9b60ee260d", "comment": "Malware payload", "value": "2a5536e277d7c71bd7a8fd7b1ffd7afd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188284, "uuid": "90fd29b9-3181-4bd8-8d65-eecf70fda786", "comment": "Malware payload", "value": "a1b72731ababb98a1ef377943d1995a6cb5860585d8e3573db27c095aa28c04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188284, "uuid": "f43d3260-3576-4133-894d-e732a60565d9", "comment": "Malware payload", "value": "63f999f7b8eeee207546b08a69b54b5ac13753ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703188284, "uuid": "945b468c-9a18-4ed0-808e-5401a08e71a3", "comment": "Malware payload", "value": "48748e903fbbde6cab32d50ae84fbec026bc6b99f8f2ae1977046d87e68b4b4a5fdb18b5272d13a0b61215e3fb63385e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188284, "uuid": "5421f0e3-320e-4c87-a08d-5baaa02485c7", "value": "T1A34523797361EC63F11EA13149429369F620FA3002700377B3B15FAEEA5B5875F62A8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188284, "uuid": "60d5e231-a6d3-4c89-9e0a-4a58b37c5c49", "value": "e990dd07e89d04c53e337ab9b3f5e0cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188284, "uuid": "fad8048c-3b99-4b74-a965-906b14d62b6d", "value": "24576:9qr3545pTbaTkXSafBClDXSy/dbsqSGqsYeLlIe3KeBpwnoc3V:gy1b0kXSPFVbsqHqleLzBBEPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703188284, "uuid": "b700c7dc-58ca-40e4-8a6f-78bfec296ef5", "value": 1263895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703188284, "uuid": "ba69b646-a132-4326-b719-c10a2afbc71e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703188284, "uuid": "c5bde7f3-880a-4304-bf1b-b609072ce3ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30151855-9fd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703144418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144418, "uuid": "3ea2438a-3eac-41fe-9616-540cc18355d9", "comment": "Malware payload (RedLineStealer)", "value": "babd7672cca87c5799749f96aa53dc72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144418, "uuid": "288b6a5c-430b-4afa-a1a2-b99c46f46160", "comment": "Malware payload (RedLineStealer)", "value": "a1c2492588c6007caf900d15978c9875afa57a3ac2b8b4ea0157d10015ea2ea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144418, "uuid": "7fec8897-d7fb-491d-905b-47fa21a427bd", "comment": "Malware payload (RedLineStealer)", "value": "1b604fb420dd372b887275f712d1899b753bbb7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144418, "uuid": "fef61a41-cc04-4338-8e6b-d725b58531ba", "comment": "Malware payload (RedLineStealer)", "value": "99fa25c63175652b68000389888ffdf188393848bff26198c754b27be89ac76c17f3644dc7359c65040fe733c19bcc85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144418, "uuid": "9c6257eb-f9a1-4a56-8861-917239a6a2b6", "value": "T18703D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144418, "uuid": "d70929e4-d30b-449d-ae56-3b13b87bffdf", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144418, "uuid": "940b01c1-1b3f-4280-a284-5c8beae2810c", "value": 37691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144418, "uuid": "f4c22308-819b-4e88-b0d0-8671ced6f105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144418, "uuid": "a95d42db-5dfc-4743-9900-27f48caa521f", "value": "babd7672cca87c5799749f96aa53dc72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a5776e-a003-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703164748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164748, "uuid": "ccf0658e-2485-480f-8e59-d847d649f999", "comment": "Malware payload", "value": "68854c39d5a421ad5f4c9123b8670a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164748, "uuid": "a26fcef1-b5cc-4984-b310-cde12140a26c", "comment": "Malware payload", "value": "a1f1c25a19c804d3c4f01b0ae134844d6c203cd4fc19bdfe638b18ce2648cf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164748, "uuid": "95ca8ce8-6ae7-4c8b-8f8d-03b3cf65d670", "comment": "Malware payload", "value": "dc8e08625e0ba5395f630fd35e06f8707cb9359e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164748, "uuid": "9ff0adea-24f4-43c1-9161-d34432b8b9b4", "comment": "Malware payload", "value": "83f413381c00494b1c924fa36ad6c849b21d6b04ef1e04c49b0dbfd7b2f02f714f23ea8b023888aae015a03dabf08313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164748, "uuid": "1774cc1f-1fd3-417a-9fd6-53f5f8997212", "value": "T187059A41A7A85D15CDA41A3CC462507022A1BDC6DA5196CFABEABC9FFB3DECD40C074E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164748, "uuid": "871c1c72-797d-4979-b258-d3211642bfad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164748, "uuid": "ee903602-6781-4c61-a0a7-56f63c845bbb", "value": "12288:s80tvQ8FTrAhRwqnB9WI//QrY9IQLnZLmTUfj+jU:QAK+V/IrY9x8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703164748, "uuid": "e0d211e5-9507-4d24-92ee-49f836bfdbbb", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703164748, "uuid": "89478532-ada1-4d82-99de-8bb6c9c5ac18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164748, "uuid": "9e125202-71f9-401f-8e29-7e7eedbeea29", "value": "SecuriteInfo.com.Win32.PWSX-gen.24160.31885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5d2e32-a009-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703167148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167148, "uuid": "34accb90-9c12-4245-b813-60b21f766d48", "comment": "Malware payload (AgentTesla)", "value": "382635422daa0a2e8c5a035ce5eda491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167148, "uuid": "3f66b598-18b7-4637-be28-1bfefa7a716b", "comment": "Malware payload (AgentTesla)", "value": "a2e82dda8b0b0cc7831f28e2174a990d479819b3eae7c57e360ed9e11c4effe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167148, "uuid": "28e2e654-e6b6-46f7-afa8-61c653d5dec5", "comment": "Malware payload (AgentTesla)", "value": "18d505bbdbffe0d9bd822e44a18cc0cdd40b3720", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167148, "uuid": "326f3ded-7613-4105-84ae-1f2408143143", "comment": "Malware payload (AgentTesla)", "value": "026494a534cebacd1a5d87227e9b1419b505138e6504f6032e9a54f306ad6f2dbfb4127c68c6b33d4869f33c96faa605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167148, "uuid": "f5b44bd8-3a7c-4b34-ac5a-7a26aa867bbb", "value": "T1A515D43C58BE2A2BC075D7A9C7E50563F250947B3A12ED2698D3439E4366F8379C321E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167148, "uuid": "014a1a75-b579-4cf7-820f-6cb8237924c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167148, "uuid": "f6b81c96-d67c-4e79-adc0-547e5349d9cc", "value": "12288:XvV1SQeSBgroWxhzbBoqg/6DkryAgEsyFNiy3dfv:/OVSyrFxFkfgEsyB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703167148, "uuid": "c70c1bed-4ba9-4ef3-aad6-833cc6bdebf4", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703167148, "uuid": "1acf3a98-ce9d-491e-92fa-edc39984e22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167148, "uuid": "8cccdd2c-b3b3-4d95-a025-dad935c42b57", "value": "ndexut.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfbfbcc-9fa0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703122213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122213, "uuid": "60195520-d9d6-4366-bd7c-7846a1ea1fa2", "comment": "Malware payload (LummaStealer)", "value": "f31cde8e44b4d759f9026c454466757a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122213, "uuid": "123f0a29-0722-4031-801e-7d21a3ae7de0", "comment": "Malware payload (LummaStealer)", "value": "a57359348bc493113636ad8bf9dd2c565c33c2b07d885e56d22b5dcdc31bfec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122213, "uuid": "a39a3f59-6143-42cf-a713-4ef09a07d14e", "comment": "Malware payload (LummaStealer)", "value": "8e55c92eed4bbdc0b1dd2e06efd5ae654a7141bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122213, "uuid": "541f71d9-a224-4dc7-9418-a6a9f3baf33f", "comment": "Malware payload (LummaStealer)", "value": "b5c63173856966af0983c553e21f79234d4fd93e8c816ab87e9a853cd3d43bca85669033c7f68bc8d520b0e471b4e097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122213, "uuid": "3e12b363-14bc-4a71-ab01-799ce5ac35b6", "value": "T179563353EBE40812C49D17B45CF627621F06B8A10BF893BB5EC4655B0CB2BD968327DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122213, "uuid": "42d6f57d-16bd-4eb4-83f8-4504972fcbcc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122213, "uuid": "8d8ae287-9977-4212-a9a9-91f02070c4b3", "value": "196608:lJXEjv7fLjGYL0MneRvVhBr6xq6dn/QvQ:ojvjlOvVhqqknIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703122213, "uuid": "5c2454d4-bb8c-42b2-b0b6-2de9871980bf", "value": 6426624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703122213, "uuid": "a46e07b4-dab1-438c-b178-76d536f7f681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122213, "uuid": "0c03d1ca-a0e0-4e5f-8093-7110fcab8ae7", "value": "f31cde8e44b4d759f9026c454466757a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13f8c9e-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174377, "uuid": "426fe9a9-697f-4411-a46c-678b430137c0", "comment": "Malware payload (Mirai)", "value": "da7737b175d9705ae82eb0f44e062cc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174377, "uuid": "97f376b3-c44e-4ee3-9dd6-fbbda1a1bed3", "comment": "Malware payload (Mirai)", "value": "a5d0279b09187f79c867ef741fe1371809d222979c4f42b45e9f9c7cb6bf8297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174377, "uuid": "d8074fd0-f4e2-42d8-934e-81b5d88405e7", "comment": "Malware payload (Mirai)", "value": "237f4c70778c9facb36ad5c15c8bea79b9566464", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174377, "uuid": "a4284b30-28a9-4ea1-82c6-dba1a90bf9de", "comment": "Malware payload (Mirai)", "value": "bf24a550aab0f475d9af1acdfc360996383f4de84b59c523632223836fa23a38e1eb9653ba41e2a017a58310ad77bbfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174377, "uuid": "5675bfb7-a6a5-49bd-927b-f95eefed965d", "value": "T13C330952BC91CA02CAD42376FA2E02CD372123D9E2EE72039E256F5077CB95E0D7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174377, "uuid": "4cd4462c-3cbb-46d0-946a-7965be860ee8", "value": "768:/E5I4ZHi6n0X/qQOgH1SCR51PJq7VDtTjPXtygDFdpvsmLBN+gtQgaAl6D1:CI4ZHH0iQOcv51xq7vTXImjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174377, "uuid": "547544d0-11f4-4a78-abf2-0d4590ecfb5d", "value": 51308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174377, "uuid": "ec7ce0ca-0f37-41a1-9fb6-45e5afb1d36a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174377, "uuid": "7a8eca04-f1de-4b36-a4e8-c3b4d21cc57f", "value": "da7737b175d9705ae82eb0f44e062cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3b2dd4-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169671, "uuid": "55eea1e2-8069-409a-bf69-11e1dd2caf4b", "comment": "Malware payload", "value": "d60e7d16bfd073a64c272637840a7f4b", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169671, "uuid": "09b96a3c-6547-4e14-924c-d5685cf17691", "comment": "Malware payload", "value": "a6d07aabb8f83a7796fa2b2ad1003454332f9e3d3e8ba4d24d8596f8d917d5cf", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169671, "uuid": "33f5f1c6-f403-48fb-bb6c-d94f1f27369d", "comment": "Malware payload", "value": "ebb8cd91c1be7e329dfca7549726e5b827a6c865", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169671, "uuid": "97b8dbc5-05b6-49d4-a3e7-964264848a52", "comment": "Malware payload", "value": "c9f7ae6a9b8344cf50ccd7bc1b63c02ffdbed24f2b301d8c4e06a9f5a4a4011a6e00a8be9e39ea86adcbe73c5ea89aee", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169671, "uuid": "8c8fcc1b-f1e7-41fc-87d2-b3b99123b8e9", "value": "T18E5633ED5CB14930D4AC9CB2A5EB75D576980A5C000D4237AB8B2EFABDA82C3653345F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169671, "uuid": "d2cda546-733a-4ff5-a2ac-2610d9e3d73d", "value": "98304:iho0fqgFDEPf/o8sYH18JeLXJ8PrKiNPzh3bS3vkrCnAf9OzMz28O5s+KcTkQPK:i5fqg8IqJQKiNecrOJnTkcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169671, "uuid": "aa3e6e51-6c3c-4635-8173-b07dc323287a", "value": 6205956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169671, "uuid": "656bb0df-10f9-4e97-9f7d-293705e6a62f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169671, "uuid": "200a09d7-ce5a-4296-8c2e-a3e7c8bf07c1", "value": "WWW11_32.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191d1dd8-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186470, "uuid": "0fe97f64-8595-4fa9-bf6f-d0883f0b5c31", "comment": "Malware payload", "value": "7e79c5400a41f81ce0c4e1cd00f3d218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186470, "uuid": "4fdff91a-4f77-450b-a51c-ad8ca745a14b", "comment": "Malware payload", "value": "a720ed98b6d5008dcf2e32d9d580d3472df50413aae67141a1e6bcd52dff6375", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186470, "uuid": "cce50e51-9565-4278-843c-3a1c05145673", "comment": "Malware payload", "value": "af5dcef50128bdc4aa2f58db49adf02cfbd02d59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186470, "uuid": "976d9f05-29dd-4a90-a24d-2646b227b8d8", "comment": "Malware payload", "value": "ee5f048888dfefccc4375bbb02935783843b5b1eb8e29b744bc28ce94bb2d6343fbfe0a7742964832c990adbbaa298e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186470, "uuid": "2cf72d0c-f537-477d-a53e-fa9a15c87c7c", "value": "T188E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186470, "uuid": "61d06f21-b404-4561-b08e-078936713fcc", "value": "3072:JW6dm9tS1aRGQdK76t/zCwI5mrThPaLEnvPrNb:c6IG+LClmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186470, "uuid": "ee01af6e-c180-4c04-bd06-9d4d66adabba", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186470, "uuid": "f5af05f7-871b-4a60-bcfc-a3506fb5cabe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186470, "uuid": "c67633a1-a2b8-4e84-9c10-34f355ed0547", "value": "7e79c5400a41f81ce0c4e1cd00f3d218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10dfff5-9fc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703136044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136044, "uuid": "aa46e137-0745-4b36-993f-45fb8f67247d", "comment": "Malware payload (Formbook)", "value": "c263f716775a19c95b627a5a090bf923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136044, "uuid": "8f87d7e5-724c-4439-a3e5-a0506fb334fd", "comment": "Malware payload (Formbook)", "value": "a763451108bfe11eb6fe2e9a42430fe6b2c9c5be10709cb464e5f753d9fc0c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136044, "uuid": "e51692f9-2909-42b8-af12-1c7ee4a850c5", "comment": "Malware payload (Formbook)", "value": "b99f648414dc717b91b38d5a023488a4763ebdec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136044, "uuid": "410f0bc8-a2fa-4eb7-b27a-4b1fe464e99a", "comment": "Malware payload (Formbook)", "value": "1a34bd940f90e5cedb3b6bd6e3cc5c711615992b5176574a3c9bcd538a82fa358320470b39e8e7f964fe6285dde6e7a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136044, "uuid": "a5085521-c3f3-4264-9eff-88b5a5f56b25", "value": "T102E35A0035C09076E5B7423249FAAA24467DFDB20F666ADBB7C80E4D4B745E0BB35B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136044, "uuid": "9f744758-7308-4cfd-8a93-67a7cfb3feed", "value": "6aad837909ed5ba39fbdce3fd0d557c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136044, "uuid": "6a32dc0f-6a0f-4df6-9ae4-65a38d707d1d", "value": "1536:yH1WiGLz2Nm20FK5su0FLrduCUQIKsQRVLLsYel+g+aiPG8Sv+0cQjps8jcdSKAO:8YiGLZNi15nGRAlNoSv+SQSKABCJSem0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703136044, "uuid": "6cb41ced-6f65-4ba2-9abb-670f157d57e7", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703136044, "uuid": "0de4b920-9b82-4489-84f5-94794e24c214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136044, "uuid": "60214466-45be-4904-ae81-b2e6bb8af37a", "value": "SecuriteInfo.com.BScope.Trojan.Strab.12449.11612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311361e1-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703177491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177491, "uuid": "f79a34bc-1117-4f7f-9f05-3dfc98adfbb9", "comment": "Malware payload (Mirai)", "value": "0818639e781cb0b462a8887894eb0960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177491, "uuid": "8fdac923-d26f-4019-9114-e99a217e02ba", "comment": "Malware payload (Mirai)", "value": "ab585e74cc2915ef41a7936681f342b70b44f58c45066d9111a5c1c2099d4263", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177491, "uuid": "525eefad-960b-4184-9618-1a71383a00c4", "comment": "Malware payload (Mirai)", "value": "9f54a8e55032a3f7f965925ee26c0138ffb6719f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177491, "uuid": "bd568d1e-4453-4603-be9c-e0c5040f1f8e", "comment": "Malware payload (Mirai)", "value": "236230ed4e8f2df54cd2f8f73f0477dc34497f33bba8f619a0636a6270c7028f6ab15faef30616a5c2c85b5cb139de5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177491, "uuid": "bb8dd1a2-1e87-4718-a782-bb0c438113ba", "value": "T186239EB6E86D9D84C2590274B1289E3D07A3EA45AB631FF51B86C7919007EDCF12C3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177491, "uuid": "326c64e1-4204-4a63-acc4-6f2705ea1ea8", "value": "768:G/pGtYVjpi15f5nSx+vaRe/izqPNVUA9U/wPQOWfqCjgoqRbSZ4C4s1P0:G/po8dGRy+vaRNMN2f/fOQqaPqEZ4C4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177491, "uuid": "a67e3ef0-8a74-4489-bbaa-3a8b2d8cd3c9", "value": 47132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177491, "uuid": "934c1c3a-9b0c-4536-9a7c-e31bd9cd83b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177491, "uuid": "0ec48cb0-0016-4428-ae41-d1abc082080a", "value": "0818639e781cb0b462a8887894eb0960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5faaf65-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174358, "uuid": "d21f280f-9ac6-4e17-95c6-9784976d6c24", "comment": "Malware payload (Mirai)", "value": "2c88c91b56de82a045da5e6bdfd0da9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174358, "uuid": "fe088fec-6435-4dad-9c43-4840cc3426e1", "comment": "Malware payload (Mirai)", "value": "adc2c1a5e0d2b5dd69808ca693fb583606c0b2afc7eef3aad440d4e8324cdfec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174358, "uuid": "6a265cc9-b4b6-4037-95a3-e1e8b1bd2a6c", "comment": "Malware payload (Mirai)", "value": "142f014cd98c67ce2573ab0a51af2f2b8a70b659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174358, "uuid": "7b667bf7-85e6-4b2e-bb73-631be67345d2", "comment": "Malware payload (Mirai)", "value": "7fdb363796453bc88077a3ab6e11fd39f8a0cbce20f186abef40a1373e42c8353c3d387f2189f9f24e0f1d997c169ea4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174358, "uuid": "7ce412ac-2b8d-49ac-be75-afa64cf36ca4", "value": "T13963654D6D219FBCFBAC463447B38E21964833D977E1D684D29CE9012EB034E241FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174358, "uuid": "354ec1f7-ef16-44fe-8f57-6e5551b405e6", "value": "1536:xuKvuWABYvnPJfl2XvMrsNkQ9QfFI2XWRlF9GiC:dvdABA2XvMr+9QfFI2XWRlFoiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174358, "uuid": "4e648495-fe07-4bd5-9e36-f798064802f6", "value": 68072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174358, "uuid": "407506da-9015-4ea1-88c7-dfd44d04ac21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174358, "uuid": "dee350ec-ab22-476f-b579-770d0a1aa1d7", "value": "2c88c91b56de82a045da5e6bdfd0da9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4f2d48-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182746, "uuid": "8ff752dc-525c-422b-8bd5-f5c10a2768e0", "comment": "Malware payload", "value": "f14a4ce6ffd756f1fa1eaf02f4f6ddc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182746, "uuid": "b9b03a37-7829-438c-a36a-502ec4fd9ccb", "comment": "Malware payload", "value": "aec213f81cf9c2d32453e8051eeb25fe8e8c5e6a79a905b9c6666210e585a07c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182746, "uuid": "b2863979-e3df-4d46-b4ad-3a27c2cad701", "comment": "Malware payload", "value": "fde621253e767a69e2f7831673d39e953e8e976b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182746, "uuid": "abafada1-1b43-408d-a44d-f419a0faabac", "comment": "Malware payload", "value": "a07d967b1526c051cef451a3bd5e0a6fa905b6e7066143eaadca803757f23611c893c53b522e590f07a6a897af35bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182746, "uuid": "183dca6c-bf5c-45e3-960f-10bfded16d3a", "value": "T131C34A13B1E1C872E1711EBC9D46A565A83BBD213E281A6BB7F84D0D6F7C2C0589D3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182746, "uuid": "c03edb3d-5073-410d-a84c-aac5223fc303", "value": "3072:5iUQwxpu1dLt5YDgpUFlQzI/uyc2g6E9+:5ifSALhU7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182746, "uuid": "af1501e6-e124-4ce3-a548-867df558bfce", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182746, "uuid": "ac561f34-82aa-4feb-bcd4-f90b2c1ebf45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182746, "uuid": "1d6a1853-6e43-4008-963e-f3f06a58de28", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.13118.27927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ac3160-a035-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703186354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186354, "uuid": "2fdaca45-15e1-4392-8fed-b4ecc87590ca", "comment": "Malware payload (Socks5Systemz)", "value": "690962806ae360fdc04b19da152154e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186354, "uuid": "fddcd88c-b83e-4dec-91fa-f7d4dd731192", "comment": "Malware payload (Socks5Systemz)", "value": "af72d998606947486a87fd2c1dd93afa42154511ee5c4b220d3f1aa07426cd91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186354, "uuid": "968378ad-d447-4892-956d-6dc818c47b10", "comment": "Malware payload (Socks5Systemz)", "value": "46e482af730bf11389b1b238a64928dbeef6bb52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186354, "uuid": "f97e7663-8df4-4d34-af08-fba8157b9647", "comment": "Malware payload (Socks5Systemz)", "value": "540096dba9c44da5b4fb09872d8b1787a14204d092ddd7ee86942db6ebcea97c413e50a66aec79dd54afef55bce50ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186354, "uuid": "dcd992b4-cfd0-4520-99d8-4bd0d875f8fc", "value": "T1CC663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186354, "uuid": "877873e4-b90e-4995-9f0e-10bf9661f85f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186354, "uuid": "32d9c61f-6e4f-4704-89d7-9946fe0edb51", "value": "98304:+4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:Rh7teThPZidcKj8fPz6+4jb1KswNdDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186354, "uuid": "12ccb2d9-f744-434a-96b2-cd27999aa45c", "value": 7054359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186354, "uuid": "a43ec2c7-59cb-47ca-8272-b9c8ce0dbf01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186354, "uuid": "c3abca6b-6d6c-4cf1-9f6d-ba8bfb330972", "value": "SecuriteInfo.com.Other.Malware-gen.15.32366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6562a6-9fc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1703135800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135800, "uuid": "c33da10f-50b6-440f-a7f1-863719929dff", "comment": "Malware payload (Stop)", "value": "48bba0776399b84f275e7478cd60edfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135800, "uuid": "f5a0fb19-1ac4-4aac-8285-cd8f78c8b9b8", "comment": "Malware payload (Stop)", "value": "afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135800, "uuid": "64a49dac-dbda-4498-9e2d-a1b75106baf0", "comment": "Malware payload (Stop)", "value": "e87fd365807cd0dd15b70063beadfc20a988d06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135800, "uuid": "e2fd19d5-7929-4e54-b6ba-55904b73cdd9", "comment": "Malware payload (Stop)", "value": "a977bfe2d01a5b3c72f20352964404e247183cfe17315592e8d4e3741701edbfc52d0c69ee15c9d48c80b003bf5e78f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135800, "uuid": "0a14ded8-6be2-43ec-ba86-7c8bfec6a9cc", "value": "T194F4E02382E17D95FA22CB729E1E8AE8779EF2408F597BEB22585B1B04711F1C573701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135800, "uuid": "56e003bb-4b3c-4af9-b77c-ee5a61c40a1c", "value": "9138bad961b0c12306fd188b3eb186f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135800, "uuid": "a28cf0c3-81e9-4e75-b3eb-948f8585585a", "value": "12288:UKkwWoPlLr52zrZxRJY8X7VCTxJ3Dfn8g8gSaLK6+RI5bPhx+SBjl98o5WXjJ:LLr0z7HhITTDf8kSau6U4+SB/t5WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135800, "uuid": "6a2ec635-5c1f-4319-ad2a-ab3dad38caed", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135800, "uuid": "58ea5897-c4b1-4911-a195-4844e1dfe319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135800, "uuid": "da41977e-bb7d-4565-9fa6-a649d32efdd3", "value": "buildz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb77b94-a035-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186426, "uuid": "c31c0ead-4d6c-4589-80a1-c64fdd277320", "comment": "Malware payload (Gafgyt)", "value": "b648e529878cab504143e8b929deb835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186426, "uuid": "401e136c-34b1-4cdf-8b93-58f9c0ee9fbb", "comment": "Malware payload (Gafgyt)", "value": "b008f79610464663515f7030e1c2d39a59b7011050cf1842fa97d8fd89180cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186426, "uuid": "9da62088-cb5f-42ad-80df-e615311922a6", "comment": "Malware payload (Gafgyt)", "value": "cb9f62d7df240810c5755162f683c101148bfaa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186426, "uuid": "0a9efb3a-c7a3-402d-afc3-20f08e47f5c2", "comment": "Malware payload (Gafgyt)", "value": "f59ce2341892015431a3ddddc4b745fb21f79658f0733860743301d96c77d4d4895661a285cd4af1adcb36e6e850f2cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186426, "uuid": "a02136c6-3af2-4997-a9f3-653a0b611d2f", "value": "T10A93E784FD55971BC3D372FAE759028D763A1FA8A7EB30269934BE9023F5BD02536120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186426, "uuid": "a98a39c9-c166-4280-b352-1b6467fb3024", "value": "1536:dmjnaOU7w+N62KBfISGHFxBpqRP/1yoQt/NeOCOlCvV41b:7OR+N62w5GHFERPcFNerK1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186426, "uuid": "416606aa-f4a2-4702-b15a-81e5acdbdb82", "value": 90612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186426, "uuid": "a0fb411b-a913-43c8-ac49-c238f72641af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186426, "uuid": "5ea52c4b-6d04-4e66-93fa-ac5ced2ed103", "value": "b648e529878cab504143e8b929deb835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cec1d2-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169362, "uuid": "b674de97-e01a-4367-82f6-87af006db040", "comment": "Malware payload", "value": "cf9edf14ff8b53c41c6ab928121b1bfc", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169362, "uuid": "b792069d-e141-4efb-9150-a8f7b82ff211", "comment": "Malware payload", "value": "b3d2678bb325dfcd1510c1b13db87facdd78e7840c45d85a1fe28c11585bb2b7", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169362, "uuid": "6e6aa492-bf01-41e5-a86a-26daf477cb30", "comment": "Malware payload", "value": "1eb8b936005bea3f8d69b67296dd0328f369c6a6", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169362, "uuid": "35414640-4335-4661-82b4-8559422d6c18", "comment": "Malware payload", "value": "53dce7ee14c251042ca1a5e244bcc7b236f9a0ab8b362ddbc1be9e279e871f2c3492654d4d443053d70610f18c15bc7e", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169362, "uuid": "211f475d-3a15-4a40-8aff-7971a52086fd", "value": "T154A4AED8DC874F0F96B0B9BA0A23B42E46DA24EA47B0DB7D05CD464D308DBD04EEB585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169362, "uuid": "2c6aecad-46f5-435b-ab36-a38f8208f25a", "value": "12288:YwB53Gtggx/2peYyg3JRPoD66L4+pkl3Rf:YwBJGtgm9uRPQL4+KpRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169362, "uuid": "4470ca6a-f016-42dc-9b7f-1143e569008f", "value": 492932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169362, "uuid": "01880d07-1267-4c3a-93b7-59139e562b31", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169362, "uuid": "086357c3-3224-4614-97bf-e8d956bcb65d", "value": "crypted.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839b5527-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703135109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135109, "uuid": "958d8d9a-f0ac-43c8-ad9d-f9179fe2d627", "comment": "Malware payload (Socks5Systemz)", "value": "dfc6195c56648d477c11087696a34ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135109, "uuid": "8b0c067c-077b-4b38-9e45-b2e30b72963e", "comment": "Malware payload (Socks5Systemz)", "value": "b5bc391944d46890d903aae938e801632b6a408141ef0dbf8047478e552333cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135109, "uuid": "0d9a53b2-ca40-47e5-820a-4af3e8c31783", "comment": "Malware payload (Socks5Systemz)", "value": "26de5869cdecd6f754671dbd465417b14dd6a569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135109, "uuid": "991acc24-d010-45c4-97b4-c638756316ed", "comment": "Malware payload (Socks5Systemz)", "value": "8027d370d3cffcf2e49630c705d3bbb62c2b16699b280cbfc180f5ef41ec3053b91cfcdbe7361f9747298b8b4bd71f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135109, "uuid": "2e011cdd-cdba-434c-8d8c-6eb1f5d4f3d2", "value": "T17786332AD463CA3EE10EA0705D92CC214B1B6C17907AD8D5BE19935C3DFA31EDA6CB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135109, "uuid": "0ab88eaf-9896-408b-a5d2-ea0630536658", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135109, "uuid": "08389c0e-b64c-49eb-87e7-ca972b98308e", "value": "196608:pIbZH5F9xIyMnKH4IsxUlDV2fsJxAKN9ot44/pgzMyJKTF:pIbZH5DMnK7Das92hggyJKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135109, "uuid": "0818e128-55bc-476f-8850-3ee0730da2ba", "value": 8609480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135109, "uuid": "8198b5df-03ed-467b-8a3b-469e9cbb7773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135109, "uuid": "9b027aa1-c5d1-4c86-a056-7e1478a2c73e", "value": "tuc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268674e6-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186493, "uuid": "8a394464-20e3-4afb-aaee-402bdae9bc9c", "comment": "Malware payload (Gafgyt)", "value": "0ceffa8ba1854b53806ddf9dd40cfd31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186493, "uuid": "9c747d6d-52c2-4e6b-b1cb-82e019ce3cbe", "comment": "Malware payload (Gafgyt)", "value": "b6d1194504599eb54e3d4b449efc3334db185e9bc5f82971482aede1e27a8dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186493, "uuid": "d7f8a9e3-fc41-4851-a838-0f75887c2c7a", "comment": "Malware payload (Gafgyt)", "value": "d449a35d2a738bbf39c15dc0772e19d6361bb6c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186493, "uuid": "847639b2-687a-4cee-a803-4b5005e2fe6a", "comment": "Malware payload (Gafgyt)", "value": "347b9f63997cc2af7a5371d51e7aab732d6e4b81724f874ace4461b5358ebc259a6d09ea5943ea905e8494d77ba31d02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186493, "uuid": "3049f90a-6bac-453c-8fae-ed2b748e8d73", "value": "T1CA730B56E743C7B3C80306F202A7AA6F8931FE3A5835DA4AE3257D54E7338D06612B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186493, "uuid": "9ed5cb89-d700-43ec-8ea0-0a16b4a31357", "value": "1536:txXVxzBt9UzYJmwaFuTWMKOXsqbL5SA5NFZu:tBzBt9Uz8mXZOXsqbL5S8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186493, "uuid": "553bc0f8-06a5-4c6f-bd1a-5c0f83642e4e", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186493, "uuid": "dc1c54ac-b11b-4ed1-ada5-65b689ba68ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186493, "uuid": "8f9bda18-5bd9-4c5e-91e3-31f948162dff", "value": "0ceffa8ba1854b53806ddf9dd40cfd31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aebde57-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1703128572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128572, "uuid": "1cdc40aa-fe8b-4b08-91a6-dd0959fe5653", "comment": "Malware payload (CoinMiner)", "value": "85b31cb0a9326cbef2496e63ababd9c1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128572, "uuid": "f75ee821-b4d6-43a5-a7f9-6b31c9aa07e3", "comment": "Malware payload (CoinMiner)", "value": "b754418c18490b4f4f4a4b7c6424353a61994a4b344167b7f9e1370191339b30", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128572, "uuid": "38e73598-509c-4699-aefc-11bbcc4db3a4", "comment": "Malware payload (CoinMiner)", "value": "ef7f3e8793e4d65e93330cab1bfca23291bb7c8d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128572, "uuid": "dabf48bd-8b78-4718-8601-ac58587ba7ba", "comment": "Malware payload (CoinMiner)", "value": "850cfe185567069ffe60bd4853ef1b095f27baabdd62db8178c150be4b2df31f9014a44b67adf458f3c1a8f1d035f9c3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128572, "uuid": "9b626ac3-6b15-4671-90f2-a203dd8e647a", "value": "T19AB5333A1F3E9014D0006EF4E950AA9C6CB9AD50599DE77BD2202EDBCEFC641FE49097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128572, "uuid": "6f299105-38f7-4cc7-bfc6-8f915760266d", "value": "925f066e0da3bc64b3f19f84bc8435db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128572, "uuid": "a68632aa-5660-4a2e-b70d-15f480aec85e", "value": "49152:oyn3g39RS2Omo73WOUHdoYm2LoMOlp/ar2Ie2VYM/YCSSCaSsgBsSG+jDR:oE3g90gorCoYRsn/ar2Ie2yM9SSCaSBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128572, "uuid": "ada22e6d-7852-4a85-87ae-5526f23dc26f", "value": 2367392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128572, "uuid": "4df23ae4-788f-40c6-8240-143e4a0111b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128572, "uuid": "8cdef8ae-81b1-4e85-a4a3-5bfa3886b6b8", "value": "85b31cb0a9326cbef2496e63ababd9c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0229f78f-9fc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703139616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139616, "uuid": "0bbd23b5-84b1-4110-9042-de945ef83452", "comment": "Malware payload (RedLineStealer)", "value": "964aeecd65bb36f17f07d4ccd32f22ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139616, "uuid": "0a41a9e5-138d-48c6-b92b-07199402f0e5", "comment": "Malware payload (RedLineStealer)", "value": "b823dec3eeae35906a95d69d3c39ce07fe3155f2c8d4cff66a3cdf35a610a844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139616, "uuid": "1a0f21aa-caa0-4fb8-aedc-23719037c569", "comment": "Malware payload (RedLineStealer)", "value": "a1bc67553ce46c07056a3b3fb716eea5b265d494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139616, "uuid": "bbc90ce7-a9ad-46d3-910b-86b04cc02474", "comment": "Malware payload (RedLineStealer)", "value": "7c63d962def711c71b5c07132aee95eb3c124da6fa65e4571770abd537f106ac089b0ac0948b5f7647c96198cee92d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139616, "uuid": "01671863-c78f-479d-bdb4-1c6a7f0f86c2", "value": "T17B56334AEBD80496CC6C2B784AF713670A39B85536B1D1AB9844D10F2C31FE1F9627F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139616, "uuid": "3c3ff6de-4ae2-4a47-a79b-e210c8f36447", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139616, "uuid": "99f56e43-f79d-49e2-949e-257030435626", "value": "98304:fWiQ1mdUev2/RjkdBMObK1lHqo4qkwUzPwz7CVHBQZQ1bXppS7xu6b:fWiTdUegeMObK1lr4tjE7Cpi21bXUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703139616, "uuid": "c161be23-b72d-46ba-b530-72899b9b9a19", "value": 6424576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703139616, "uuid": "f2ea02a2-7aa3-41c3-b3cf-4bd114e52168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139616, "uuid": "b9a1b7c1-90af-403f-95e7-01574083d9a6", "value": "b823dec3eeae35906a95d69d3c39ce07fe3155f2c8d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f891da1-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186508, "uuid": "ea937f86-3672-44ec-83c0-896cb855714d", "comment": "Malware payload", "value": "5eaad0f9e934ea3d7ed20167d7943e1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186508, "uuid": "373c248b-230c-4d05-98df-6659d82f9ad0", "comment": "Malware payload", "value": "b8d78d7d6b07233f612c3be214333d60ca7e86db63bf5e4d860d11b947cbb788", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186508, "uuid": "66a9516b-874d-41be-a36f-6b73881ab304", "comment": "Malware payload", "value": "d7731bedf166f19843bd1bd70251426883e63050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186508, "uuid": "a132e931-cc11-4ae8-8481-5de1ff86e8c8", "comment": "Malware payload", "value": "9727bc175099153336f6ab9c3d70d4682c01f0d32afb164c6d4c2f0d945da08e83ab3d5ff9beacd9c4735df3588885f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186508, "uuid": "b2cebb4d-1edd-4977-b386-28dc4d1448a4", "value": "T13E93D593FC01EF6BF40BA77644E34815B530BFA60EA25A767213789B9D3A0D51823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186508, "uuid": "d76e9f32-fc77-4014-b720-74c1251e9542", "value": "1536:AcpLOIVa0aIh8FuX2W4Wsyf0/zH1B3fc+iDwy8RAl0:AcpyqaId+WFMXxiDwy8RAl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186508, "uuid": "d71edf35-61cb-479e-8070-e167370b9e99", "value": 89492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186508, "uuid": "4be5b31f-4d26-42c8-a586-3abf7613443a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186508, "uuid": "5325bf0b-2ffd-4038-936d-d7f3dd7b9589", "value": "5eaad0f9e934ea3d7ed20167d7943e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f44d0c-9fb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703131244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131244, "uuid": "ec84a303-5813-4b98-be62-70c8bd3e3892", "comment": "Malware payload (LummaStealer)", "value": "82fca540e2348eaf0f7c70992ac6c98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131244, "uuid": "3dacb525-68cb-4941-ad8a-4c6b2b7355ca", "comment": "Malware payload (LummaStealer)", "value": "ba67c24a22b57b646340c7355e30b1f9f837f472fdb3b701fc0ae10cbc176304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131244, "uuid": "e58cf424-6648-4d3e-9d02-a822e44c196a", "comment": "Malware payload (LummaStealer)", "value": "d3d3862992a003ab31a2776d89d563f9527f7bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703131244, "uuid": "97a9a82d-1ab1-49e0-8c42-3e12339da9cc", "comment": "Malware payload (LummaStealer)", "value": "82300d4392062699b0c1fe76e1d4c5ff839cddf61aebe83f574b3c69d23a0a0d6e0109310fb0eb6cf84c4866b1e0112e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131244, "uuid": "e46e8abf-7ecb-4030-ae03-61b6a0bc710d", "value": "T175343B2392F17D90FA62CB729E2ECAE8769EF5504F1977EB12588A1B04B11F2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131244, "uuid": "d6e72d68-4101-4b35-b31d-fcbe8d4ff3ee", "value": "9138bad961b0c12306fd188b3eb186f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131244, "uuid": "fd564510-dc31-4d00-8a88-e0bed76f0301", "value": "3072:56wWDWLCLYz3NqXPICBhHh4e1vEsM6cAKohevmiMRFfo4aMKwX7jA:MlDWLJrIXPICj+e18OcAKXmJg4CSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703131244, "uuid": "11ef409f-821b-4284-88ba-459b25e5ff91", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703131244, "uuid": "822ca583-ec88-489c-b352-3fe9c27bd8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703131244, "uuid": "de7bed18-2839-4557-b72d-a03876bcb9aa", "value": "82fca540e2348eaf0f7c70992ac6c98a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3425e182-9fff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703162893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703162893, "uuid": "2bc171b9-7efd-4247-842b-8ee8e09e8771", "comment": "Malware payload", "value": "798450a4b3d1894ed3b08738bb6dc048", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DragonEgg", "colour": "#F15BF8", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703162893, "uuid": "94494a98-5b6c-4c77-8342-50a42d01bd04", "comment": "Malware payload", "value": "bace120bf24d8c6cfbb2c8bfeed1365112297740e2a71a02ea2877f5ffc6b325", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DragonEgg", "colour": "#F15BF8", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703162893, "uuid": "f05ae7c4-3baf-412c-a689-b87db81e6cce", "comment": "Malware payload", "value": "a2a76990b7ff226191429842e1fd569a2e65868e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DragonEgg", "colour": "#F15BF8", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703162893, "uuid": "329b74c3-8feb-45c3-bfdb-d64c1e138ccc", "comment": "Malware payload", "value": "1031b1c79149cb7c73990a297f94a274132148b6b16a9db7684a03b8959cd211d307802014aab487b0d50a13d4af3e05", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DragonEgg", "colour": "#F15BF8", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703162893, "uuid": "f66f302f-524d-4d35-b62e-431e543540da", "value": "T148C4232FDE304EF47B33E45A6E82631C6200935310A4850EA6FB12E7569579CAEFBDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703162893, "uuid": "3b241d3b-36ad-4766-9e53-bd0feb3ce1d8", "value": "12288:GT+KyYPam+OycsM7FJD2lpgkQSfQ76JqHC:NYPamfyO7FcQ2yC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703162893, "uuid": "62938d1b-945b-47b5-9236-ff282ad69dbf", "value": 565067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703162893, "uuid": "1ba1c929-883d-4be0-ae8d-64b46a9585de", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703162893, "uuid": "8f51f546-23c9-4839-a0e1-9ee11c755627", "value": "b16a1f673fb9e38f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af116dd-a01e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703176299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176299, "uuid": "80da1e39-79e1-4f74-83aa-6f71c58731e8", "comment": "Malware payload (LummaStealer)", "value": "452aafe6693efd4b8f1ba2dd6c92b2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176299, "uuid": "e8bf86f0-ac5e-4efc-9858-2c3e9d05b158", "comment": "Malware payload (LummaStealer)", "value": "bad46fcc2c912fde112f0fa9b432c0a80a91e55337982b2ef2628680e0270551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176299, "uuid": "2ff20bf5-b949-41c1-8f2a-70e08a5aa341", "comment": "Malware payload (LummaStealer)", "value": "91a1beb90d25aab6f060ac65116817f468bbd146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176299, "uuid": "ea36cfdc-f96e-43aa-bf05-8add3b1b86c6", "comment": "Malware payload (LummaStealer)", "value": "af2871c88ecdedab4befb397a62a7df19c7bef8b864b83829a0347589bd8f9ab61271268fd4f5d29ba412ca15e2fe688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176299, "uuid": "188123fe-60b9-47c3-9a83-fb682ed15aec", "value": "T164343A4356E0BD51EA624B738E2EC6E8B61EF5D0DF4977A712189A9F4CB01B2C173312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176299, "uuid": "69b1a7c6-3b05-47fb-9cde-67ca35f9a3af", "value": "21a899cb2bf7f1bc566f7c47e1443114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176299, "uuid": "aac5334c-d2c1-4b9d-87d4-d62c4ba6610a", "value": "3072:2uozML1f2d74AH+YdTmIUw+C2sYkH2R1AmTdNYV2Bk:8zML8FvH2IlYsYfLpNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703176299, "uuid": "90ce4e15-ee90-4d3e-8cf6-68139271d8d0", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703176299, "uuid": "8d30eb24-cbe1-41a2-bfc7-92de56850960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176299, "uuid": "a7207a0d-0c57-4757-a695-5883f037d3e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7457734-a020-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703177394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177394, "uuid": "925af8ac-1ec7-49ad-b8bb-d20fd9682a03", "comment": "Malware payload (Formbook)", "value": "6b62c056b88c03cadf04a8dc8e14afcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177394, "uuid": "6a18c5c4-990a-405d-8585-8f70497c7495", "comment": "Malware payload (Formbook)", "value": "bbc3bc8711fe893a142aadbfb50fcabefc91dd640f1a22b370246ad56c3c02f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177394, "uuid": "4bb71cc2-7017-4393-9cee-fb64974bd285", "comment": "Malware payload (Formbook)", "value": "616069a317ec41578ddf38afcf54ed7e77ed67d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177394, "uuid": "4c1fe76f-c756-4fc7-a220-209efada03fb", "comment": "Malware payload (Formbook)", "value": "4b9a152ea0baa611d3b69fa86fc50e2fd70b81c6887989eb9581a7a83dd1ea712ba70c8e1fccdef9e8198f49a24c74f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177394, "uuid": "bcfd530b-274d-43d4-aef3-b66edd9c7757", "value": "T1E453083CEBD84A22DFBE47BCA9650100C7345453EC23DF6B754C899969A3F9886163CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177394, "uuid": "bea9e400-d20a-42ef-a251-9c2428fdd9bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177394, "uuid": "8d4ab211-c75b-4118-a1b1-44e105e1e7ac", "value": "1536:57QTSKiqSjotgX5elvEHyaix1ApBNfNtX:5SEoO5elveyDAtNtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177394, "uuid": "ff85d5f7-17c3-43a9-add0-6df70ebbb826", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177394, "uuid": "851d3664-80ae-45cf-90c0-3425628b19af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177394, "uuid": "dca8c3f9-75c4-42a1-816b-aaff57a66efa", "value": "z67dhlreceipt.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7007bad8-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703182750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182750, "uuid": "2740e907-9891-4a5f-b4a5-ab467fc2601d", "comment": "Malware payload", "value": "de82b55048a968912775ee385ca599e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182750, "uuid": "7f57fd74-626b-45ed-ad25-7625ec67d42c", "comment": "Malware payload", "value": "bd0402fdf41ed33a42f7d0a8cb170952528788b454079040269b77bd82969b94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182750, "uuid": "63aee029-b9e6-4c83-8cb9-203397062fe4", "comment": "Malware payload", "value": "d91950ee32268e9f74feca1cc15e55497e31622a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182750, "uuid": "840c0a86-23d4-4760-add5-e9f64ea62dac", "comment": "Malware payload", "value": "c08e846b6b6f91b812fee7f6a103ada9ae8da698e2582c7a410c97d774c08cb100f9b9826b33468684a0d513ae0ac7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182750, "uuid": "84754919-9cad-4f23-8498-6ebcd8be404d", "value": "T14A249D1271E0C4BAD35F43314F53ABB9B3F8E5108FA1CA8B6B50CF1E5D765429A26236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182750, "uuid": "2b2b71b9-5de5-4bb2-bd9c-92dd8bdf392d", "value": "3072:a5VzX1jWM8Tr6Gy5R9ba4/qge6OyjywOVkTkjEo0QDr6YoPNH34PJdLy:azFYTr6Gsrba5vZmT2cZWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182750, "uuid": "ef88522c-8078-4bdf-8d69-5aeebd9bf3f1", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182750, "uuid": "57f300fc-5428-4b5a-a7cc-e047ba628e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182750, "uuid": "5848b4d1-c0cf-4c2f-af1c-877144337b37", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.3987.23700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d3b7fb-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703135143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135143, "uuid": "51f54eda-0530-4450-ab19-190a11504cbf", "comment": "Malware payload (Socks5Systemz)", "value": "ba9caf6dc168d6a77ee11527e5ff8c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135143, "uuid": "90e70a54-e71f-4e99-95f9-e487b7dd5d01", "comment": "Malware payload (Socks5Systemz)", "value": "bee77f316029edf4bafe843e3124a3c5cc6ad6f5ef6f5a572631536179692e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135143, "uuid": "32d26583-0347-4d7e-87e6-e949c914893d", "comment": "Malware payload (Socks5Systemz)", "value": "550d0974c7b090b35e6349efaad96a754bada812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135143, "uuid": "60094e64-bc76-4b1d-b326-a0cbcdf617f5", "comment": "Malware payload (Socks5Systemz)", "value": "41d6c68e68bff1acf4c41418e61277cbe77b056d96269c809a59c5cd11a38012e74fa732514b1680c774f30351be153f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135143, "uuid": "6d9c4fed-42cf-43fd-bfb6-64b5b3cdc261", "value": "T1CB86330E47B994B6E001D972ED95B860A1F53F6C4B308506F4F327D86A0A1F9FB2E359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135143, "uuid": "268c8b6f-31d1-41b5-a563-e07d6d879630", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135143, "uuid": "f57b174a-57f1-4754-9b58-9666ad723389", "value": "196608:F5Jt3tU2ZusmIosfUoGdzR08sgDYwjf+F5n0kxmRF:PtGdIoscoGdzRBsuVUn0kxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135143, "uuid": "63da5682-ad9b-4750-994a-1756dd72bb2a", "value": 8454256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135143, "uuid": "f74b3a08-898a-43ae-a0d1-bc350d112dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135143, "uuid": "68ef5dd3-b273-4c39-84c9-069e3faac671", "value": "tuc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5740d179-a010-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703170253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170253, "uuid": "7a646191-2fc4-4aeb-82bc-63ab3d92a7ce", "comment": "Malware payload (AgentTesla)", "value": "b78d72ed6be4292cf4ed39e4bddddcb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170253, "uuid": "59726bc1-593d-436f-8979-15ef4a89fa42", "comment": "Malware payload (AgentTesla)", "value": "c16267ded4f66e4d26b6bbced4e08185bb3237e48e4f8804c344aa5be5232162", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170253, "uuid": "1e2e8f7a-9f36-4ae0-b80e-7355106c40b2", "comment": "Malware payload (AgentTesla)", "value": "962748071e475dbd989964088242c54ce11022bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703170253, "uuid": "c2d471f9-6a4b-4d3b-aa88-d525a95bdfb3", "comment": "Malware payload (AgentTesla)", "value": "e373733265bc471bfa236afd79fae414a75e110586177f19fb86105a77668ad8673b54ab662e19ae0625a56037f07474", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170253, "uuid": "f252dba7-af9b-44d0-a70c-4ee32131a39c", "value": "T1987413B737D54873DC692E721D3AD2A3E3B6F45102B0924F8BE46EE928325D25E09317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170253, "uuid": "b0af574e-b410-470e-840c-68270282af1c", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170253, "uuid": "b19d2576-6466-4e0b-b44c-e93ee6f1ad2c", "value": "6144:bhjmi39RSA+ey1dayvd3GUoLvHlZgu365T80az1pt2cz60+eLuGmiVQX:RDD3yl9jopZg+qT8lzlLzSeLuGZVQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703170253, "uuid": "6afd0921-c6af-4678-b5c6-281d3a1a8a61", "value": 347203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703170253, "uuid": "75406c54-62ea-4ad2-8846-9e6074985d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703170253, "uuid": "0286b6e8-0b46-4af9-bbeb-1d1fca87a1c1", "value": "SHPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ad62ee-a026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1703179836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179836, "uuid": "ba00e2a1-33fd-4fd4-a23e-3ee0f0648b7c", "comment": "Malware payload (CobaltStrike)", "value": "ea6ee6d944ff0d8b4273390a6df271c3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179836, "uuid": "478c28bd-2466-4537-8e85-d4c5d1efcbdf", "comment": "Malware payload (CobaltStrike)", "value": "c3ced1364cb7976f9665cdc06cb2dc52d5f776a9461889d634e4327d9b6e1154", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179836, "uuid": "6df4692f-d113-4fab-8afc-437fe7362d0f", "comment": "Malware payload (CobaltStrike)", "value": "1bed8733b9a65e35732f1a124e903cdbf1436bb0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179836, "uuid": "969947ca-0b4f-4918-aff5-17a2e7a45358", "comment": "Malware payload (CobaltStrike)", "value": "8f0d5433ec1d59da05a3b3e4342edcf47b5e494d3db5c1deff7c012d206df877c12f56a7f594c9e27d2c97f758f408e6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179836, "uuid": "fd10db1b-8df3-41ea-bafa-234e2fbefba4", "value": "T138F73323C5D3E726D7D9082BF014C8502D06E3D7677CA6FBA195E74ABE64A43403A9E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179836, "uuid": "ef7f18a2-5cb8-48c2-ada5-ffd1e680b123", "value": "1572864:QsbsWQjRd09OOjrO2qlpZHkPE10Kz/MZ8gnbtWQ/vpqc50Pi6Ja:9adzSPE1H7MZ8Ch7dca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179836, "uuid": "cd64513b-7e76-4799-8a78-e8a77916ca6f", "value": 72339513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179836, "uuid": "198e9347-f7fa-41ed-b9cf-4e19d33140e0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179836, "uuid": "b48eaad4-a61a-4c3d-a53a-184f8965c3f3", "value": "dl91uj.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faff004d-a008-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703167092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167092, "uuid": "753aaeb0-8e8d-4a86-b595-82f36bfe5bfa", "comment": "Malware payload (AgentTesla)", "value": "c549a0971e4eebbbd9b32924f0b008c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167092, "uuid": "5d6439fd-5c93-46ec-8add-8ac95525c93f", "comment": "Malware payload (AgentTesla)", "value": "c41e5a2be9fdf6f3a7b24f969f13e92b2bd141be0b1ec6ff23f4afe20bba146c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167092, "uuid": "20d145f5-351a-415b-95e3-3a1db918a238", "comment": "Malware payload (AgentTesla)", "value": "f3fe367696edf82ed9519f4d4036be3b8aaa29dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167092, "uuid": "9c34ca25-63cb-4f93-98dd-e89acadb733b", "comment": "Malware payload (AgentTesla)", "value": "d82a9410aa11816c08606d72e316fb5cf6c10473af3085befdfecfc07ce3c7f6bac3501b13cd912ac30c0aef07fa5271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167092, "uuid": "d8ca972f-40d2-4d23-a049-882f8726e4d4", "value": "T1CAE42284729CA153E6FEA77B2A3071444F7562066930E7899CC526FE1EB3360C7A3793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167092, "uuid": "88c687f4-196d-4f26-b793-04b52cc9a5ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167092, "uuid": "bc361ee5-b2bc-4475-86ee-edf76f51730d", "value": "12288:52Vj8tvQ8FkLCo4oXPVEfLuwTNngCx11fUUSTRkOtUxFVnP+gqecWSBrs5gm63LC:XRq9Jqb3sUFbRnPxcWGx/o/L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703167092, "uuid": "c40e50bd-4266-4a7f-a632-a4b670e5c24b", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703167092, "uuid": "9759d7fb-e368-41b4-8977-ffd84520f2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167092, "uuid": "168a4fa7-1677-418a-be18-b99351eb1139", "value": "sa1NCD4GPQTxXBu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed50d65-9fb0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703129115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129115, "uuid": "dab0da46-12d8-46fa-9583-8f58e90a397b", "comment": "Malware payload (RedLineStealer)", "value": "e5bde3dc518cf8452ac1deb0d2199f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129115, "uuid": "ac9dad93-1ba5-4db4-93e4-1b94893c8c3f", "comment": "Malware payload (RedLineStealer)", "value": "c4bd0f87b3c59809e8e3bf1f415ac8ab547da53609e36e3c97dd73c8e502c17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129115, "uuid": "a2c69f54-eb1c-4965-8eff-78313835ac00", "comment": "Malware payload (RedLineStealer)", "value": "5b06f1a0d4f446944a54e28ef7e272f209970261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703129115, "uuid": "d7673a7d-211d-4bc1-a477-6c848e8fcc96", "comment": "Malware payload (RedLineStealer)", "value": "ce6c12c1cef6402b35db9c9b5b3e71c71f0ea980c2bb81b72d1711cef3589d198d7204fa83d190cf2c6767e8589beb08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129115, "uuid": "c7bb891a-9136-4704-8566-2c0a57bc1cb7", "value": "T1BC5633C3DFD8D4D3DDAE1378087207232D36B964C1E1E2B5AE996D4E1D71BE4A82025B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129115, "uuid": "8f207818-fa40-4b5c-95fa-934f42c77925", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129115, "uuid": "db621a44-c667-4a2c-9990-c15f6e0053c8", "value": "196608:HjmUC+Kqp11bx5BX6o8aVcSNwZrPoZNPlDXaR:HbDPT5J357NtDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703129115, "uuid": "4f96f1f1-1a31-4d09-86d1-aefbb99a651c", "value": 6425600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703129115, "uuid": "5187166e-4cee-462e-a95d-655636bb5309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703129115, "uuid": "ab6e6262-2707-4817-a2a4-9c452552950f", "value": "e5bde3dc518cf8452ac1deb0d2199f75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84781a75-a050-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703197817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197817, "uuid": "1ba9fcc9-6f84-4077-b124-f89f03b44558", "comment": "Malware payload", "value": "7dc7f5b9d7b418a4b3e000af3a2de79a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197817, "uuid": "46f04f5a-2744-4fdc-8375-748494aafd33", "comment": "Malware payload", "value": "c5807fae35427cbb7d668c2ed82c7d607e63b27404be53fa0dd372664ae285d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197817, "uuid": "7ffccd28-496b-48c2-ac8e-09d6156e4c70", "comment": "Malware payload", "value": "d0ec6ccc01bfa43feed3f2a41ab02e199fd944fb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197817, "uuid": "68b35a33-46d7-496f-b8be-6307bece5a54", "comment": "Malware payload", "value": "895ca5c0b1d5291905a35081c20fcf3dce63d53af9d793df35def763930764bc8f8e02b2ad182dc9d470ac65ed1aae04", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197817, "uuid": "1bea42dd-b09c-41ff-88b3-068f9fc8c9a4", "value": "T1EB23022109DEAB65F2CCD1B2A356EFF51ACE1BA4B7486D45726A9B047732407CF34C28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197817, "uuid": "44bbd851-b697-4bed-8ff6-ef9dadd55c00", "value": "768:YUFkZPPneQEAaWLRe/TccF9bcIsfZkE+F9p5FtcflRjCWZ9lL3BOg5QHn5Vl3h:JFkZneQEAaWcbrF9nE+bLSCulZ2ZL3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703197817, "uuid": "3d067bca-1766-4651-a4c9-a9d1b0e5b8ad", "value": 45719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703197817, "uuid": "046b4884-f231-4519-9e23-b18ae161c43f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197817, "uuid": "702d00e7-75ab-4bfe-9cc3-48d2513e8bf9", "value": "ZPQDL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65eefb3e-9ff8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703159970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159970, "uuid": "01da1669-2d70-4b0c-a44a-c5667052fbc5", "comment": "Malware payload", "value": "4e8fd1e0dd4104e7b8559e95a07aff7b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159970, "uuid": "7edb78d2-58b9-4825-a05b-cb27fee6355e", "comment": "Malware payload", "value": "c7d33e3c50e2cec2280ce4dea79c278bc951cf942a490f973b80bb804f69563c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159970, "uuid": "2a9412f9-6192-46ec-aead-655ce4d1184d", "comment": "Malware payload", "value": "fb60a629bd132976c1d3c7b82ab4ec6c84040d9e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703159970, "uuid": "5862b60c-43dd-46dc-a6ca-189de5a2dc13", "comment": "Malware payload", "value": "e583b6d7cfda7a5b3b4b61f84f0ba6eb88a5692ae91177e6d7780015f4735a4f4547ee0cda5fd318f52dd18b16df4cd6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703159970, "uuid": "bb726a56-28ee-4eaf-aaa9-e9de8c249362", "value": "T19B9312FE5445D62DAFC389AC10E4F54DEBB1BB2688F54123900F62B44C94C7AB361B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703159970, "uuid": "3c9bfce6-5829-433a-a879-202f887c3472", "value": "1536:E9S/ZpLd8i2MappnHAvmQorVDy3qwEifYZXptjgShlG80acGdC5+TY7eVWWs5:E9QH2i2nHACrA3qqfW3G80aEl7eVWZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703159970, "uuid": "0846ba6e-2f56-47fd-a842-fe19779cf61d", "value": 93912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703159970, "uuid": "21244881-1ff9-43bf-b3b0-39978b60ed16", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703159970, "uuid": "57d17a76-5aec-4463-95c0-3f2294e6b00d", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd1f169-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1703128868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128868, "uuid": "90844d48-b31d-4a4a-9307-7dca03654103", "comment": "Malware payload (PureCrypter)", "value": "2c8bf6e42f2195c8256d91f5007a1219", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128868, "uuid": "776143e3-9048-443e-80fc-fbefbbe1c317", "comment": "Malware payload (PureCrypter)", "value": "c83802e36a693b7ec24c23b175516c136a2938218b3543e11c372bcd1dba9b2d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128868, "uuid": "228a84df-e3e5-4f5c-ba0e-a49af3a7f2d0", "comment": "Malware payload (PureCrypter)", "value": "8522f1970144b3bee059df28d7be6d9b07208b51", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128868, "uuid": "a76f2183-4a7d-41e2-8ee5-92e034b2d927", "comment": "Malware payload (PureCrypter)", "value": "9f0411cddba8d7bacbb14f08b96da7393d1b393df326288fa9e9c9aed11a0af063c35ffa411f8ef6533f4675b8b52afa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128868, "uuid": "8f159310-eb25-4e56-9608-c318919f96df", "value": "T128F21907F6CA6170C6198B3EDB6788100366E6D2F5D3CB89794F23C71C137AAD95268B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128868, "uuid": "7875be74-5619-4e32-af71-47a4177ed949", "value": "768:PjUfEiPI3jm+jwCvLCvn09DGVHvlYdbp8q89BQ43ZJDO5iUPmsVP:AciIjmQdSJDeiymS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128868, "uuid": "c50449f0-c341-43a9-9b1d-c0e3b30cefd0", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128868, "uuid": "989ec52a-30e7-4c1b-8a09-d904d3f4fe02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128868, "uuid": "f0ed55e4-caea-4e28-8e0e-bc7bbec0d866", "value": "2c8bf6e42f2195c8256d91f5007a1219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a62bdf-9fd5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703144803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144803, "uuid": "2b52f286-8575-4a8d-819b-2e4c21bce5db", "comment": "Malware payload (AveMariaRAT)", "value": "68a8a5d1e13366a2d5ab89f4122e2a67", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144803, "uuid": "baa9ab10-4ab9-41bd-b78c-e06e0f61ec29", "comment": "Malware payload (AveMariaRAT)", "value": "c8731f7db8cff30881c306796850704a66edb90501fad4952822bb09624db618", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144803, "uuid": "8a7832e9-06c5-4e0e-a8ac-7941fdf425c9", "comment": "Malware payload (AveMariaRAT)", "value": "3fb3a263cac3f6c1a6070554a734b428e15c987a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144803, "uuid": "5587f164-eef9-434a-a389-c54bb34e7ccb", "comment": "Malware payload (AveMariaRAT)", "value": "06261988382cb9eaa010f4c9f9877f5f23681a5b4877d85071a4256169d3fc40362727601df209f5653983a4c4a16bdf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144803, "uuid": "d673cdca-fd37-4786-8350-6e1d3b7e087a", "value": "T140C4F1343ABD520AC57A4BB91D7596C113BA3AAA7F05CB5D2C44168CDC337238B11EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144803, "uuid": "7703a62f-8c6c-4fe7-a354-cd6a6ea143fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144803, "uuid": "04bab61b-bc6f-4602-8a13-39eb2f282d17", "value": "12288:w0x7M9TZLmfTcC6lu91N3z6XfEc7aaUoLX+LG27W:5kZETcC6YDj4+M+LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144803, "uuid": "8c983303-5188-4fce-a700-1ab22b87947d", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144803, "uuid": "e62a4720-1452-4d53-b7b1-46c89bbdb88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144803, "uuid": "6d7ae4cf-6380-4609-95fb-a1b0f4b67d6c", "value": "PO53623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e28979f-a02f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703183526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183526, "uuid": "192123a7-1293-497d-8023-ca0046b8eac5", "comment": "Malware payload (Formbook)", "value": "ad2ed33da195ad7c3f02b5cc56eaf334", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183526, "uuid": "dafeb97f-0f80-44ef-ad47-cbc6ad05132b", "comment": "Malware payload (Formbook)", "value": "c8a269e7d3f84d8fbc35285d9c0d4c8fbbd4200e8a6fcf7f6e492c3749073c70", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183526, "uuid": "ee07d3eb-1da1-4977-a858-6bbaf85650b3", "comment": "Malware payload (Formbook)", "value": "2cbe0dd0876ca4ec07f631a7e64939b362d33a71", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183526, "uuid": "90668739-ad87-41ee-a09c-73d137a3bf71", "comment": "Malware payload (Formbook)", "value": "01b956af82e0e2fc413388ecb3b85b9a4e8188eaef3f32f9649db974ccf7f15d1cb13c90269d8a89a631dbf57248064e", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183526, "uuid": "78f98955-3462-412c-8d2b-29853341a5f9", "value": "T1BB034C047BA44626D6FF7FB56CB2510542B1E907E913EB6E0CE495EB2F27A804B403E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183526, "uuid": "7ddfcba1-1f49-4792-9101-4f640af56048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183526, "uuid": "69dfe100-6e4b-4d16-8868-11654f2f2a02", "value": "768:xhY8/gSBkIqznfexlKirTtjwylp+24DYZ8ZV8CFY9ntdOYhCDV02J:xuJUGaLwlZ/FY9nrOYwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703183526, "uuid": "f9a23447-5dcc-4181-9c41-8741dacd3c98", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703183526, "uuid": "9ed34382-a0fa-47bb-a281-ad1ce0ddea2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183526, "uuid": "5930319d-fe2a-4baf-b310-1646c9bc1708", "value": "1703183524026706b46d7506efa093a567e789710849bb2bc95169c539f56f203094b272de920.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2fc859-9fd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1703143205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143205, "uuid": "1484f731-a4c8-4064-9de9-3cbcfd41f4e2", "comment": "Malware payload (njrat)", "value": "b9f6511e03f2f4fa61d4fdb1964cae4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143205, "uuid": "89a69342-084f-4c19-8d73-acc5b0921f55", "comment": "Malware payload (njrat)", "value": "c93ab6bb562f09706d141a4804e655fe92612a07bc3ab92bf1f6f7a7a9ef9dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143205, "uuid": "77599db9-2699-4f29-87cd-0aea2f5b77a9", "comment": "Malware payload (njrat)", "value": "ba42aa852a48f5449abd9c66f8a1d909a5c01618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143205, "uuid": "f6a53518-14ae-4c11-837e-f6311fb76497", "comment": "Malware payload (njrat)", "value": "5b2a353ec7c061606d0deef00ae9ffd85fb18923fe8fe9bb8482f50a4a8dd4701d6af9fafb9ab35b314469ca6018ab0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143205, "uuid": "db9aebbf-c087-426a-8b3b-f3417bae65ce", "value": "T1C693C84977E52524E1BF56F79871F2014F34B44B1602E39E48F219AA1A33AC44F86FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143205, "uuid": "84031dd8-fd91-4728-9a6d-9bb54bbffd38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143205, "uuid": "a68648bd-6d0d-4596-a2ce-4687859edf1f", "value": "1536:yUb0MVHnHyLgq8srvwSljEwzGi1dDLDlgS:yUdHnHyLgqzrwSSi1d7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703143205, "uuid": "fb2038a5-2d5a-45db-8009-467f9402b236", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703143205, "uuid": "4e49be36-a8b8-4f2c-bc8a-106ec94da213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143205, "uuid": "057931e5-7bfe-4b11-b7ef-ab9cbe41849f", "value": "b9f6511e03f2f4fa61d4fdb1964cae4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7927be-a027-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703180359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180359, "uuid": "a5fd308e-448c-448a-a885-2045ee72db1f", "comment": "Malware payload (Mirai)", "value": "b757694e98b44b2a21e5654c92c98826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180359, "uuid": "66ebe170-a926-466a-aa1c-a22fcb26a73d", "comment": "Malware payload (Mirai)", "value": "ce192327b8b13edbe3fd6b37c42b16bb0dc59951379fc25b8f6d92ed64e8cc84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180359, "uuid": "2e7fb589-05ee-4786-a9f7-723588eefafa", "comment": "Malware payload (Mirai)", "value": "9cb9a03cc21badd27f13ad7a09d44bb1bfb380a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703180359, "uuid": "acc4fa04-c1d7-425e-8fea-6624e65d883e", "comment": "Malware payload (Mirai)", "value": "21871644e388a7d5b06fadc2399c83658637bb5e4aa2585424d2d77bc137e021fda4d9104f39c4eb0e62f7b7a6b6b77d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180359, "uuid": "5d6d3bd7-0218-42df-a962-c7d50e57a18f", "value": "T184435931E9790E17C0D4B57B52F78629B2F5174E25A88B1E7C220F8EFF159C0216B2B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180359, "uuid": "e775f134-be55-48d1-90c2-eb28b82cb238", "value": "768:Q375eDpM0jowQa5LuYRqXPFbFP+sv23O+Nv/aNSGv:acDpM0jDQa5LuYoXPMr03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703180359, "uuid": "02108255-e3fe-4ec4-91e2-74da00058d5e", "value": 55188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703180359, "uuid": "1f643ba9-7820-4d3a-9280-8e0c6c71d373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703180359, "uuid": "d1eafdab-3628-4168-a65a-d43312963033", "value": "b757694e98b44b2a21e5654c92c98826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e6e763-a018-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1703173628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173628, "uuid": "de6ba368-649c-4fdb-bd59-b38882d36f37", "comment": "Malware payload (Stop)", "value": "bd7beb7562fbbb5d6a7773f879389d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173628, "uuid": "b2b5e147-b937-4eb4-9e1d-fbefff4c0bdb", "comment": "Malware payload (Stop)", "value": "cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173628, "uuid": "3dfff3a0-f4b4-41e5-9b3a-deefd421371f", "comment": "Malware payload (Stop)", "value": "993ad0a915e475bafb3833b61a36818481dd55aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173628, "uuid": "d151b0ab-0952-4a6b-9472-d6e089ba2e06", "comment": "Malware payload (Stop)", "value": "cbd72f18ce78bd0de2e044b2e12d60783a6f1f75afaa764372b1e3e970eff5796abab1bd6a460a1403d361cd9c610e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173628, "uuid": "f682c45c-9a60-4740-a3ec-c7856616a48a", "value": "T10105022152E0F470D1278A329E2AC7EC6A3DF8E09F557A9F27981A3F1E761E1C171319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173628, "uuid": "f8ddca09-a64b-4ada-a6d5-e280a2d19c64", "value": "2f42c7240ce091676db27467fe8eb2d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173628, "uuid": "cb27407a-b688-4955-b16e-d757f3986e73", "value": "12288:x1lw2NU9n4c7lB5P5ZQwshmMs5OR2aX+975V3BOh6Z5EGyjShHT0q78nDHrJ:x1lwxD7TzZQHmR5OR2aXgrRqj6HTh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703173628, "uuid": "c362d985-1c12-4b8e-bfc0-6f42c31b9ad8", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703173628, "uuid": "a8e6c27e-ef4e-4065-886b-d31ec441476d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173628, "uuid": "ad0b5e1f-4cef-4037-90b2-259facef255c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508df8b2-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169383, "uuid": "f58ee2dc-4a02-4f6b-bafd-3e7a2c205550", "comment": "Malware payload", "value": "929b06d7a3e68bd33cff225922d7b7ba", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169383, "uuid": "df6630e5-5ec0-462c-a84e-a24610099ac9", "comment": "Malware payload", "value": "d25f4cece4b41281073f8ba183788f4c088839661144dfd2452f53880c588fb9", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169383, "uuid": "d5b7a3ce-439e-4b70-be6e-98e1ae499d5f", "comment": "Malware payload", "value": "5f104c75cc9201846967cae30f377d51f5ac0789", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169383, "uuid": "71c8d516-fe94-4560-b925-68c0939c9153", "comment": "Malware payload", "value": "82ff24d1402f94352b33342ed1f45120a92e642a600050e3352df1cffec363a37525f9048e53c642ec889aad12b84d67", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169383, "uuid": "e964d380-d5d5-4bb3-be84-5c7beafa8f92", "value": "T1040501F800C63CCD9FFDB47BDC9D6A28865E05C07942679231C288065A65EEDC2EB5DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169383, "uuid": "3de01d0c-ddd6-4ccd-abb5-6d182302c254", "value": "24576:I+Pc6hTvFcSHI+yQnuphBWMPMVL/hNSWM:IN6hrFc8IhVHZMVL/3SWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169383, "uuid": "d6ecfe21-2386-4f9b-a153-61b79c7e3992", "value": 828932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169383, "uuid": "3e475dcb-6ba3-48ce-b23e-c4ea81b7625a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169383, "uuid": "e2409801-f31e-4b2e-a303-310769daf472", "value": "file191223.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eead908e-9fd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703144738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144738, "uuid": "b6c4ef31-2c81-4093-82ff-89ee25ba1aed", "comment": "Malware payload (Formbook)", "value": "2540d98102638628570a2ceec5038857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144738, "uuid": "ff648f7f-08f4-42a6-95bf-e98b477b6f23", "comment": "Malware payload (Formbook)", "value": "d288f0d2427b64314285c3b5728e0f415ab99015debea9107737e1b72893243b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144738, "uuid": "322dfa4c-17dc-4120-bdc9-d722cda4585e", "comment": "Malware payload (Formbook)", "value": "e3bb6401202d32b9dfa75cba7701ad45eaa97f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144738, "uuid": "025d33cd-2fa5-4fac-8fbc-42b880e976c6", "comment": "Malware payload (Formbook)", "value": "b95226383500825661a29ff392131ff6db06ccc2c26ca62404e80d6c154344498cb70d11368dc6682071720418174b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144738, "uuid": "39103dcd-c5b3-4357-a0b5-db5d16855684", "value": "T1D615053C58BE2A37C0B6D7A9CBE90567F050947B3A12EC2694D3839D4367A9379C321D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144738, "uuid": "1365ec2e-d815-459f-9438-146a270175a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144738, "uuid": "85695d6c-4d5e-4370-a77a-e778911f6754", "value": "12288:mqn6pMsDIll+mG6Hom4U4Y+AV8pzZjQcu3UQCoBWLo/AENe:m8ssl+mTHonU8bhQcgU3Rn4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144738, "uuid": "2b3c7330-6f0c-4184-a285-872f7eba4bba", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144738, "uuid": "1c5da7b2-a9c7-4829-8352-9161301381d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144738, "uuid": "651394a2-1afb-49cb-8d65-fdb466243b04", "value": "PARASWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3121be9-a00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703168367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168367, "uuid": "11bc2cc1-e606-43be-8fd6-c16bf292bd34", "comment": "Malware payload (AgentTesla)", "value": "a8fc51dd3cac8d1592f57011187465db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168367, "uuid": "c336ae1e-f686-4c76-958a-89725069e71d", "comment": "Malware payload (AgentTesla)", "value": "d2b54b2073cb0bbb794046ff67fbdc31b2cef38e1726134b64395144c4533ef8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168367, "uuid": "e5111a42-64d8-4d55-8b3d-d6499deee4f0", "comment": "Malware payload (AgentTesla)", "value": "8291f345cf06cb8e4701e726418ed4f924a14e64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168367, "uuid": "35b36be8-fd38-4f67-8227-b730aafe6062", "comment": "Malware payload (AgentTesla)", "value": "4b2e151fdea59a7a2b72ae451295eff4d377a9db344d0f6c8c70650e47bc7515976bc43d02e001eed2d8eeb52e6ffb7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168367, "uuid": "85327b68-8e76-4a2d-b12a-c013066ae443", "value": "T100E412113A7AE327E6AD03F7A061662587F1BA2F6131D75C1CE170C639E7B441E82B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168367, "uuid": "bd5e2d05-3c3b-47a7-a462-194142fe8366", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168367, "uuid": "cefb7f26-544b-45a0-a98b-942a4868891c", "value": "12288:eReMtvQ8FFNZqQamYxIwpMeUMPyYYCck/9SgPaIGzKJHHGZFx:1Y1Zq7HxIwpMcYCcO0gPaJoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703168367, "uuid": "118200fc-f8c1-4b9b-91e1-5dd7d7a7f309", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703168367, "uuid": "2850b718-ce8c-4823-93fe-c7c96d865870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168367, "uuid": "7cb3b6da-19a4-4a43-ae1a-b16e2d1a96d9", "value": "SecuriteInfo.com.Trojan.PackedNET.2511.21116.16165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058c68cd-9fd5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703144776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144776, "uuid": "14e026c1-d67d-4d1a-a2d8-998014a6e810", "comment": "Malware payload (AveMariaRAT)", "value": "7ce47dee0ef61a16d0811fbe451e02f2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144776, "uuid": "6bc4393d-d477-4809-911d-33b17798ec28", "comment": "Malware payload (AveMariaRAT)", "value": "d2d549d6dd5d017ce1b853932513ec389de11e6443fe466487b2ed2e1528b857", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144776, "uuid": "50f0cf42-5092-41ee-b6ea-f3219d6dc423", "comment": "Malware payload (AveMariaRAT)", "value": "3c7271b7ab2e80ef40be568d7cd4c36a2212ec64", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144776, "uuid": "8f2c8d90-238b-4888-bb70-bb2b6fa5188a", "comment": "Malware payload (AveMariaRAT)", "value": "8366979832ecf3bda7d65d31d76f6e29459878745efb507dd22f614d85d1e4d8e9a8d9e1e3d7ccc7697c16e14c8c6eb4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144776, "uuid": "1b939139-6914-433e-9a20-acb0e6f95a84", "value": "T155551212F6D2C4F1E67329364A39A720A57D7A205F34CE1F63D44E2D8A71281A635FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144776, "uuid": "4377334e-b564-4590-aa62-7e4c19868dee", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144776, "uuid": "59e8868e-1fa9-4699-be37-410d69d752fa", "value": "24576:jNA3R5drXq1lefVA9PtGzpO28YL58VVtDUYKRESDyXX:O5K0A91ip2HV74YKRcXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144776, "uuid": "7d78b9e4-83cc-469b-a6eb-00a795fc7bee", "value": 1308689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144776, "uuid": "524d5a7e-935f-41f0-89de-0dbe41831910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144776, "uuid": "95ca0969-6045-48ba-bbbe-980cc2d49627", "value": "Oden_PO2339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7b2eb4-a050-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703197827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197827, "uuid": "1383a7ba-91c7-48ea-b165-02b25eac06d2", "comment": "Malware payload", "value": "3f7068a385405afa46ef29bbe3ce9a21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197827, "uuid": "abb2a084-4d1b-4a7e-9808-402300ac0d6b", "comment": "Malware payload", "value": "d2de7c172246a6b32f00388c18a4b1ca2f44291a73d1115e85b3c1e37be48e6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197827, "uuid": "fc810e29-79e2-4d89-ae38-a69a9cecc34b", "comment": "Malware payload", "value": "e76cb90e4617b27fbc9751d0c119d722a04856b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703197827, "uuid": "02b90e35-afed-47a0-9c64-e76f7f4220eb", "comment": "Malware payload", "value": "b9898c6164e4f834b2b36fdd4e3377aedc36de22e41331124ddf2c907fec26dbd10ed48316b4bdbad9ddfd497b5b8895", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197827, "uuid": "5dfe0a24-edcb-491a-96e4-fa6852082400", "value": "T127F4DF2BF7F7C4E0D067093255A662759275BE346D118E0EB700EB7B36B89D8AE14323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197827, "uuid": "3efacf3a-d265-44ae-a728-6e2df1f961ce", "value": "7da7033f46ad588e405b1e8752abd4c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197827, "uuid": "59a53eae-889a-4cde-a0d5-75686595a2b7", "value": "12288:L88tpQmNwfp6/dNE2uIigUp+CQ/EAr06DggYmpEj7N904+G5ciTHMgxiQt1cb:Q8PQGwB6/IRgTEoDg6pEj7N94G5BTHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703197827, "uuid": "4ff218d0-410d-48a9-9952-9aa75153edaf", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703197827, "uuid": "51364efa-db7a-4a8e-ad62-8d2ef74a8167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703197827, "uuid": "5a4647f2-d838-4ae8-bb90-731e1d52148a", "value": "Wiflgodjvo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76afe7f-9faf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1703128861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128861, "uuid": "3373e2ca-44ba-41e8-928d-0a3e74dec4aa", "comment": "Malware payload (PureLogStealer)", "value": "0d2ba08917783332f6a5b7ac5fff6fda", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128861, "uuid": "0de4ac93-26be-424e-9fdf-8de2136de791", "comment": "Malware payload (PureLogStealer)", "value": "d7a2ae6d4c8ab5d13d4298334e9d95f82770ace62b3bb62cd683d3017f768da6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128861, "uuid": "8735312b-d056-4a93-9eb2-d1fca3210f21", "comment": "Malware payload (PureLogStealer)", "value": "226057cb1cfaea1660f72e63623d4f8329e6a06d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703128861, "uuid": "406b3a35-5184-44fe-a4ea-0ae603ee549c", "comment": "Malware payload (PureLogStealer)", "value": "3b9cff15230e862b2c4a5fa2f3dfdcb10c8b9367f68b75ebb25422510f404b75a86c226ce371e5b6436774f8f9e01e95", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128861, "uuid": "fd3dab4b-2894-4dfd-a118-383520a30079", "value": "T18F32B62063408690D651CE328D93DA440537FC17887EAB5937CC5E5F9F33F9A8522B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128861, "uuid": "1bd4bf60-284e-49dc-b3b1-e9f0c8092ea1", "value": "192:x8klVoREakd1CB1NeT63CNeT4+vDrjnXo:x8yVoREVw1NeRNek+vDHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703128861, "uuid": "e2a714b8-a51a-411b-8463-6be8a35321e8", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703128861, "uuid": "b2e50ccc-beaa-4bb6-a5f1-0c7b558ba1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703128861, "uuid": "f0744b5a-62a3-4875-8c31-2c5a9d556c58", "value": "0d2ba08917783332f6a5b7ac5fff6fda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472f664c-a021-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703177528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177528, "uuid": "18013060-dc5f-4659-be30-1c7fb70421df", "comment": "Malware payload (Socks5Systemz)", "value": "5bd7523614ed3ebe940d27e62edbe84d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177528, "uuid": "da97106d-cbd1-4aad-94af-9f311f7702ff", "comment": "Malware payload (Socks5Systemz)", "value": "d7c0c7650124d5fc3ceb01652ae9b3f54898797bdb77733333b80be530f44814", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177528, "uuid": "fb8ba3e8-4a9a-4a7c-a5f4-212c019765b5", "comment": "Malware payload (Socks5Systemz)", "value": "d26aac5d3b0a6ec83798dcc6fc6f20f5c7c3e837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177528, "uuid": "35fd4670-c9e2-4324-aeb3-fdf24b599f9b", "comment": "Malware payload (Socks5Systemz)", "value": "19887e7635c593f12ae560b53e1c3b6b7373cf003243b7e7aca29340f807f5412fc3fd23afdb7f49425e6bd0552c1739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177528, "uuid": "6ba8d8dd-afa9-4f6e-b068-2f0ad2377e15", "value": "T15D663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177528, "uuid": "d3a01ba6-9ef4-47a5-9958-41661065d485", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177528, "uuid": "d64fb270-4cab-4f19-a11f-aa7302697d8d", "value": "98304:y4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:th7teThPZidcKj8fPz6+4jb1KswNdDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177528, "uuid": "74abb9a1-72ec-4377-9fb7-6e37657921ce", "value": 7054359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177528, "uuid": "9d6aa1fc-0419-4aeb-991e-07dda44a8376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177528, "uuid": "556563b1-084f-4260-9081-b3c156249c5b", "value": "5bd7523614ed3ebe940d27e62edbe84d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d69cee-a018-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1703173950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173950, "uuid": "df0f7bd1-2433-4294-8c11-1d372cdee384", "comment": "Malware payload (RisePro)", "value": "7dacdea48c3b6ea1db9faea7f2040421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173950, "uuid": "978d023b-39da-4d87-8a79-4375ad775ad3", "comment": "Malware payload (RisePro)", "value": "d7d20cb6cef8304d1e463ef8e6a4ac586b84374e3b22158c093960f705ef4065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173950, "uuid": "d2993872-bc66-4b51-95f0-2a22ebe79437", "comment": "Malware payload (RisePro)", "value": "162ec3e9678d99ea419c325b90a82b388ce94975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703173950, "uuid": "daaef6b9-e76a-40dc-b8c9-a76b1e884cdc", "comment": "Malware payload (RisePro)", "value": "8cd9fdb411c6e828cc64f1cbd6b74797a22162913a174b112f87ae0e3a0f891c49a5f9cef2ad3387ccd07960035e5115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173950, "uuid": "6f880d8a-8304-4339-9676-8111a3002030", "value": "T1B356330E2CD2358AE4BC51754FB7F8ED79FE0BDC80628E2D2C642AEAD673154917910E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173950, "uuid": "0560a3cb-8968-4f4b-b52d-c1f45f7998cc", "value": "68688d0aee6b3c9222043bf702187352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173950, "uuid": "e50e6c93-0318-4a6c-a3ed-6ff2b2da8c42", "value": "98304:vlaXqk4dYTZ8qlQNhmwk1rVMQyInjRp0AXcFJkuVePN3mt4hT70xsXpvE:daXqk4dYTZLHlO0HsFBeV3muhT70SXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703173950, "uuid": "18cefd58-6f47-46d9-9b6a-a4947fbc8518", "value": 6205952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703173950, "uuid": "f6d13bac-2847-4278-b1b8-ff55ed42eafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703173950, "uuid": "665503c3-22a2-4d08-bc70-3115de90de2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e68b796-a025-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703179392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179392, "uuid": "a9610115-0c07-490b-823c-1680eb90ce22", "comment": "Malware payload", "value": "52d9462975f572962eec93d738231d6f", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179392, "uuid": "14f67635-175a-486e-90df-2bb4e855f504", "comment": "Malware payload", "value": "d7e67ad96c22af9cda9912ebb04ac881ce34c50084f7d9da4d15eae4046a3fd6", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179392, "uuid": "f36f30d6-9e71-49e5-b4a1-49151c34f092", "comment": "Malware payload", "value": "134e0954c879839122a089663cd11d6744c79312", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179392, "uuid": "1b268371-66dd-4d06-a032-f9b947cf2297", "comment": "Malware payload", "value": "9efc2fb0007394359fc04f49d29fa287978865f36ff24c2ba806c4a2d2699d7d5cbb02e044c95466de8dc6f145883058", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179392, "uuid": "04603b35-57f5-4188-8d93-046f278100b4", "value": "T15F4522442BD98736DAFE03F522921210C3F6A5226452F7553DDE34E86FB2B404B59B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179392, "uuid": "3a504dd4-468d-402d-a4d2-582451dff757", "value": "12288:h0oLteXH1HqLmDBP4YLfGaFTdmuUlXXq/Q7sOddmwtqY8n811cDtF8mB:ygw1HrD9zLFBmuU9XjZ2wA181kAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179392, "uuid": "152007a3-a403-45bf-b8a9-8b8b9f4e0e1d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179392, "uuid": "f58cc004-4e66-4f46-82ca-9b624cb91e65", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179392, "uuid": "e7be3a20-1035-44fd-9a8f-d8a8c3d8c287", "value": "n409-DEC1214.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e96c50-9fd2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703143830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143830, "uuid": "5dd27438-94a0-4573-abc6-9510b8c8c2da", "comment": "Malware payload (DCRat)", "value": "ba6aa919ab6952c5d67a0eca4037fea2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143830, "uuid": "f0b36c06-69a5-4601-ad74-5011cd0d7263", "comment": "Malware payload (DCRat)", "value": "d84dbf3389ea461ba92fb875c496a46a8dbb4b3f276b592bc472aa80a7a15e7c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143830, "uuid": "56f79e3d-641c-4c61-ade8-2216e44db425", "comment": "Malware payload (DCRat)", "value": "55b5acc827f94bede10cb825fe0daaa6be374ccf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703143830, "uuid": "4987e702-91b0-40c4-90e2-b0a7f35243fa", "comment": "Malware payload (DCRat)", "value": "a6ea611a712e9cc1fdda8d42abb26a176e1d9d0bd5b54f82a4dcbda0a003a509537b07ab215a249f9557a7203bc3ea4d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143830, "uuid": "1366bb7b-9f11-4ed3-aecc-e04adea8c16d", "value": "T14516334039CCD521D3B18335B1ED9B1D0931FE75A5A1E78B66F1F5A2AAF2B439A032C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143830, "uuid": "ce4cafcc-0b1e-4d4d-926d-1c6c311dc8d7", "value": "49152:DnMqadNDTiypxgwbcI8oZ+dDWBlgxfdGACwA1dpnXuYb9urYImF2HEO:DM3dN3iykecIm9Au1ZC31dZz0rZRHEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703143830, "uuid": "193ae2d3-44c7-4d69-88cc-c21bc4174ae1", "value": 4260136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703143830, "uuid": "a1f5c0a3-c9e6-4101-a0a8-693795a03f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703143830, "uuid": "5251e8e2-a34f-4a38-ba87-40b40251bf5b", "value": "ba6aa919ab6952c5d67a0eca4037fea2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e2edaa-9fa5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (N-W0rm)", "timestamp": 1703124313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124313, "uuid": "c5974a1a-9fbd-4bac-bd55-caffdbcb3c45", "comment": "Malware payload (N-W0rm)", "value": "0cc829274e01a5a7908b3f7a0bc16bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124313, "uuid": "3fc758e7-75c6-447d-bdf2-445b9eddc419", "comment": "Malware payload (N-W0rm)", "value": "d996ccf93ca4e2224dfa20cae4a6521fa8b82971300a30dff3eb062b309797ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124313, "uuid": "90361996-51b9-4184-8848-ef94ed8d9380", "comment": "Malware payload (N-W0rm)", "value": "74791ea502d51633daa94ac8c263b70370ecadb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703124313, "uuid": "eaeea831-2bd6-4b83-bd95-8c3d2ecce076", "comment": "Malware payload (N-W0rm)", "value": "61849df167cda0695e17d2cd25af27258b0ab9fc3f48c9be60ab02cec85ee07751f503a469bf3f2f7a22e8f1f80a2dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124313, "uuid": "c2d5d053-1b1a-4351-b382-98999efc5d8a", "value": "T1A3563306DF7454ABC89927B159F766A305793C7207F8C17A5B80A08F0C31BB999683BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124313, "uuid": "5aee0bc0-7fb8-404f-b8a5-6e7125358161", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124313, "uuid": "37fbe2e9-7fd3-43dd-8013-ca351dabe87b", "value": "98304:QDdiFTMz4XOJ3PaPos3t/Q3cy3v8XaeZdgP36qkGk0VN6QbtKX6psX3Ko6iR:IiFYdYoytzKeZdzqkZ0LTBKX6Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703124313, "uuid": "5d9b6d0b-292b-4082-b6bf-9814bdd8da33", "value": 6430208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703124313, "uuid": "f8edb319-d175-4c94-870d-f306438de8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703124313, "uuid": "788340b3-de02-4bc2-a821-dfd09a5f2782", "value": "0cc829274e01a5a7908b3f7a0bc16bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2523525-9fd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703144610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144610, "uuid": "b0757990-ff94-4b65-98c3-430c326b0786", "comment": "Malware payload (AgentTesla)", "value": "0d6903937d99f589999fe92abdf3dfa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144610, "uuid": "f9b58039-30af-4acd-8eb9-2d36cbfd6069", "comment": "Malware payload (AgentTesla)", "value": "d9c3810761942c6191a8e2dfb22b2178d6970bf474a908a4af1bc80b3022a774", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144610, "uuid": "b5d85948-d4da-4be8-8363-453e0d46e3ac", "comment": "Malware payload (AgentTesla)", "value": "c5434c31851555523d380591c3c7a3ec884278b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144610, "uuid": "d8cc9a39-d4b8-48fd-aef5-d12856c24723", "comment": "Malware payload (AgentTesla)", "value": "c4890dd7020a97d30566df9f4f40964025da3cf7fb4f91357af3e9e1294e99e2adc11dff9c075bfbacbce14c0917ab29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144610, "uuid": "24625bb0-20d5-496c-9edd-f3c2031ca98c", "value": "T16F15B23C587D2237D6B5C7A58BDC8427F26CA46F3151ED6498DA93E603C6E4238D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144610, "uuid": "7bf09e05-2b4c-4b62-9136-bdc7daec3b20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144610, "uuid": "3af9ac06-88ff-4a1f-b8f5-6cb7b29a8278", "value": "12288:HGXDY6tTAvg2Gb/AM2JHabeXPLCdSHGPT+FdOLSfgGGqi:mzBAIAM2JHabIbmP5u4hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144610, "uuid": "76ca56f0-2e30-433f-9e3a-d5c933042bcf", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144610, "uuid": "07f1be8a-b562-4e59-9e0c-62b1efe31420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144610, "uuid": "89e3bd7e-df83-41eb-aed1-34f7dc9bcb5d", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9b9904-9fd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703144118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144118, "uuid": "16729180-c1ca-4b3e-a93b-76556feedba8", "comment": "Malware payload (LummaStealer)", "value": "11312dd3c4b2ff22f314abab63c8a137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144118, "uuid": "23348be5-c374-429f-a920-201337a744ba", "comment": "Malware payload (LummaStealer)", "value": "dacf95b25715ac1b0388f080efa19d2cacb2317ed85ff786b2404be419d3d4ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144118, "uuid": "c250c821-3d64-4c53-975b-5c9392051633", "comment": "Malware payload (LummaStealer)", "value": "b8f05580c6e1147c62f2edc785c78cad70647691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703144118, "uuid": "cb3aa194-7e46-4101-a5c7-4169c3a6ae9a", "comment": "Malware payload (LummaStealer)", "value": "bf9b59370f9382da6b9f7111dae9144c1675452a75f3fb430befbe52b39b5b51f813d9c2d639a8bdfef81f3a27ae3ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144118, "uuid": "451761f0-7d86-4fe2-84f7-360885d748ce", "value": "T183563306C7E80C92CCAC137454FB71911A75B8A516B8D6BD7780D24E2E723EBB07639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144118, "uuid": "1d751064-c239-47e3-9234-35027f51d670", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144118, "uuid": "52fe2890-8dd7-4629-9d7f-895ff6ae5dd1", "value": "196608:EAafdZb8OcilirQ1yxbZj/7PdpA1xrx7LEBJ:SJg/D/7d2xt7kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703144118, "uuid": "48e00580-adc1-42f3-98e5-35d6ae96de6c", "value": 6428672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703144118, "uuid": "08c88f61-05ad-434e-9b5c-43cf89891ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703144118, "uuid": "deff92b5-59fe-40e2-9915-ebc1b3f76833", "value": "11312dd3c4b2ff22f314abab63c8a137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a16270e-9fda-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703147146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147146, "uuid": "54557fa4-b954-4a37-bd63-cef96fb8c03c", "comment": "Malware payload (RedLineStealer)", "value": "70042a345b80f7391c41333479ba384c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147146, "uuid": "07f6f90e-8cf4-480a-8391-a39d1a050de7", "comment": "Malware payload (RedLineStealer)", "value": "dbeb8141e27bca95718603cbf623aa147292b860d7fc2529ea713539dd9af65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147146, "uuid": "b6b93c8a-b5dd-4277-817a-45953c268f4c", "comment": "Malware payload (RedLineStealer)", "value": "88309a926ca0d2f096c08d2daad7617b2887a856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703147146, "uuid": "6c7b9607-ea4a-43f0-a54e-6a596a8688b5", "comment": "Malware payload (RedLineStealer)", "value": "56cd9594c99cc59342dae1d1056a9b1268f25c56db4ed5a639e37e16319d77b8c8dedd4bd539a0e7cc0df880b422e55d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147146, "uuid": "e8b774c3-3832-4c95-b1a7-3eefa71d594b", "value": "T19F5633139BE078B6CEAC2B7504BB06571834B95007D083E67B89CB4A1D73DD4E9A53FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147146, "uuid": "b79e4c61-3a7d-4be3-9217-afe33401365b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147146, "uuid": "5fd0a58b-957b-455c-a222-b4a35c4c082e", "value": "196608:Y4T3W8ZBpcBt8DCJNwDOOuzs5s4pnzEh9:88Z/cB2mJKD1u0sWnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703147146, "uuid": "b5747bfc-87ee-4c29-9167-ef9abd021f84", "value": 6429696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703147146, "uuid": "2f19b5a2-cf3b-40de-b1fa-15fc880b2d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703147146, "uuid": "1fcd2a34-c9fb-46f9-abdb-55aaf3a2576f", "value": "70042a345b80f7391c41333479ba384c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b803a0f-a025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703179280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179280, "uuid": "f1510679-5905-48ba-ba2d-86a47e1013cd", "comment": "Malware payload (AveMariaRAT)", "value": "7267423cb651fb1a5f0fa8189b188466", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179280, "uuid": "d455fa9d-2abb-4cd5-a9db-7e7c6a7081c2", "comment": "Malware payload (AveMariaRAT)", "value": "dd0db8cd67753ee046c45c23e0a2d05a48a22a8adda0316760349c4aab3faa2b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179280, "uuid": "22b7fc7c-286f-4e7e-9bc9-f97e3c4c6d0b", "comment": "Malware payload (AveMariaRAT)", "value": "4207d4fee5a96020e8a838e94f591c87a7a45756", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179280, "uuid": "062444be-8662-4ca2-835a-60dd84ad896d", "comment": "Malware payload (AveMariaRAT)", "value": "0ddf5707a1ac6c3230f79169a623191f32bc5fb2ada96c9c3acabc7a031b738c1c47258f45c6a0b7416f82501da245f8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179280, "uuid": "4964f941-84de-4588-a994-679eb1f0c7dd", "value": "T1F2030126EC3BFB4349A31485417039823B896F6FA0A17B31D2580FCAE5615D8986DFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179280, "uuid": "60d80fe4-e373-4a95-bfa9-040c68611c20", "value": "768:F/GFSWPwkAorl2lVAry5vcQWjhymZ6kOj2KrtKqkfBGj3CSH5nv3p4JnyTaSReQ1:F/Y5wVorlZJQWVymMkq2KrthkfBGjySp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179280, "uuid": "2692b7d3-703b-4a55-b5a6-d6904deac21a", "value": 39377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179280, "uuid": "adbd168d-f72a-4c2e-b7a0-c2d0ab2e6fee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179280, "uuid": "3df8c389-1a46-43b5-b4d0-6f35e54ae975", "value": "nNEW_ORDER_28938928384893029.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed6f3bc-a01f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703176816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176816, "uuid": "4278f120-ca6d-49c7-9748-36eafbbcf3d1", "comment": "Malware payload", "value": "7052629e5cdddcc9413a68a08853eef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176816, "uuid": "b6acf904-fd3a-4237-b5e2-7b0ef4f90554", "comment": "Malware payload", "value": "de3fd0f07b19190a36d9516edca7c0db37ccdf0332b3d336c6ea2d0b236ffc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176816, "uuid": "690dfb75-59ef-4e95-b237-97913783b7cc", "comment": "Malware payload", "value": "4d74737a12fa5828c25951c807a59515d82d3edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703176816, "uuid": "e69ce902-06ad-4ba5-953b-5c50048ad9b6", "comment": "Malware payload", "value": "584dda102632d786dbb0a37da84dc1e76557675be587e710a5d3b2161867dfdb0118da118219981b53fde397e1819fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176816, "uuid": "2700b7a6-d3e6-49b3-a147-ecca9f92cbef", "value": "T14DB533213DDB59B2D592033255847FFBD1FBE32C571022EB03618504AF69562EE2BE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176816, "uuid": "8436b146-f78e-4823-b7cb-07a3fc4a2445", "value": "94af7f0728c275a2ef6a6a6c552117f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176816, "uuid": "406a77c9-0019-4254-9a8b-0503d6a97a1c", "value": "49152:B8xV/nFkp0WHSO+He+vrQ36yK+ryrYx/eiUxynGakz5HEj:B8H/nHWqytrAkMyG5Ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703176816, "uuid": "ae24522d-4703-4a88-84c7-68076790f8c2", "value": 2270780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703176816, "uuid": "53bbc742-48bf-41d2-ba3d-c01012f160a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703176816, "uuid": "7e624d49-57af-4fef-88dc-83c436c2c7b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1859b1-a019-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703174394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174394, "uuid": "11b59a05-8c23-4f9d-a5fd-56a4cab0d885", "comment": "Malware payload (Mirai)", "value": "51d3272a16552d20c98839bcd4153608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174394, "uuid": "1f404aa8-3353-4ec3-8479-e6d0a724b7e0", "comment": "Malware payload (Mirai)", "value": "e179be7c43d9f8f8ff6930868ec5c785c26f6113784a8c7c731a58b29f9c0562", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174394, "uuid": "e9548956-9496-47cf-ba35-25f79b79d8fc", "comment": "Malware payload (Mirai)", "value": "20777ebb843257d4a917493205eb7021b78f075e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703174394, "uuid": "827b306b-e495-4151-a39a-a983988f5ff4", "comment": "Malware payload (Mirai)", "value": "bf57b5c603dc34baf10fd7792e78a40d98ffdaba5305e2bd3abe52de8f12da64a0f92c482f5b15e3e7f4c2b0943b68ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174394, "uuid": "9699e13a-b727-413f-9667-ec5860b03e1d", "value": "T1F6E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174394, "uuid": "7f20d3a4-15e6-4787-ab09-6a078d664b64", "value": "3072:pUkePnlUPX1JJXJUwbY+a9scgTbOCm3DoVRpW:pUHd4jJXuwbjaPr/3DoVRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703174394, "uuid": "5789800d-c1d8-4e72-a907-11714da5438b", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703174394, "uuid": "a7876e59-11ab-4d6e-a398-1176b679f39e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703174394, "uuid": "3d54c27a-e47f-4695-b550-041b3db659a5", "value": "51d3272a16552d20c98839bcd4153608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c1716d-9fc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703136156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136156, "uuid": "a5034148-2e94-4203-8783-2ebfa350146e", "comment": "Malware payload (Stealc)", "value": "e13c92058e609717d68810d4f1773af9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136156, "uuid": "fbd5de8b-80e9-4b66-84cd-2feaf55415b2", "comment": "Malware payload (Stealc)", "value": "e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136156, "uuid": "b9506f97-4e6b-4dcf-b0fc-41ccbcfd0cdb", "comment": "Malware payload (Stealc)", "value": "44c1879d60cf4a6d4202114aa8798a2ed0e0e8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136156, "uuid": "9c405225-ce57-425e-8b02-a9e65f4d46ff", "comment": "Malware payload (Stealc)", "value": "f673548f6af0d94269cb7253f1aceadf817dc28003104f39638e1aa4359e515b4fb589b08d935dd1b86bfef95c1bffcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136156, "uuid": "951c000f-1959-4287-8887-0bea3f01a5f0", "value": "T1DE342A2392F07D95FA66CB728E2ECAE8769EF5508F0977A712189A1F04B11F2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136156, "uuid": "3e1fe6cc-bb38-485b-86f4-c29ff1169e0d", "value": "9138bad961b0c12306fd188b3eb186f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136156, "uuid": "147543ef-dc81-4883-9612-ef7b3e342593", "value": "6144:8gDYLdO9xoBEyPXVHu1vj/S9Kz1cfCSj:8VZ2xsFHIvjK98ufJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703136156, "uuid": "f4ecf300-9b8e-41d3-8fec-6746c1df055a", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703136156, "uuid": "2a28c9b6-df6d-4b9e-909c-3286636ea5b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136156, "uuid": "8458b830-be7e-4742-bf18-1ec3a7bdc2b3", "value": "syncUpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54f7e2d-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169552, "uuid": "2ce5469c-ca1d-4482-87c8-67012e8c789d", "comment": "Malware payload", "value": "4d96106f8d1610a9197f582ecc79d8d3", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169552, "uuid": "7b849a20-c265-4a2f-9812-0b785062529f", "comment": "Malware payload", "value": "e390cc169f0e0e826f090ea1821f1cc36008e3e4fec95b36b865e46c4b92b9b7", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169552, "uuid": "cbd7df20-a652-4f6a-b4e1-8cddc7054f40", "comment": "Malware payload", "value": "7c5ef3046dc3acee11c0460a3bdac70582f7e411", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169552, "uuid": "498fb35e-5a3e-49f1-bc35-54668879060c", "comment": "Malware payload", "value": "5ad1f449b8da24805fb53b3444b03b4c74916c0faec6db85062c0c0f8e3bd0dde621005f7dba8384ab863336bd393b72", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169552, "uuid": "d81b0f4a-a8b6-448e-873d-1e255c328f21", "value": "T117247CEA0A33EDA557F421768155AC806841B738B29F29BF154EE40E9388BC345EF3D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169552, "uuid": "a76f3635-994a-4fc5-adf7-d843e9bbc8c7", "value": "6144:aYdTaXLBC2IrlJqIIP/8mDHlp9aRhRO22Vm:H2709DqbP0mLlp4RhRO2+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169552, "uuid": "febbdcc4-bda6-4be0-b18d-267387216ae0", "value": 225352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169552, "uuid": "530ef2c9-8ef7-48d2-b929-7de1e5c688e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169552, "uuid": "730fecf4-9013-4d0d-9d2b-0636a2cde87e", "value": "onxin.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb04db5-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703186911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186911, "uuid": "cfa181d5-5fdf-4ed9-8326-861b7d0936bf", "comment": "Malware payload", "value": "2642914fc0891c0e54297f85c1628db9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186911, "uuid": "d1c9d188-d9eb-4df9-9c7f-e5cfabeecbc5", "comment": "Malware payload", "value": "e45a87d312aaa81429fd1c44bfd800194476bb72ddd1df87f253f1f182313549", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186911, "uuid": "67c35511-7888-4a54-b5a4-f7bc81f71b9d", "comment": "Malware payload", "value": "fb3fd56e048b1125751ea1083e66889913abe3e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186911, "uuid": "fca6a7c1-86e0-4795-936f-65b976fc81c5", "comment": "Malware payload", "value": "f4eff75ee3ac4c75ceab82167a5d1b2fa4696639858431e914e5c80760492e96541821bf1998c8c087daf8b0b2752f14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186911, "uuid": "04261529-7965-4fe5-80ed-9defd78caf99", "value": "T165B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186911, "uuid": "51e8067a-9b90-4b30-aa80-3609ab239b03", "value": "3072:pC/4rdZHsXsZwwR9ZNk5mm/QcuLmHniPNb:pCwrvHwsZwY9ZOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186911, "uuid": "ee06f67c-047a-452d-addc-0825927dd5c7", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186911, "uuid": "eca11dc7-fb36-4103-a944-9a3b875d4f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186911, "uuid": "1671b5b5-205a-4fe5-b8e0-510fb3285ae9", "value": "2642914fc0891c0e54297f85c1628db9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816fb53c-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703187934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "3ece9f40-d13c-43da-93d6-e5c650372095", "comment": "Malware payload (RiseProStealer)", "value": "27d04f23ca30fea68cdc6c4493be7233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "f154abcf-084a-4376-a33a-646305873fa6", "comment": "Malware payload (RiseProStealer)", "value": "e514d7d13c028cecbd4d19420cdb3a2345fe465a15898cac56d6c7cf1b4ff65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "45ba33fc-0e10-42c3-8017-c9c30dc4d2f1", "comment": "Malware payload (RiseProStealer)", "value": "d10e84325665b92306aae0b94cf76fe85db793bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187934, "uuid": "6cac047a-0a97-4365-8a24-04ef421e8d42", "comment": "Malware payload (RiseProStealer)", "value": "868b4bf2a53e9a291b0757e689f5b0b189700e7ea1f4782f65e60627785cf32822f55021805d780b401af925b4fd712f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "fcc76e3e-d70c-4ce0-a4bd-17d8e9f7cb40", "value": "T15B756C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "86392504-fa23-4b9b-a802-1a68f1e40d50", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "ca09ce1b-71d7-4132-9bc5-24ef72966a6b", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187934, "uuid": "9b7c52ed-7967-47de-8c91-c75af717ae97", "value": 1691190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187934, "uuid": "e0dc91dc-275a-4013-b0ba-55f795697fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187934, "uuid": "828232bb-b1dd-429e-bc4e-4275c68876da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77857ab-a002-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703164456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164456, "uuid": "a991df5e-1c2b-463f-8e46-9615157f13d0", "comment": "Malware payload", "value": "3a2371944573dda32eb2e2a40125ccd6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164456, "uuid": "6c3e6219-83b2-431d-9a9f-3f881584619a", "comment": "Malware payload", "value": "e62493e340bf3759d0a12724bd00b2a8ec0905f2491aac2b01672793a9525092", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164456, "uuid": "28c5828f-30c8-411e-9d1d-9a407bc11b04", "comment": "Malware payload", "value": "b072ffc572dd8e555923948440306f45ea0f1fbf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703164456, "uuid": "dfe65240-cb46-434a-8b3a-12e4f8c94c18", "comment": "Malware payload", "value": "71e7786afb6f3d6a547ef4bf6f41e61d852b8260dca91b98a0c3b7c4711260f64d2c2390f7f7bb2c906aab28d2b2e5b8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164456, "uuid": "4dae4551-79ba-4240-8d5e-77b121ce3610", "value": "T1189302FE5445D62DAFC389AC10E4F54DEBB1BB2648F54123900F62B44894C6AB361B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164456, "uuid": "04dc633a-6300-4035-a1c8-bef750307bd0", "value": "1536:E9S/ZpLd8i2MappnHAvmQorVDy3qwEifYZXptjgShlG80acGdC5+TY7eVWWsu:E9QH2i2nHACrA3qqfW3G80aEl7eVWZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703164456, "uuid": "5c60eee6-b47e-46c2-a5d9-1d4d67cbdabb", "value": 93919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703164456, "uuid": "28d11ae6-163e-4e27-9bef-d788f8cd1ca2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703164456, "uuid": "befac70a-13c8-440c-a7e9-b4b96192f719", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0623e8-9ffc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703161833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703161833, "uuid": "b230f043-4196-4ad0-a80b-64077914609d", "comment": "Malware payload (RedLineStealer)", "value": "562579e3fc3c7d7e1dadbb48164979c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703161833, "uuid": "2a28db7d-fd35-4ff4-8b55-809e771c9480", "comment": "Malware payload (RedLineStealer)", "value": "e76d1717db98f5eee4fa9ad431bd5fa86df5766fcd4111d35e40558cc6301a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703161833, "uuid": "9871c68f-5fe2-43e0-a1ba-34273d7ed8b1", "comment": "Malware payload (RedLineStealer)", "value": "fb53f7b2f9b3d49cadfdcd86daf78c180a52066b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703161833, "uuid": "a01b50ac-2578-49ab-9f2b-ffb3702fc7e3", "comment": "Malware payload (RedLineStealer)", "value": "6679ac5eab88b178fc8b6379078176c72c63702cd2919cdaa6fb6f6f6e0ad8b8a77bbd0d413134bc7a6fc3dcfb1a5dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703161833, "uuid": "cbb0981c-ce3a-4c24-8269-372c8af51747", "value": "T10B56337AEBA458F7CCDD173108FA16520526FC713BA0C93A5A88DC5D3CA39C978512BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703161833, "uuid": "e43968f0-ba40-4a8e-a841-697a2013f6e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703161833, "uuid": "d7a29a5d-2a19-4ab0-9802-fad9ccad0f06", "value": "196608:whylfbeWoQUvYbi03ZuqJS/CnhXZsSpBX97Po/:FD2ZiuqJSKnhjBt7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703161833, "uuid": "ee420ad7-fff3-41e6-b50d-2bc347275307", "value": 6430720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703161833, "uuid": "d30334c3-858e-44bb-9754-c54ced38036a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703161833, "uuid": "5db3b3ea-5be4-4c0b-b341-8c7ceed7f67e", "value": "562579e3fc3c7d7e1dadbb48164979c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf77cb0-a043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703192411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192411, "uuid": "9fd5e78f-4e82-47de-8e47-881e02b654cb", "comment": "Malware payload (RedLineStealer)", "value": "52fb63450a9fd513367921c927f033d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192411, "uuid": "d7abd48d-bab6-40b7-b9a0-0a4bc6ca6cc8", "comment": "Malware payload (RedLineStealer)", "value": "e7f2b3dba0e5930aff36d63c1e3c23c5aec770848da2425b282999a277a79353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192411, "uuid": "48ab0ad5-a42e-4c93-b50d-34a4e5c6a536", "comment": "Malware payload (RedLineStealer)", "value": "0bd694f43f3db42fe6f64350c2ca49d70700f79f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703192411, "uuid": "694ce983-f4c3-45cc-a8cd-cf4d24942633", "comment": "Malware payload (RedLineStealer)", "value": "66ecbf639f0b3717622422174314216adf85d771959be0c54a5f8116605608fa70902714447f10529f3f4ae272a09732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192411, "uuid": "bce48c09-5914-4618-aae8-b88b6292aa50", "value": "T1A1444A5356E0BC51DA664B738E6EC6E8B61EF5909F59379B22189FAF0C701B2C173302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192411, "uuid": "5e9514b0-897e-43e9-b74b-acef59e7c509", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192411, "uuid": "dead2f0d-be15-4540-bc40-4c355dbdfda2", "value": "3072:dWb2nLAcSaHCk2aFSZUu11EeoSrvsz1mw+kDj72fRNEheMdNYVpPk:gbWLAdaHCkzSZUuKS4z1GkyBqNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703192411, "uuid": "4bd0eb47-be99-4656-8b45-ea6c1ef5af00", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703192411, "uuid": "fdf0de3d-d31c-43ea-af69-e9bcd5ace924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703192411, "uuid": "b6d8c648-38f5-485b-b227-d02016146001", "value": "52fb63450a9fd513367921c927f033d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e14f20f-a025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1703179284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179284, "uuid": "cfca7b89-acc9-44d3-9422-aeb9813526f2", "comment": "Malware payload (AveMariaRAT)", "value": "671f91d1c3acee050ca7106080a9d6f5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179284, "uuid": "71dd6716-3750-451a-87d7-5bf5cbf45593", "comment": "Malware payload (AveMariaRAT)", "value": "e7f98ddb4183f82f7931888ff9237f898dc0e484241b02c5e0780204fe680c7f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179284, "uuid": "019a10f3-5caf-4775-a7db-79a137513acf", "comment": "Malware payload (AveMariaRAT)", "value": "34dcf5a1913b660d2bf3fc2c0ffce74a3b8fc6d3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703179284, "uuid": "78c8398b-acb6-4947-9ecb-bc59bc7d0c8a", "comment": "Malware payload (AveMariaRAT)", "value": "623340aab8d9ced7b327fa2d8069fe27fa97dc66fecde8ff7ad14116e74720f82192d6d5c5f39d444374309111edaa83", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179284, "uuid": "bd56a19e-31ae-4d15-b4fe-00e8b9a55550", "value": "T1B7A32902322CC727C1FE02BAA431A17803B64E4A7275D7DD9DD9F9DF37A17815822A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179284, "uuid": "ddb58ec0-3f84-4698-b448-e2790f9be995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179284, "uuid": "f0572921-0659-44d2-b9ad-61220d630fc5", "value": "1536:jBtNyxERJQoQ5c0OMxnmOY4bza2iocHUw2gfP2jPfMIc4ppd6n2KxEINr:vcc3EmOY4MvHUwVfMPfMIc4ppd6x6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703179284, "uuid": "b7364690-7f9c-45bb-869e-407d6986fa0e", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703179284, "uuid": "443c8df8-3d8d-4f0e-bdc6-26a27812f5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703179284, "uuid": "e236fdbe-3197-4499-a7d5-f3097bb77f58", "value": "rNEWORDER28938928384893029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05332dd6-9fc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703136615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136615, "uuid": "750aa4e3-9ffb-4ae0-a23a-5ed65169949c", "comment": "Malware payload (RedLineStealer)", "value": "371a6a1c8f54420097aad2c5d56881c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136615, "uuid": "cea0fe3b-c5ec-4521-b1f4-63e27db449b2", "comment": "Malware payload (RedLineStealer)", "value": "e850559ebc260d4643cd9926547e4a2369fd1c23291036a99276ec881303fa31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136615, "uuid": "eb12e311-15ae-45ff-af48-b09d88127483", "comment": "Malware payload (RedLineStealer)", "value": "4d26810613a17f84b9c04e7f13fd14f3823a391f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703136615, "uuid": "a0dd7c22-6fef-422c-a4bb-97b46b41479b", "comment": "Malware payload (RedLineStealer)", "value": "a83bd0d3eaa773922a61e1769b39e474551c77cf6a34009c4fe04c4e6c89cc1771c56f876ddf202233924ddc357de783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136615, "uuid": "55a0f184-4ad4-4676-95d3-8196fe1bc5f6", "value": "T191563313EFE4646BC8AC133464ED15E3005ABDA551F190767688F48E2DA3FD4B0A63EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136615, "uuid": "5757f4ba-a1c5-4866-8c5b-d9f9a93329ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136615, "uuid": "c407031c-ca43-4b4a-af37-1be06203dd75", "value": "196608:pdrH+u+zPFjxAuIQOSqHzEbGL+s9oqp3nQJ:OlzP3aQqemboo30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703136615, "uuid": "765b7656-da11-4cfd-9a19-1c7991827f00", "value": 6426624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703136615, "uuid": "a391078e-6941-43fe-880d-12fa8b031189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703136615, "uuid": "0b760a01-0466-48f7-9c42-501e316d65e5", "value": "371a6a1c8f54420097aad2c5d56881c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b0f6ea-a036-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703186456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186456, "uuid": "01426b03-7c17-4d6b-8313-3230eb37068d", "comment": "Malware payload (Mirai)", "value": "c963d96142fde7e1d04cbd91aeca05e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186456, "uuid": "3e7f89fb-f0d3-49f7-8352-43cc57ccb563", "comment": "Malware payload (Mirai)", "value": "e8d939a52905f1bf3945ae1f4662b356e931eb25c1a016e5f9075bff4f0f2eb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186456, "uuid": "bf21102d-2de3-40b1-899b-56ebb54cf33b", "comment": "Malware payload (Mirai)", "value": "372d92b784aec26941e32c0c1f43584740b52d0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186456, "uuid": "9687010f-d4ca-4ecf-b84e-c26bfca65ab5", "comment": "Malware payload (Mirai)", "value": "edc8c00f32d7b1cb939d6b5f0010f169397032818b4faf02dff83ad7da2f229952a0347f1b73939aeacd24ef38ad4c6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186456, "uuid": "914077b3-1c3d-4346-981e-350fce71e96b", "value": "T15FC35426AB619FB7D81ECE3305A94901108CAD5A12D92F6FF1B0E61CE36BD4F48D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186456, "uuid": "a9fa8f6e-7591-4117-8bd6-525901819aa1", "value": "1536:UVeTCZ/ekn8gVT/7i/8ZGGX+yGCVKZlCb2ZyAzR2sA4hsqg:UN2XGX+JwKCrGRpTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186456, "uuid": "dec43a0a-6bc5-4496-a6fb-7ca1c8567570", "value": 129688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186456, "uuid": "063879b7-ab7b-47b9-bdcd-db4763d16dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186456, "uuid": "19837bf7-700f-4270-a4ca-339a932e5332", "value": "c963d96142fde7e1d04cbd91aeca05e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b39ca36-a02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703183091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183091, "uuid": "eb180fa0-ba12-4957-90a1-e1ddc92887ba", "comment": "Malware payload (Socks5Systemz)", "value": "edd03cb4870148c9f9c0a09749f70561", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183091, "uuid": "f0cc915a-77a3-4d00-ab30-3b81db3e4016", "comment": "Malware payload (Socks5Systemz)", "value": "ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183091, "uuid": "d5ce3c1d-971e-4fb7-b93b-4ff85631612d", "comment": "Malware payload (Socks5Systemz)", "value": "d7b4a641c0de7769e67bf243e93159376612d8f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703183091, "uuid": "27049122-5f22-4fd9-8b36-16736f066a6d", "comment": "Malware payload (Socks5Systemz)", "value": "2c242062c5664ea81a82f52e0392493e9dba2f9b22d2463e71c57671f38c8f050b63116bc55561f2acfe6efbde6ea6c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183091, "uuid": "e1a79e05-4f27-4d52-a36b-5b4718852c8e", "value": "T1AA663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183091, "uuid": "13da7f9b-8506-434b-8f17-e5777250a3d6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183091, "uuid": "69454f59-5682-4ebd-ac90-90846884ae4f", "value": "98304:p4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:ah7teThPZidcKj8fPz6+4jb1KswNdDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703183091, "uuid": "2e6bfb3c-37b8-4f65-88be-ccd94fe7050b", "value": 7054359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703183091, "uuid": "425793a5-4402-4dc6-8ea8-7722662f6457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703183091, "uuid": "bf46060d-2183-4f5a-ae7a-acedae04fe1a", "value": "edd03cb4870148c9f9c0a09749f70561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7c1f9f-9fa1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703122826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122826, "uuid": "d12b9a54-10e6-4aab-ac79-970d0c400d83", "comment": "Malware payload (RedLineStealer)", "value": "62c9e15dd99c7d3b7367dcf220579c54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122826, "uuid": "9c970ff0-0c7e-4f97-84dc-ff74749e9946", "comment": "Malware payload (RedLineStealer)", "value": "f0031fca754e1e01db4ba9d8df732cabfd34117b136f8e44d5869d6f727c3930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122826, "uuid": "b110b975-8bf4-434b-a1b0-d3a46d6785bc", "comment": "Malware payload (RedLineStealer)", "value": "a735b0e57f0f013592a55675220e5f4d7c093f78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703122826, "uuid": "480f4d26-35ab-4a1c-b011-23c8461d319a", "comment": "Malware payload (RedLineStealer)", "value": "2625cc3f57faf2d41bda4f5b3b14498d9659ec111887893569234192b2e6906bb8b70df494a4c7599d1d5f29585dbdfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122826, "uuid": "ed624401-258e-432d-aed7-9f926ccaba31", "value": "T1EC269E06BB9AED22C11D6733D9E6505043F7E9816723E70B35C1136A1E433EE8D5AE8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122826, "uuid": "1bd2b62c-f69e-44f4-a1d3-cd4ec5011b5d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122826, "uuid": "f914f867-deb7-4159-bc7e-a60de9aebff9", "value": "98304:IfCOrHQms2QJmu6eonAh3EX5hKMrBA7dLV:8C0H82Q03n+3EX5ltWdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703122826, "uuid": "5dfd5e75-3a30-4479-9add-dffa472fa35b", "value": 4765600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703122826, "uuid": "9451b904-b1f1-44c9-9b30-62434374680f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703122826, "uuid": "a023cead-4220-401a-b87d-589a801be8a6", "value": "62c9e15dd99c7d3b7367dcf220579c54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf4279a-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703169647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169647, "uuid": "7ec5b872-aa79-4e0f-8d11-68929dbc1390", "comment": "Malware payload", "value": "5b29fc90423419bf90739fbcd0de7791", "object_relation": "md5", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169647, "uuid": "f76579e5-922e-4025-b084-d37c6731cd0f", "comment": "Malware payload", "value": "f0260c18236a370b2fcaee17742b4dc3ad43e3f40e71c4ad50cd0e4470d38175", "object_relation": "sha256", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169647, "uuid": "970d3034-9655-45b3-80b4-527d2130f335", "comment": "Malware payload", "value": "5b1826061622cdea2a3b467f19bd7178b9285681", "object_relation": "sha1", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169647, "uuid": "69c6d713-9a78-40ee-83e8-b72bd0277823", "comment": "Malware payload", "value": "f9253a16ac1eff4f755dcd217d100fff8feb5cc1ae223b080fce20b200f221847c1d6bb0aa10a706c8042297f6785590", "object_relation": "sha3-384", "Tag": [ { "name": "PrivateloaderVK", "colour": "#B2D88C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169647, "uuid": "2718cb93-c078-4674-ac56-53899394e670", "value": "T1970449F5CE1F42122F67B17258AADCC3DC4113A018EBA8525BCD9C54B8E84D58D9FEA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169647, "uuid": "1fce97aa-6a86-46c1-81b4-e5c0f33165c6", "value": "3072:xhc6lXTsZl7k2lgvsCSqhr9VGCSqCWYruLFRmgDEoAcjrMQU0W9LhJ/qLO6/YS+k:xhg/DWYruRNvYJVYmLGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169647, "uuid": "e6042e7d-dcca-41bd-89eb-5ab4fe3b05ae", "value": 178692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169647, "uuid": "7b52b69e-b5a1-48ef-972a-99024cdb2ef2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169647, "uuid": "809a1f6b-27aa-45ad-bff3-5b09c9eec49b", "value": "sdfhj8s.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c22401a-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703169510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169510, "uuid": "9563f163-31bc-47eb-a85f-218b098fd4ef", "comment": "Malware payload (SnakeKeylogger)", "value": "dfdd7ffec44bc0be0c4d58f33a7428ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169510, "uuid": "0560ea43-63e3-4e12-a0ba-8a2cdf321c42", "comment": "Malware payload (SnakeKeylogger)", "value": "f0df0ec243153f35a5522715fb79c372fde175ad98596185ec2eea5a16a535bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169510, "uuid": "91997c06-6626-457c-8e74-b893d24375c7", "comment": "Malware payload (SnakeKeylogger)", "value": "a352935a55ea1e1bb3e9853b6971806b1e64bf48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169510, "uuid": "407aa38e-6b15-4917-a229-bffe0d9235ef", "comment": "Malware payload (SnakeKeylogger)", "value": "eb2ef9a1a43ad58a666d6f007bd70e5f1cdec0a2e57b7d6da9621e459901dd3f04f1790541b4621ec4b3c79e21e6be89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169510, "uuid": "331812a4-0803-423c-9dbd-e4dfde5448a3", "value": "T19FB4D01063E4832EFAF203B879B92564AF77FD9B5562C3AE5918703D267331045727A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169510, "uuid": "23527534-055c-4e93-a978-d1b227863b42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169510, "uuid": "231efa98-8564-47cf-85d9-064ab49ecc8c", "value": "12288:sXiF3PPBQI0qkGSdbd4dHlCTO3pb2ASwUHqGUS:sm3PPBQIZUdYFCT6dSVrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169510, "uuid": "1fa691a2-ade6-4379-bfce-9b9d4eef00fd", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169510, "uuid": "b38cd832-ddf7-45dd-83f8-f591bff077ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169510, "uuid": "2f93637f-2ea3-4b3f-9999-3c90b631b1ba", "value": "MT Marine Tiger Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754821c0-9fe5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703151835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703151835, "uuid": "07269738-f771-426f-a594-ab64280d1403", "comment": "Malware payload", "value": "8d6b2f32d2bf145cfc82c256b863195d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703151835, "uuid": "cad5e637-7ee7-4ef0-b0be-72c470741b1d", "comment": "Malware payload", "value": "f1befad364c3e9557d5a5e67654fffcf179081a2cc3141024881bd8f7080f651", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703151835, "uuid": "9dab119c-47ca-4a96-9425-9c5a87dde015", "comment": "Malware payload", "value": "08b59eea6096c63b855e1851df593a74b1481336", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703151835, "uuid": "ab9d12a1-9b0c-4a3b-b6e3-cf2638c54691", "comment": "Malware payload", "value": "4a4a72b8b4fb1349b6aa19db5109e34cca3092c50ba6f00a02cbb72a9bd454c815f111148617ac1bca4fa63fd6385bd4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703151835, "uuid": "53453730-ecfd-4921-8fe6-02c80b912852", "value": "T1F3D39B6DC34B02598F62433A9B171E1142BDBB7EF38552B1346C537933EAC39A1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703151835, "uuid": "98d585f4-8163-4577-a000-5e939624aaa7", "value": "768:9wAbZSibMX9gRWjtwAbZSibMX9gRWjLCOXUj8rWLSSkdG7CFlNnajpefNGkKHS2h:9wAlRkwAlRWCOXXafOG7CHtajpefM0kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703151835, "uuid": "9a2dff15-b907-4a64-aa46-5668e3483929", "value": 142811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703151835, "uuid": "525adbe9-286c-4bb6-9352-4768de499255", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703151835, "uuid": "7867306b-465e-4209-94f3-f2ce9b99b6c0", "value": "Fiyat Termin Talep.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9abeb0-a009-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703167122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167122, "uuid": "b74f29ec-579e-41da-b23e-ee032932683b", "comment": "Malware payload (AgentTesla)", "value": "ea8a2dcf863ff2e6f3d295650b22f140", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167122, "uuid": "77912074-9a3d-42aa-a2c4-6a2a565ab4c6", "comment": "Malware payload (AgentTesla)", "value": "f323a45b82ee3168908df48def20613c357cf1dc9f4f2fae6c4e50b9434ec710", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167122, "uuid": "d24ca398-3a2b-4d3f-a988-015b200271e6", "comment": "Malware payload (AgentTesla)", "value": "66c6873c959020422dadd2c25c8774106cfdf990", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167122, "uuid": "b72bb83a-1b25-47d6-bf74-b96e84db843c", "comment": "Malware payload (AgentTesla)", "value": "75617082aa0e1429943408e8bf8cafdb432284ace58fe0ff9246e9cc9b295984e62f2cd920d107a6ed0842693225a161", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167122, "uuid": "0d1b9793-6c6f-4e38-9cb3-070db32bcefb", "value": "T11FE433A235DE110FD7A0839152B9DE250B196ECB270FDAF27E16077D42EE508C9AB712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167122, "uuid": "7dd73819-a55d-4ead-9ec1-430b318e5996", "value": "12288:pVc4E4SDy7vjhP2K31r9S+KlDed1Nru/Z43jKZblzRCzW8jms5Pdtamf64lvVakX:I2F2K31BS+8cOCzKjelzi4Lakqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703167122, "uuid": "a25eb9ee-92c0-4d52-b995-11cb61e56e14", "value": 683528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703167122, "uuid": "8b988ec2-3ba3-43bd-8c27-68e7089d8e71", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167122, "uuid": "829ccd3a-6e6a-4b07-ab4b-43a63324c7dd", "value": "36KV XLPE Cable, 300mm\u00b2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8398a753-a02b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703181924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181924, "uuid": "dd226d18-a28b-471a-ab38-eac54b546657", "comment": "Malware payload (Smoke Loader)", "value": "513dd912f239cb4dd531adcd06b2b05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181924, "uuid": "7cdf2cb4-a8d1-455c-bb34-764691147c88", "comment": "Malware payload (Smoke Loader)", "value": "f518307808486c2718cd6b83e4e5f012e3531c8d352abd6d51b7311fcfa2c28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181924, "uuid": "bafddef9-5284-4e10-a732-6ddb02918640", "comment": "Malware payload (Smoke Loader)", "value": "568150eb17e763156855d63a43808c2a02cb5377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703181924, "uuid": "f4779080-31d9-40c1-b4e5-9033a3fb804f", "comment": "Malware payload (Smoke Loader)", "value": "5fb7d7d0d52b7805060525e989fa76a10e9d9de02bbb191c3efbe51aec03f243ad9e97093211ab91b8678422115f8ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181924, "uuid": "bdbf9ca0-9f12-4c65-bf28-9bc6c62a06af", "value": "T122443A5352E0BC50E9664B738E6EC6E8F61EF590DF4977AB12185AAF0CB01B2C173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181924, "uuid": "ca8229e8-87e0-43f3-895f-83b18ce35dff", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181924, "uuid": "49c71f99-6901-4c4e-81b9-6c02f8054852", "value": "3072:TWbTnLAOSaHCBX5hDWVLmEnkIJiAzne0+Mc8/OEIcv0JpwRNRQMdNYV2Bk:KbrLAfaHCY9fnnpw78GEIcv0oRQqNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703181924, "uuid": "cff1878b-068a-4aa5-a42f-61c77736f7b5", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703181924, "uuid": "6c079733-c46b-486d-8ef6-28f1bc8b4b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703181924, "uuid": "9e008821-ef25-4215-b41a-54f3f2275f40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9297089a-9fbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703135134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135134, "uuid": "a2038296-ef65-47e7-8d70-0153c3d8c0fb", "comment": "Malware payload (Socks5Systemz)", "value": "64364f9adee8531d197c6ef15f1e6d0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135134, "uuid": "16238f44-13ac-46c5-a446-665b27bc6209", "comment": "Malware payload (Socks5Systemz)", "value": "f573da1163ddc4c34f53f398d519db66896325464f1fc29de6d7b1b6d4fb9ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135134, "uuid": "756e01e6-17ac-4917-8fff-487aec923ef3", "comment": "Malware payload (Socks5Systemz)", "value": "8c175be79e0b4c725ce9e1cbb0fa3112e94390ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135134, "uuid": "3474ed5a-a4f4-4ce9-aeaa-c188b57a9bd8", "comment": "Malware payload (Socks5Systemz)", "value": "8dafbb2b72d36aa4fb0e848c81a9ae1b0ed5efb90f1f34508c10b194e87461eef878a3536e5edcd2ff360e6f1ed5b201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135134, "uuid": "f45d233d-d3fe-41a2-b09b-3c5b71c60d30", "value": "T1B29633A95D18F93CD805D5BC8EF886A9DFB16C73009897C0AC1B6CC9C9FB926500DED9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135134, "uuid": "68332d73-f0f9-42e5-8a34-84e53827698e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135134, "uuid": "5679c946-ec99-40ee-b19b-09625b402f39", "value": "196608:rvgBCMne/vpkBDrjop/yVxzrxbroMWsATc1kWvcjWb2jviEuFpF:roBCFxkhopKVxHBfXOQcj3jiEuFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135134, "uuid": "054eec16-0d2d-4713-8009-93424b55b9be", "value": 8836583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135134, "uuid": "b027d5a0-be20-4ac8-b677-17967c012e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135134, "uuid": "bec72f7c-be74-45e7-ac16-de5cf5635dcc", "value": "tuc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e2025b-a00e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703169585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169585, "uuid": "d373ae58-177f-4706-8abb-be77cdcf3a28", "comment": "Malware payload (SnakeKeylogger)", "value": "c1117172a2e97376213b2bbefb3491bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169585, "uuid": "4f71336e-25a1-4298-a844-c7dae2397cc9", "comment": "Malware payload (SnakeKeylogger)", "value": "f63b61933ecd47ebf5c5c79fb5e30c89852dc271dab0a6df17015392e1158293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169585, "uuid": "634459cc-a3fe-4e78-80ec-5e18b6eedbcf", "comment": "Malware payload (SnakeKeylogger)", "value": "b3751bf360dd1e85f33633e228b40c23329766c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703169585, "uuid": "04dce813-f157-4b42-a8d2-758d4e752005", "comment": "Malware payload (SnakeKeylogger)", "value": "0bfacb65353c82086b860ddd7090cb004d238b883f6642c77930ec7fd7964732080f97a8543fff9437c9def69b1b82a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169585, "uuid": "7c9ea2bc-0dec-4023-968f-a1f699204bf3", "value": "T1A9B4D01063E4872EFAF20378B97926646F77FD9B5422C39E5908B13D267331485B63A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169585, "uuid": "c90187d0-1b91-4a73-a305-5ca1b14327ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169585, "uuid": "a87a519a-62b8-40fb-bba1-3327fcd2e326", "value": "12288:YXiF3PPBQI0IrGSdbd4dHlCTO3pb2ASH1SrTlSdS:Ym3PPBQIndYFCT6dS8VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703169585, "uuid": "dbeb79a6-01ac-484b-a01b-afe148eded46", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703169585, "uuid": "3e0cc37e-35b0-4ffb-ae0a-7a145e11de33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703169585, "uuid": "aab20956-c112-4cd0-9dde-7f7fc50f66d1", "value": "New shipment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06ff8d5-a033-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703185516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703185516, "uuid": "af967b80-1b72-4af5-ab6d-7bdd3fdfdd33", "comment": "Malware payload (LummaStealer)", "value": "d84faf4734207609ae60c4f14d295383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703185516, "uuid": "c856f768-9052-42bc-b4f5-4e435a0add69", "comment": "Malware payload (LummaStealer)", "value": "f662b3ef913a9bfb62cb970e6f8f8e81ad75b21deaccffc01cbc1390f34e776e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703185516, "uuid": "9a227d99-d1fe-4099-8a36-9dda320fad0e", "comment": "Malware payload (LummaStealer)", "value": "05a6e0165fb2d08ce379b0bc39d9e4872a34b04a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703185516, "uuid": "447b2581-c5b4-44c9-a30c-3b9a12752092", "comment": "Malware payload (LummaStealer)", "value": "0e9e17470731e47b13e8054169a6d2b49ef7214904dd2adc6cc48009ec6afc08915c125a9cb00734f92aa258a3db9320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703185516, "uuid": "bb819f25-032d-47d2-8315-c74f32bb87a0", "value": "T1EA444B1352E1BC54DE664B738E2EC6E8B61EF5909F4977AB12189AAF0D701F2C173302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703185516, "uuid": "fe76cd98-7ee1-48b4-bb83-4802d67f255d", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703185516, "uuid": "8bdda727-6992-4daa-809b-db0b72239cbf", "value": "6144:2b7LAhaHC5vv1ssgpvTL4FHKB0y1+2depUBNs:oMheC/ssgFTEHKB1+k4UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703185516, "uuid": "ce9477bf-8377-44ea-b4f6-9f65e19887b5", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703185516, "uuid": "0f38fd90-af82-48ce-a6b4-ecf78e19a85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703185516, "uuid": "e7bda307-1353-448b-ad53-2966c96038cd", "value": "d84faf4734207609ae60c4f14d295383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa24b3d-9fc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1703135953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135953, "uuid": "b346661d-e2d8-43fe-967e-444493141583", "comment": "Malware payload (Vidar)", "value": "e23c839edb489081120befe1e44b04db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135953, "uuid": "52638b14-cb5f-4c25-967c-182e7ccc1fd0", "comment": "Malware payload (Vidar)", "value": "f68f73e9330202575e6476e37ed5bfaa11a52bfac4d1248c6fee5628f17c0cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135953, "uuid": "50ee1ff8-844e-4608-8366-7bba97acac73", "comment": "Malware payload (Vidar)", "value": "d57fd824ac54082312dcc23d2bca61e4d98f6065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703135953, "uuid": "14bfca6a-34e7-4174-bbe2-ce335823071f", "comment": "Malware payload (Vidar)", "value": "f6349c72edf47b33a901866de406ae09522f9c58b92a988e2c235462485ceb37b13f4610b29c1ce96c9ff6351af322d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135953, "uuid": "d309514d-3501-4380-875c-87ca8a5f01a8", "value": "T107642B5393E17E54E626CB729E2EC6F8B71EF5108F19376A5229AE1F04B05B2C1B3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135953, "uuid": "648a6ece-8462-497b-810a-44f474f1c2f3", "value": "24a8ecd73626ea109270e4a29851c3b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135953, "uuid": "948b2a8a-97c3-4096-88a1-40276effb934", "value": "6144:ZjLaN58Awvxfc4Y5YC/j8o74UhOfu8HV/7:tGN5xqtc4Yp/j8o1hUuOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703135953, "uuid": "562cd545-90a7-4b19-adfa-7155d2e667a2", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703135953, "uuid": "8300a2be-cebe-4bae-a333-a002227d6674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703135953, "uuid": "5340c586-f6af-401b-ad86-393e15ea6d10", "value": "build2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a5a8ce-a037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703186917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186917, "uuid": "c8108a29-4fe6-4651-bc11-e00e4aaff4fd", "comment": "Malware payload (Gafgyt)", "value": "5c4700f6721e1dd8723c681641569d1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186917, "uuid": "32008641-d88c-4d80-8122-7a560658d976", "comment": "Malware payload (Gafgyt)", "value": "f71cc0c7a7614d03a6ac4745e47f4e7c76d29bf61faeef65fe079a76b0d858df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186917, "uuid": "0f6cb03e-304d-4a91-94e1-8c4276725474", "comment": "Malware payload (Gafgyt)", "value": "9331dae026a88556dd7a10574607fa5c27d5a527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703186917, "uuid": "25c4d217-ec22-4bbf-9c7b-8a2c5fd615a3", "comment": "Malware payload (Gafgyt)", "value": "389bafae0e640639c7ee509794c2b87ad600d030d4af218d808902efbd30dd4af052f77aaa8b6e2d333724baceae56d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186917, "uuid": "292a8b54-9ef4-4739-a8fb-2fed9d335c62", "value": "T18EC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186917, "uuid": "c2e5a9c3-444b-4f26-9b8a-3c2704a2d1f7", "value": "3072:4jDy/+mh1vtbPIKatbpcUPium7/L7QsvmGfIiNb:mOJ1vxfatbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703186917, "uuid": "1ae1270f-5b90-4a44-912c-0cba279fdbbe", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703186917, "uuid": "6805e44a-a228-417d-8ccb-7765c1e322ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703186917, "uuid": "3060cbbd-0f57-4f28-a3ba-cecd8c0605c8", "value": "5c4700f6721e1dd8723c681641569d1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4574f418-a009-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1703167217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167217, "uuid": "197a3210-e5d3-4297-a41d-78e6bbbb4a2e", "comment": "Malware payload (DarkCloud)", "value": "18c42bc021d5d535cf55eb3b8de7df4e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167217, "uuid": "c6d1e8c7-1aa8-4000-9ca3-ace34a043a56", "comment": "Malware payload (DarkCloud)", "value": "f75baa2a4d3ec313c8dd15c44262d8f70a8c5fd1acd4be99173ffa492316df17", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167217, "uuid": "0ea3ee82-7a7e-43a7-bff5-0e47a3bbcb67", "comment": "Malware payload (DarkCloud)", "value": "be5d2d0bc3151c5223b13c23be6a9410923b0f81", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703167217, "uuid": "40a0aacf-5cd0-40bb-81c9-72eb9e971c6f", "comment": "Malware payload (DarkCloud)", "value": "9256235cfba491e18e288a1694eaeccf171e5854ea29d9929fb3b6fe7650ae2450cb68ffc2617e1f740c53dafd8c9a82", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167217, "uuid": "22e6390c-d016-4370-afc0-39746c68125f", "value": "T13A15E05767020A61C765A776CAB397000394F9BAA167D31793C9217E2A0B3FF1FE2742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167217, "uuid": "8e5c6da9-fa1f-4cb3-aceb-72db1f66c1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167217, "uuid": "042d475d-a60f-489d-bd24-b920239ae601", "value": "24576:T4e2KZtkmBDIJN+Pv+H8T2OI/zFYQhvHIiQHFxiajhSb:Tz2KZt1BDIYGHZ71IfTVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703167217, "uuid": "b722643c-f125-4fe6-9642-eeceff218757", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703167217, "uuid": "dfa6cafb-a866-4c52-8d09-c3fa75dce83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703167217, "uuid": "fc1562ce-99d3-434a-af3e-12addbf0f59a", "value": "Iwjvxg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf19803f-a02d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703182883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182883, "uuid": "54305c23-d132-4cca-bdd1-21ef967bd1e2", "comment": "Malware payload (QuasarRAT)", "value": "2e9ba9334449304220a549e7a75447f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182883, "uuid": "9d7b0819-a0ef-461b-9994-99e3601954f7", "comment": "Malware payload (QuasarRAT)", "value": "f859bddda5d049e5449032b8a4373515a6a06cbc2019f9fc1c0c269ba4d90153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182883, "uuid": "0d45166c-578d-4bb0-8036-aa749d7443e1", "comment": "Malware payload (QuasarRAT)", "value": "791d1648ee703e05b4749fcb99c8f45692e73787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703182883, "uuid": "025f2320-1951-45af-ae91-bbfdc1170015", "comment": "Malware payload (QuasarRAT)", "value": "fa9fb5b136df66eeae8885e8250bfcfbb86997fb0a0356d79988d5dd4998de5cbbac70119d51206fd245a86b4d0c22e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182883, "uuid": "37770e57-da27-40ca-9153-5f0be43d43c1", "value": "T17AA5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182883, "uuid": "8c358748-3d07-4fa2-aebe-811180b7032a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182883, "uuid": "d332ac8c-7b5a-44d0-81bf-ca614ce647db", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY1:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703182883, "uuid": "ad8ee7e6-6fd8-4382-9451-7bae8f2d413a", "value": 2110648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703182883, "uuid": "20a38e66-700f-4403-9d81-134f545dba92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703182883, "uuid": "09f57cb0-2b1f-4d82-b173-589827f2fab8", "value": "Adobe Download Manager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedd8f1a-a01c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703175689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175689, "uuid": "9d1d7bbe-654e-4c17-b1e9-33459c16323b", "comment": "Malware payload (Socks5Systemz)", "value": "8c8d67886630409bdb18df91a33d88b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175689, "uuid": "597bf141-2fd4-4ce7-a31c-58f63372272b", "comment": "Malware payload (Socks5Systemz)", "value": "f95e2ed824d17844bbe1277cf764fbc769bcccd8d38cda03ca30f4c7b98eedbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175689, "uuid": "70d9d3e6-86c6-4b27-b623-d692059192df", "comment": "Malware payload (Socks5Systemz)", "value": "1a3445e369fd8821c8c7f98dbe854ea041ca8c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703175689, "uuid": "eb7bd462-884c-4f94-ae39-e4600a111c76", "comment": "Malware payload (Socks5Systemz)", "value": "0d2ad6e8493fca7aa62467c51b1286646f6ed832e8ec774c141f4fa0c1d2ca494b799d245c69e167cc61e0cf56adcfa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175689, "uuid": "995e9a1d-b50e-4b81-a4c6-92186913f896", "value": "T1EA663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175689, "uuid": "018754ee-45be-4b41-8438-b1282d9f71ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175689, "uuid": "14390fe3-d5c4-417b-bca2-ecc3456ca93f", "value": "98304:I4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:zh7teThPZidcKj8fPz6+4jb1KswNdDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703175689, "uuid": "3760a5bf-3043-45d7-861d-b996732b5fc3", "value": 7054359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703175689, "uuid": "2751192c-ed33-4882-b7b5-b56a944a53c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703175689, "uuid": "a7df19e1-fe72-4bb5-9fdc-2c3ed92af55f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d48e02d-a039-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703187927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "535a56c0-334c-4e81-8804-9330d560cd36", "comment": "Malware payload", "value": "d0543990e88af04f28324659e85c8d21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "2e74f515-548d-4c41-a1ff-6f271a0de668", "comment": "Malware payload", "value": "f97af272feea9ccbc92c81139db9254c5b3f8219e48a1e5242dee04dc3b57d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "7a4e68a5-10ea-47b8-8a70-ee083b4c2a60", "comment": "Malware payload", "value": "af9af9c63959b3bcf95e85af80a5a6857d558f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703187927, "uuid": "735b7e41-810a-430f-9690-cfbea4cb5b51", "comment": "Malware payload", "value": "455fa7c6b46cda939ebe6427119ff34f04be73c4efb265788fa57a79d1f2d3a8649f8d2c2ac27aab22a08e542ebc54d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "8af642f9-6b3c-4136-a315-139d4cc72f82", "value": "T18E444A1352E0BD50E9664B738E6EC6E8B61EF590DF4937AB12189AAF0C701F2C173716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "323fb235-d0f2-4e11-bc21-0ae24744afd3", "value": "3ebfbb4bf01d3e1f5d7ff885e2b361c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "07018e08-92df-45a3-b7d8-7e1ed92a3b9e", "value": "3072:2WbonLAISaHCUORahXgXyqyKPPJSzKsXmKutteaeRNs/dNYV2Bk:HbYLAxaHCUO8hwb9o9XmtQsFNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703187927, "uuid": "4ebfc8c6-2266-4808-9a33-ae69c1b8b0a7", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703187927, "uuid": "4bba15fc-f969-43db-8e8e-23931e607a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703187927, "uuid": "a70d2e92-72b9-4cc7-9b5e-9274708c5771", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb780b1b-9fbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1703134800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134800, "uuid": "56deebbd-843c-4878-b63c-0228c6ca0985", "comment": "Malware payload (Gh0stRAT)", "value": "82182c7f430666ecd80649a3c9d4b06a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134800, "uuid": "4706fb14-d34d-48e7-9616-dc23ef287c71", "comment": "Malware payload (Gh0stRAT)", "value": "f9a0484222a37b48f410a2a1b6cfc204d0c6a3f722ca69aa0773c2c4f67bea35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134800, "uuid": "43bb5f8f-cbb3-4282-a379-fc412cb10bc1", "comment": "Malware payload (Gh0stRAT)", "value": "b3448fceabc6238ccfa04678c6a68148cedaf924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703134800, "uuid": "5723be62-6110-4eeb-9100-f08c4727fd11", "comment": "Malware payload (Gh0stRAT)", "value": "fde83214f1854fab2d65f291c4b03a2c7fa59b28f467bb204b3028e79a72636401ad583570e5745590fb0a2de74339ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134800, "uuid": "569d81c8-0cb2-478f-9145-80696313f935", "value": "T192B312A925663808E6F278B85D2F2CCD2D8D015895B3F45C2C5EC60027FF5BD72A92B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134800, "uuid": "9b66c9cc-5e48-4599-a38f-b9d902921a6b", "value": "e58ab46f2a279ded0846d81bf0fa21f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134800, "uuid": "6af1f141-6399-4193-bf02-f307fcb2912a", "value": "3072:AyIpG2/iDbYyEXcFHUZUMgJUYF+JddZCqNC:lIposRcF0Z9gJh+bd9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703134800, "uuid": "fb4141e4-25a1-440b-b1ca-b7ef60b7994b", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703134800, "uuid": "e04255c9-8210-46f2-89ee-7740a7b6ebff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703134800, "uuid": "c56b27b6-80ec-42f9-9378-b56285125200", "value": "lve5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ff3c62-a020-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703177122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177122, "uuid": "2f4c31a7-c85b-4fcf-a9a3-f39613d6a29a", "comment": "Malware payload (RedLineStealer)", "value": "68d9d6e2dd6fc05bfcf83a2d9597a86d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177122, "uuid": "d2524436-f5e4-476a-b187-f77be6b47947", "comment": "Malware payload (RedLineStealer)", "value": "fbd944b3e8ecf7b8f1a2b660441394f51509e80b5440973834d8eb41af30c7e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177122, "uuid": "c97b1599-50b1-4004-bdb1-90cbd9a6fb7e", "comment": "Malware payload (RedLineStealer)", "value": "83e3ff8608574026068a80a88c261fb74ae3fbf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703177122, "uuid": "6d4ec20e-b848-4648-ab54-cabdba69fc4c", "comment": "Malware payload (RedLineStealer)", "value": "e853d8b0126e8291867b91cdd981155b09a6afc0ba232660d04baf020963edf9e48eb42cb5be71362ea7a9a3d1067a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177122, "uuid": "5a8ff2f9-afab-49f1-ba55-e463d816825b", "value": "T15C563395EBEC58DBCC9507B148FB27930E203C62A770967E5A8C905B1C72791F9703AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177122, "uuid": "4b0896d1-b104-430f-80c5-81d1a6cfcf1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177122, "uuid": "97253376-324a-4579-827b-339c9af3517b", "value": "98304:sPsufn75TGV7oKNQcITWUu68xpV2RqZMRNhURjheVLRG7ixbbpBSxouhB:sPsS75TGlucdSgMRNSDeJsmxbbHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703177122, "uuid": "b27a8fd9-faf1-4f1a-9641-757b6dcc45ff", "value": 6428672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703177122, "uuid": "09f6b87c-2397-41a9-808a-0c254ae379b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703177122, "uuid": "bad9d2f3-ecc9-4e8b-b60d-08f037e1a418", "value": "68d9d6e2dd6fc05bfcf83a2d9597a86d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b749793-9fc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703139015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139015, "uuid": "ab255b72-01c4-475f-b5af-a099e95717a4", "comment": "Malware payload (RedLineStealer)", "value": "202ba429ba5a71165050dc8e8bb14297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139015, "uuid": "c8a5f94c-0443-4def-8a98-606d9b7de3a4", "comment": "Malware payload (RedLineStealer)", "value": "fd69bb9c704200cf842d1622c32a9a1e8b60300aa120aabef2ef7ac7a7286eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139015, "uuid": "8c4dcc00-6ea7-4ca2-9fdd-950951c4021f", "comment": "Malware payload (RedLineStealer)", "value": "7f180aa21f4fd88012702670f3eefbcfdaf4f086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703139015, "uuid": "221fb3e7-81f1-4e3b-b023-68080cb0cd5b", "comment": "Malware payload (RedLineStealer)", "value": "78e63a9b3162cff31b8a160e0250b570b75a10415b435bcafdfed5a7995030af5a0cff348db50ee868c7fa29c0e6513b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139015, "uuid": "2d5dfa37-98cf-48f7-b462-d245b6fb61d0", "value": "T1AB54E81382E9FF54E5A58B329E1EE1EC363DF6D08E497B6513189A2F04B20B6C1B3714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139015, "uuid": "39561143-37a0-4452-8206-e2c18d244031", "value": "a8b1db0ded57c5db8f40c241ff0d98f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139015, "uuid": "2ffc3cf5-0cc8-4f02-8def-cccc04fec0b7", "value": "3072:SJtDTawEkLzSwndQwuSxnsLWxWIRSFQgQ59uHO8FrS:8ZawEkHS2QwuSxsSwWSF6nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703139015, "uuid": "3c991c87-9301-4cec-84dc-78a19cac5fee", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703139015, "uuid": "cdc3d9f8-75be-4eca-832a-6dcd0bf34bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703139015, "uuid": "b9fadd04-fce8-4055-9ab9-73fb9d46311a", "value": "202ba429ba5a71165050dc8e8bb14297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1e49b5-a014-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703171958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171958, "uuid": "fcef8366-150c-44ce-96fa-116723b29ed5", "comment": "Malware payload (RedLineStealer)", "value": "e93a372ad426316a26d63208d739efff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171958, "uuid": "1bcb23b8-7189-45f3-abb7-8812fef1e320", "comment": "Malware payload (RedLineStealer)", "value": "fe17a2b74679743a0383ec1a775ea4ed77364884ac57990dd0b0a701e9bc69e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171958, "uuid": "234b66f9-c88b-4747-8cda-6edb1fe5bcca", "comment": "Malware payload (RedLineStealer)", "value": "02eae920c39a6ca25122c80bc9325159337fb127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703171958, "uuid": "e7208699-958e-4139-bd8a-766b2373c77d", "comment": "Malware payload (RedLineStealer)", "value": "a8e4c363cb34c69a22b4f5e57e8c215442bccbe856330db2d18039cdb162edfda0c297f2f4c81152193a211b3a1ff366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171958, "uuid": "f872e5f7-f84a-4288-b92f-34244d71232b", "value": "T129046B286359ED76E2BF02B5E4B240FC43B496266122FB9F5DC4BDE73B217C062111A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171958, "uuid": "e88c1fcd-2eff-488f-a43a-b76d586f8397", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171958, "uuid": "7655a614-a643-4d9c-b528-17e408993c63", "value": "3072:y0+7NknFPuDlQ664SIaqXhjEkvIqiDw38L1UAYTiE:d+RknFPuyrIaCh/vIqiDw3PTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703171958, "uuid": "cf918b96-3831-46fd-b630-8817b1c6591c", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703171958, "uuid": "e6bf3112-0d5c-4cf4-ae8b-b08b4b261f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703171958, "uuid": "6ec7b3b2-a97f-412e-8e8d-f779ec74bc69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0848853-9fa9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703126246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126246, "uuid": "622a3f3e-81ee-43e2-8bfb-faf601801156", "comment": "Malware payload", "value": "1a9c1d237843ca776d5d1d2ef84fb493", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126246, "uuid": "66d33a97-d5ec-4d35-8858-4f268d72158e", "comment": "Malware payload", "value": "fe24b35d98f29732b491f5cbfa8694bc8d1179efa3eb5e07883eb4a04caf09a7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126246, "uuid": "91bd81bf-a314-484a-97a4-bbcf33e2a3c8", "comment": "Malware payload", "value": "2a44672d41d879bc3a391fd868dae5e5d214d214", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703126246, "uuid": "20fdc15b-0f7b-488b-91bc-03263090ae6f", "comment": "Malware payload", "value": "5872db2bf24b5d615dff841281935c595f1fbe5b3c63cd4e7a8038dd7f4b74f5abd49efa3cdde27a35e6f8bffffec133", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126246, "uuid": "9c88b771-cc4c-46cd-a38a-eb4e7412d196", "value": "T10F55021663220826C7B19B34D873A7134656F6BAA6B3C34393CD613E611B6BF4FE0716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126246, "uuid": "134f340c-e551-4c67-921e-afd71f96722f", "value": "24576:6lb4BT0NUEOfoAygTWP6QD+oRKrhzEYjw1vMqYgHLRQ4DNw8ZC2kTRkPvV:6B4BTmaTWSu2hzEY81vNRQ4Du8ZZwKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703126246, "uuid": "2b0a326d-3807-476d-a7a1-6b9147f2689c", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703126246, "uuid": "83958096-37fe-4556-afb8-8fd6a5025fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703126246, "uuid": "bedd788a-c1e3-4b02-bb6b-9d3d2e04dcfd", "value": "1a9c1d237843ca776d5d1d2ef84fb493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4358541-a00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703168369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168369, "uuid": "6cd5f902-d3a1-494e-bcb0-d7590ee119fc", "comment": "Malware payload", "value": "8fc868f86ee50172a6135d3a58d3495f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168369, "uuid": "c7d0690a-1bf8-4d2d-8d13-cfc5f0e08d8f", "comment": "Malware payload", "value": "fefd30308f73092c122fe29921534fbeea6659c32dfd68fe234bcdbabdf8d1ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168369, "uuid": "38a0e4fd-e780-4c4d-a4d1-908a14509c18", "comment": "Malware payload", "value": "b26cd7a4ca5229e05e51068852539549b3838738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703168369, "uuid": "46ffaaa5-2760-445c-847f-263fa275366d", "comment": "Malware payload", "value": "a721835a98d5023a438e8e6055943f88c3863a22bcacdb350354c048ee4049d9945aeb93f5db7cb390ac4a474dfa7c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168369, "uuid": "5224a570-e273-4256-b201-ec62fd9f95fd", "value": "T13D66330CAFCE2AF6D05616B46E138ADD74F3FE6185315652F8ED8B929E03C59BE31102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168369, "uuid": "8d4eeea3-60d4-4010-818e-3789f9a2af3d", "value": "7106f7f21b5a6e69fd7cbbc19f3ecd14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168369, "uuid": "d16eb74f-b9c2-42ab-a14b-11d1cc2069d6", "value": "98304:oLRKr2ABiBQPGrOr17nGPVzN1iiriD0dbZHX7rYEnpMoC1y5EHuj4QdrwDOuL:oL5ABRPGSrlnGPVH7iDe0EpMoCSeuHG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703168369, "uuid": "c8e16b03-4ecb-4b4a-8582-b875eb0f1d63", "value": 6767696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703168369, "uuid": "18fdc3fc-8ab1-4ee0-a990-29055ac12e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703168369, "uuid": "4132634c-f3f5-4640-b761-52f2bb1d8306", "value": "SecuriteInfo.com.Win32.Malware-gen.14852.822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }