{ "Event": { "published": true, "date": "2023-11-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-22", "timestamp": 1700697781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3c6f193d-a258-4d70-91c2-3cd6a647b54c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac2c2d7-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662831, "uuid": "7b3e3861-d3cf-4ff0-a8ad-ee12f8b3f3b1", "comment": "Malware payload", "value": "5f0180f9750aee15a486a7c30b2bed26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662831, "uuid": "42e7f600-2b86-424e-8e46-e4fb5b88b217", "comment": "Malware payload", "value": "010ae6adee6452cf5d2583d396dacefccc6e946e35b3db1280dc9500d8c1666a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662831, "uuid": "5563aeba-dea9-4861-98a9-25d5a62ffaf8", "comment": "Malware payload", "value": "99e5068d60cef696c721f82bfde309fe66c76ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662831, "uuid": "774aa7f0-1fbb-4026-8c57-607aaeab5d69", "comment": "Malware payload", "value": "54193395aa26012d77c9c4e37204a9ed3e0dea694a7125dabe92ac4196c304751a51f0b260e977dc3ef87a194e7b925b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662831, "uuid": "0f9f41bb-7764-4a12-8032-3e977bc887d9", "value": "T10FD423032A9CC7A6D9B943F596116A5AF3F7625F9863FB4E1CC421CB2D66B000612F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662831, "uuid": "5b7c1478-d396-41e7-a03a-d47c0a15e586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662831, "uuid": "ad408803-d796-4e8f-97a5-81c8f73ee4b0", "value": "12288:V8oiZkeo66MoFhJxzuPuoYd1Ji94D6W9efvVINSysQ7kSkz9Sjx:2AjM4fzuGoYdDSe6ri8y/7kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662831, "uuid": "e5edc061-96c5-4ff9-8ff8-4867554ac7f9", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662831, "uuid": "8e12a0b8-300a-4190-93ea-25fabc063ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662831, "uuid": "dae195ea-21bb-40ca-900b-5972ea810f9d", "value": "Payments Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d604d5aa-8944-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700663923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663923, "uuid": "1681e931-d44e-4c5c-9cc8-5abb4c232445", "comment": "Malware payload (RemcosRAT)", "value": "849233e3d3a15ca626af742ceab7ac26", "object_relation": "md5", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663923, "uuid": "b907d98d-0e49-4b36-a688-3e05a7678e33", "comment": "Malware payload (RemcosRAT)", "value": "019e3b8495bea06de083b1aad9ebf51e101bd2cf128f7bddec72c7ace542b817", "object_relation": "sha256", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663923, "uuid": "df959cab-e810-4101-adff-15fd691be3a4", "comment": "Malware payload (RemcosRAT)", "value": "36919aee95286f242aaebb06832fb811482b6ab4", "object_relation": "sha1", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663923, "uuid": "09604c89-e022-44ca-886a-10b1f19f6d63", "comment": "Malware payload (RemcosRAT)", "value": "86671b0cd471f3bb1060a08c07feffedb649aee1aa7f1bc1cf2d31db6a05b36f2f49d3cc21c6985cc706a27028889688", "object_relation": "sha3-384", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663923, "uuid": "4f587406-dcca-4be9-b84f-96b85a7fa3e8", "value": "T17D742396F5DAC546FBF84775681EC0C59A0D85855C1BC37BA89C858733C2088E6EC8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663923, "uuid": "52a426cd-a4d3-486b-b2de-79bf665af403", "value": "6144:LVHsxIyc9+p37bTToND4pfPbuzvzAiNKPe/a8SQUuX4dV4gRw2vxWJX3ge8:LVMxX2037U8pfDCzAiEPe/aruO4DpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663923, "uuid": "6c899149-0ea1-4d4b-b3a0-281a8d07e379", "value": 360137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663923, "uuid": "309e820f-be0e-42a8-a90a-5b8f5e49b5a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663923, "uuid": "f326fcd2-6962-42e6-beae-32200dbf3f68", "value": "nFACT0865456789000.R13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49cd9af-8935-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700657451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657451, "uuid": "61d95949-31ad-4cb2-9f01-2c0f1129415a", "comment": "Malware payload", "value": "7444de976b23e0e546d8fa7424797bc5", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657451, "uuid": "7919979e-04a5-487b-8e42-d5ca43754dfe", "comment": "Malware payload", "value": "0388fcbfe28eedb3cc1b3ecca809073105b729a772d4bffeab30151acde67537", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657451, "uuid": "390af432-4f5c-4a10-aada-3927d5760be9", "comment": "Malware payload", "value": "3468456e2b9bbac47689df1b9d9c545c5ca7d536", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657451, "uuid": "b61bfc29-7b07-48e6-b7c3-6b7cfff9c277", "comment": "Malware payload", "value": "d9cd3f8b0b94a2f16bb0a45f30a8bd10fe7f96134bec0baa7c9daa846f227baca0d1fe97777ed8719ff0ad5e955ab087", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657451, "uuid": "1b939b7b-afad-40a2-97c1-f9f35891226b", "value": "T16CD4123875BEAB31D5925BF98022240043F7722F2475E71F0DC6A0EA7A61F216E52F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657451, "uuid": "db14e8c0-70e5-4350-9e24-bcc42c9eee2a", "value": "12288:xd1ELxFkPcRGqPfh/5GVOs06dQUywUJ9xQIUKFy2/RA7iVKYSb:f1OXkPcRG2/5GG6d4wUJPrFySR2EKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700657451, "uuid": "a5860cc3-7d13-4f5c-8af2-151e22bd5054", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700657451, "uuid": "963c90f0-55e8-4e0d-967f-71ceda64931d", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657451, "uuid": "0ec9898b-ada8-4882-a62c-ebcf38fdd5f5", "value": "INVOICE #901825.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c9c397-8966-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700678276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678276, "uuid": "fad953bc-b516-491a-8a5c-c2e5c4f4c37b", "comment": "Malware payload", "value": "1536ec56d69cc7e9aebb8fbd0d3277c4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678276, "uuid": "5bdbd496-0179-4268-bb43-7a2051d7208f", "comment": "Malware payload", "value": "04d09ab77533339a066c2e5f3edd52a698d917acc6bd9b6e5427763bbeb5fa05", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678276, "uuid": "415fab96-6e99-40db-856d-61c91d19bc1f", "comment": "Malware payload", "value": "dde025472535b16f153899786d7f63fbe748ca43", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678276, "uuid": "c098c7bb-c2e2-4db7-9f0c-1e1a4ec154a2", "comment": "Malware payload", "value": "eff91b33f1153dacab3ebab621b96e0c0372604794893aecc1a78f1a9d3eba96822a7f41ecbd03d200e3c65cbaff85b4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678276, "uuid": "09011174-3cdf-4330-93df-f909ea2c1c34", "value": "T19CD3AB2939EA1019B1F3FF816FF469D99F9BBA33253A512F00810B0B4A55E41EE5173B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678276, "uuid": "487702d4-5bd3-4f75-890c-070cf663dc0d", "value": "3072:cHxM8flJ5+Upv3DPrRzFkOUGpH/E/zrQhYkaxAgUxGu89IE/LX9gl:VUxa9IEbOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700678276, "uuid": "fa785730-6262-4cb3-b6b0-a81ad0ec9b2d", "value": 141910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700678276, "uuid": "40190aca-5e9f-45ee-ae26-8079f35f4bc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678276, "uuid": "f4fbd272-88fe-4118-9531-e02d06b0ec98", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac7e779-8963-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677138, "uuid": "357ec25b-eee7-48dd-9c26-9d06416fb89f", "comment": "Malware payload", "value": "c669e9f8d13decc727e092f433342bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677138, "uuid": "41a3bee0-3ac1-4241-a0cd-ded0af45a3a6", "comment": "Malware payload", "value": "05f3263e42656f599ba85e4caf4c867b9b8c91a2dddad24dc7f80389fed188e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677138, "uuid": "f87bba28-372b-471a-8280-e1ed435f687a", "comment": "Malware payload", "value": "7e51aa7b5d3ca07099c3c85b58c921612362054f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677138, "uuid": "9871aa99-48d5-486c-9453-a52b67418e74", "comment": "Malware payload", "value": "24a8b0e1df84bad90fed42b5dcb2978809f6ccbc106ede8e76bc5c490bc8cd101394debdfafda7a76a8632191386f120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677138, "uuid": "3d1103a6-b66b-4abd-80df-309daa37759b", "value": "T1AB559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677138, "uuid": "4b860ac1-efee-4b72-ba46-9d695b057335", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677138, "uuid": "d32b078f-6f3b-4fe5-965e-b4aa4c9a23e5", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677138, "uuid": "7d92ea30-a173-47d0-b16d-5e4771aa0e38", "value": 1322153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677138, "uuid": "911394fb-86bd-4198-8f78-c05c227ad519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677138, "uuid": "41a948e3-f159-4e87-9980-6291fd5ff444", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1318239-897a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700687162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687162, "uuid": "54907df9-aff4-4a5a-b5b9-ecfcaa29a3ea", "comment": "Malware payload", "value": "82786cd4b7fcf4fa40ead968ec822422", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687162, "uuid": "dc97533d-28ef-4542-8786-4b9b44ed0c50", "comment": "Malware payload", "value": "076a11cbc07285c28c441eba23de06c14c9926bc2c7009723d7b426380cd23b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687162, "uuid": "41b24a80-d291-4ca4-b5f8-0955689b50a7", "comment": "Malware payload", "value": "e921801cdf61e3dbf76fa57f6e38b255491f2fb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687162, "uuid": "76e4c6b7-bbe1-4673-8f91-0e9c86597ec1", "comment": "Malware payload", "value": "bbe794dad9bf4133c7e137e3d06a1298ab3ed40c1060857171d1f113654bdfa46a9e073fa911d167685f9b0357906b99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687162, "uuid": "5966d147-46e7-487f-878a-ce6bde0e4aed", "value": "T14B53FD427B9B0BA9E2844CF6A388750790E1DD2F356230B8FBF20167B53DB52B865774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687162, "uuid": "48a8f65b-60bc-474e-94cd-1b0967d15631", "value": "768:dC2qBQNRGQl+Kd818D62MHEU68Bba1KXLPo0jbU:S3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700687162, "uuid": "c3cbb489-5df1-41b7-a355-2b10a0b7c52a", "value": 62954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700687162, "uuid": "fbcadbd9-c1c8-4344-b3e7-543e72ba138a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687162, "uuid": "c9177dc5-2f7b-4356-95c7-92f9b48010c7", "value": "ms.php.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917de3fc-8904-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700636320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636320, "uuid": "98e90c4b-5e9d-42f0-8d58-7e9c54d94ad9", "comment": "Malware payload (Formbook)", "value": "c03304f61e279fd0608c9f45e978ba9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636320, "uuid": "15639d46-e3d6-4edb-90b5-6f840ef5511a", "comment": "Malware payload (Formbook)", "value": "08bd19ee270606f776e998984c478e35eb93b7a8eade7c4d945d2869ece51ed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636320, "uuid": "b47dbde4-eacb-4650-83f5-4b845a07b433", "comment": "Malware payload (Formbook)", "value": "0e25baf5f637cb53d811c28d0f110d1ed6e692f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636320, "uuid": "5513a373-2b9a-4df2-865c-f0b5da80faf3", "comment": "Malware payload (Formbook)", "value": "93d9c1631d62dd94850205e56ffe6e3479bb15929bfc7c8d640640c947da8c585cdcdbecf3b7dcd866bdbcb62863e858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636320, "uuid": "68fb2d26-6ed0-4fa2-b91e-f5dde8bb93ad", "value": "T1FCC4125327ACAB9AED3423F251AA52D253B2B40D6AB7F34F5DC251D91573F000622F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636320, "uuid": "1ee1e6b6-278f-4686-8a2e-6bd62c5a18da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636320, "uuid": "5eae3681-bc10-47e6-9cca-24bd61bc8a91", "value": "12288:38oUQsNpeR1lxn2BnlaJQyMpUEviTNcIkHd:s/QIpeR/pscJEviJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636320, "uuid": "ce0fdc9f-88f9-49c2-9193-4f7eb48e29b8", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636320, "uuid": "98bcbe71-36ea-4fb4-907f-dad0a696b2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636320, "uuid": "07e9f21d-898e-4e19-b772-3155d3729699", "value": "SKM_TR0020102023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed6705f-88fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700632692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632692, "uuid": "c17ba1fd-e970-4830-b578-391b5ac526c8", "comment": "Malware payload", "value": "b82247761ee7fef7e2f6dc266718226c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632692, "uuid": "c03e6548-8737-491c-bba3-85a07ed5ea97", "comment": "Malware payload", "value": "08cc8cfcabf0fe26de3d9bdfd6e705eb1e70f1b3e9f880f8a50cb1aee051cee0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632692, "uuid": "f0417f86-7ce5-4b04-b95c-09a2a2fade5e", "comment": "Malware payload", "value": "9c78d86667fd2ea32843821fdab6803ce027f6fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632692, "uuid": "979496b5-4f00-40b2-b68f-21dce102034f", "comment": "Malware payload", "value": "b311956b3206dfe507d8737d2b83d282f4ea8745ea7824bd919f2f564b70a2a8d9226164c0966a043bfdb28b928fa473", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632692, "uuid": "23a65791-b107-41b2-80d6-e09adda3ce0b", "value": "T196D62274BD8E158BB5F782F4A0B153C34BA83A34F6073A19E2B84BE310578799D93D16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632692, "uuid": "fe7e1cf9-b387-44ec-b4ca-5f46d63da1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632692, "uuid": "d61f139d-b542-47d4-a6a8-56d1a589e311", "value": "196608:XM+DPLHcHeGVSiUtWdoSAIunCn12M5S0Q5g25SrJshEPEOreEjr:XdTHcHeiSRWdo5IuCnYgm5g2SsV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700632692, "uuid": "137d70b9-4caf-4f64-9d8b-3afa532470e1", "value": 12832256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700632692, "uuid": "74eab2c6-d0ee-4052-a493-0ae8e5aae333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632692, "uuid": "d06264e3-dfcf-4798-8457-9b47fcf805f2", "value": "b82247761ee7fef7e2f6dc266718226c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95887b25-898b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700694309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694309, "uuid": "b470bdb0-eabe-4d2c-8e39-7f19631d4cf9", "comment": "Malware payload (LummaStealer)", "value": "abb7ea3cadb732b056ecb0443037a91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694309, "uuid": "e5a377da-2faa-413d-a672-71661d9db76a", "comment": "Malware payload (LummaStealer)", "value": "09c50e8ae5fd6440a64c8a76e89e06579b7b21821d82cdcd97dc9a2ebfe782c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694309, "uuid": "5cdb30b6-dc3f-4b6d-931d-f2f9d2ddc53a", "comment": "Malware payload (LummaStealer)", "value": "0923b27daca6cf1c9d007e5e9b1793b446096ac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694309, "uuid": "33f824bc-d916-430f-95d8-22008b92603d", "comment": "Malware payload (LummaStealer)", "value": "3833b39b979362dc21ba755e2bd42e1cac34108267dddf46f60db4a1f72f31982d764b4ccff122cf386c68b3cd2efc2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694309, "uuid": "b7046023-f2b4-4747-b836-8ca3e2a62c59", "value": "T11106CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694309, "uuid": "5a38ed75-c46e-4804-98a5-e89b0fa0535d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694309, "uuid": "f4fcd8bc-1089-4331-b6e9-99061346fe12", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYj:8AqA4bNMAeLVdWRC9bO2IyOnhJYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694309, "uuid": "e01e9fca-f799-4f4a-8d7e-35d95f0b0b60", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694309, "uuid": "4003ca47-1d32-4fa8-9fc7-6c76961bd694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694309, "uuid": "da2a0861-bc34-4652-9393-23e9bf14e326", "value": "abb7ea3cadb732b056ecb0443037a91f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a011dba-8927-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700651313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651313, "uuid": "baabbdb4-7b9e-4bb5-ba45-fd6802c8de9b", "comment": "Malware payload", "value": "4807e454d1bc64c3baa4aa35e43c3646", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651313, "uuid": "f5cc2102-aa05-412e-b7ae-1e36c36d6575", "comment": "Malware payload", "value": "0aec50e15245715818be57cef182f6cc4cc813092a74b249bbe19dea7556b07d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651313, "uuid": "1a4d324e-84c3-412b-919f-fc0b18d54e3f", "comment": "Malware payload", "value": "f501dad9557b90d946926752d9ecd4a5b5eb3015", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651313, "uuid": "c9e312f5-3d4e-49f7-987d-6fea0a2982cb", "comment": "Malware payload", "value": "550528fc7d2504919d07b0f466badde07c7b015560a0477e3aa424d610a416e44f406dd47054520c788b58c0c2216f75", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651313, "uuid": "615a7956-341e-4049-bd36-000d61b53fbb", "value": "T1EFE3566DD34F42A98F5253769B1B0E8502BDBA6EF38552B1346C433933EAC3C51262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651313, "uuid": "23a2484d-044a-4055-ab41-81443b249146", "value": "768:UwAbZSibMX9gRWjEeq4zc5aWn5Vn5q9dzMsBJh5QSNc:UwAlRlAzc5X5VOTeSNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700651313, "uuid": "cb39f0a5-b8f2-42b6-a036-7fed9f5ce26c", "value": 145939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700651313, "uuid": "1a00d20d-34be-40ee-8521-679dc0c9c3ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651313, "uuid": "b378d89e-b283-4434-bdcf-cdfb90e139ab", "value": "aaaaa.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402ff168-8965-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677845, "uuid": "b19515f0-29c6-494a-97ec-85cbb67e03da", "comment": "Malware payload", "value": "2239800bfc8fdfddf78229f2eb8a7b95", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677845, "uuid": "a142c64c-2674-4bd0-bbb4-ca0f0f552d3f", "comment": "Malware payload", "value": "0afc3ea3b44cd706064b8f16111c7cd9ed26a3037c32d5d4a028e8115022ec62", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677845, "uuid": "6d96e481-4639-40d7-8ed7-6664e8749ef2", "comment": "Malware payload", "value": "d07ca2500a5ff834bce1ac0fe99fbf20a3615cf3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677845, "uuid": "76ba812b-aabe-4a7b-b9a2-5bb5988a6723", "comment": "Malware payload", "value": "c02d464660039dd6890590107851d31331e86c805f4bd6c7f1449071742646bc16410e2d7ff98244f98c191acc98f4de", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677845, "uuid": "b1cf839b-0e44-4e9e-a1bb-841f636fc499", "value": "T1A8936A1539EE024CB1F3EF41ABEC54D9AE9BB5311A39A5AD10800F4F9742D81CE63B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677845, "uuid": "e191dd5f-15b8-43c3-89cb-d8ec4dba6baf", "value": "1536:cl2gKSjboSbOCRpSfKfH6a7TaUYwyDYiIt7WtFUzUcnMM08It6U3YOTF/:c6yJ7TvHAZcHCuOTF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677845, "uuid": "3b3c03bf-ed1e-4a1e-987a-6c5f9e9aea3e", "value": 92156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677845, "uuid": "18974f9f-08e4-4ea9-8e6c-b414e2c11c62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677845, "uuid": "ddd091dd-8516-4118-a719-c32a21df8ea0", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce41ba7-88cb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700611831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700611831, "uuid": "7b6af407-04ad-47b4-a6f4-8085a9484f36", "comment": "Malware payload", "value": "ac395d3a93dd79aa2ae44078301386f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700611831, "uuid": "3975eb7f-b207-4f2b-8d90-9b78cf71219e", "comment": "Malware payload", "value": "0c5c10338c54692916d5576274e98e04796bf50e436806c3021a7bd3457344d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700611831, "uuid": "c92dd432-7cce-44b4-bff0-67fef0559df6", "comment": "Malware payload", "value": "9a8a2a0dc0516a06664851d00371a4194f8d00fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700611831, "uuid": "c5e770d9-75a6-4849-9cdc-97ec275e2a76", "comment": "Malware payload", "value": "3dbb3ca1df56ca8606ef0f070564b80bf1defc6473e1e393afc08da51a728ce6e4a7e8c2ed1e4230a95c10fb8cf81059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700611831, "uuid": "828cf6db-97fe-4b59-ad92-59369887c3cf", "value": "T135559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700611831, "uuid": "ba31d768-59b3-41ea-9d67-3e7492c81b2e", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700611831, "uuid": "9e58b215-fd20-4a0c-8e04-8c3de3c9767c", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700611831, "uuid": "c2821a2e-3dd9-4178-8d84-74ab41402692", "value": 1322749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700611831, "uuid": "d864ad99-411e-430a-a892-d5fa2c3ece05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700611831, "uuid": "caf8fff7-4dfe-4bea-97ee-fa82e90eb4b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617705e7-8904-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700636240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636240, "uuid": "e78ba005-2fb4-4826-af11-645b3b68d0b5", "comment": "Malware payload (RemcosRAT)", "value": "c30fea02537874788fc379a2a5f59c53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636240, "uuid": "fcb26942-9ea9-400c-9075-e13e07be0fbc", "comment": "Malware payload (RemcosRAT)", "value": "0f9412ecf0cc7aed883fb1dadd80dbd59115b20ad5076b79854ec07e062b00f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636240, "uuid": "46e7f019-df65-4480-a657-4d9d83361c7b", "comment": "Malware payload (RemcosRAT)", "value": "1bdeef08a58704484cdb38665aedb8b8273242f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636240, "uuid": "338856bd-a49d-44a5-bb60-b16f4c8ba166", "comment": "Malware payload (RemcosRAT)", "value": "7544ca273d03cc2425ce6265cf7e6cf3979cb65bf738a2bb23f99bbc8ee6e5ebab022b0b8dc7ea208876fa1591a6d7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636240, "uuid": "7b00a824-f576-4cce-960a-b6167c2a1c92", "value": "T1C605234212F745FCD0CA86F054BD4C103AF854A35DA6DA6B824620E8CF77B2D9A93DF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636240, "uuid": "1f2aa21f-3318-4c6c-9090-52d9a1224c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636240, "uuid": "c308bb42-a7a9-4966-9191-422e755c2acf", "value": "24576:5F0KVlFqGyZkeCX0bhRcQMriFIVL0XnE:f0KVXwSeCX0VR7x/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636240, "uuid": "72826f9f-2b22-420d-8e3a-f8db33c69e7a", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636240, "uuid": "ac2ce43e-42a7-42db-9733-9805d61c6fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636240, "uuid": "58a1debe-a481-4176-956f-365dc78532bd", "value": "Maersk MRKU8781602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c360a708-8962-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700676777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676777, "uuid": "1c6e3072-8350-442a-8bb6-736dcf894125", "comment": "Malware payload", "value": "982e0396cbd0c0460e5c3c5afc407a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676777, "uuid": "3f87d74d-d67f-4619-b7be-556045c340b4", "comment": "Malware payload", "value": "124d2a615070c381002f048bdc6be8d84d78fb13418288031a39d10a55402e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676777, "uuid": "e12c4a18-94cf-4a04-9ae6-c77baf8fe79b", "comment": "Malware payload", "value": "5c128df3c9ee193a5a81516e1e1416c1305ea28f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676777, "uuid": "31e7f7fd-67e1-456f-b633-7d3235042447", "comment": "Malware payload", "value": "62f6f784c8f71738adcd0e7e04e4b73999aee8ef51db7b8786ab2bb1755dacc2dca1c82079507183f71a6160d97b0dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676777, "uuid": "f7cb278f-0c2d-4fb8-94c1-47d41cbf8282", "value": "T1940633A703DCA566DF4582F5723137D4DB545A818A3C2638FE58432BA946387ECCEB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676777, "uuid": "30e6fc6b-1216-4d16-8033-a877aadac669", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676777, "uuid": "a2d95dde-41fa-4dd3-9d96-de99eaca4924", "value": "98304:zIkTERKbQk6X9DCdrJ5LTdhJr95s+mJh:8KwgJHhiJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700676777, "uuid": "9c69b74e-47ad-4e95-91ea-53dfb13afd98", "value": 3687936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700676777, "uuid": "33e9e229-7f70-4a4c-bd59-31c72600f918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676777, "uuid": "287f4df0-6354-4737-a1c3-040870484a7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093f47b3-8986-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700691926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "b75a8498-d7ad-4ea2-8fbf-3142695143b5", "comment": "Malware payload (RemcosRAT)", "value": "0884e4d19d0cf7fc856efd0abeee2e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "e30938a1-0013-4947-a8da-b130f0ef52aa", "comment": "Malware payload (RemcosRAT)", "value": "1324fa6536148b20c0452f0d0d3930c77ca32d2abef6bae3f2019931d4a9517c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "216a24e4-e2b2-4c8b-8ad7-a1ae5e09c962", "comment": "Malware payload (RemcosRAT)", "value": "96eba41691ef92d473639763ec24d10ca70a411d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "8a074c17-21e6-4367-9ac9-330a275582cc", "comment": "Malware payload (RemcosRAT)", "value": "dc87f8eb70984f51ad38d8a0bc1cea79c5a39fdc498fc9dfdc6a4d5cec50453e640c030fb147270ab9d31a2bcf783a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "7ff3ec99-4f7d-400e-8c8f-bc5bbe14b38a", "value": "T16C842326B2D1C1EBC5EA4A703A6BF324D577C7064A0064CF4BF44F2B2579AC5D10EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "8671af9e-a772-4506-894c-eacaf76c510b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "f214f074-ae13-4f5b-8b99-35aee400b49b", "value": "6144:QBlL/TauirWZ6fw0JWEf7Th8PhTJrx6B1CxqmahJ02GrRELOKoN+sySfLoejoq:iJauCBfw0Jff7SPnI7CQmaw2GtEyPNye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700691926, "uuid": "e0127ecb-53a9-42b7-a360-cb8d77ba0bfa", "value": 373272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700691926, "uuid": "42c7df93-adca-4a11-8230-a96444aa2030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "fd24e477-c902-42c3-9d12-bf306e7e15fa", "value": "FAT09865678900.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125fcf02-88f6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700630094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630094, "uuid": "245a3a9f-6696-4504-ad00-a009e17f6ea4", "comment": "Malware payload", "value": "c7f9b4825bbf38b0b8c586817ac2d7a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630094, "uuid": "e2d4154a-9795-46cf-99e0-3b49fc8fbef8", "comment": "Malware payload", "value": "135cdbfa671ffafa1c728ec8f270ca055d20e1669cd809d72273da202028a64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630094, "uuid": "bdd2a107-dfcd-4f21-8d51-fcd0a52c4871", "comment": "Malware payload", "value": "dd3a66c18914fdb12b8f200772e30b443e299bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630094, "uuid": "305ee0f4-eaeb-46ec-b058-6455f81388c9", "comment": "Malware payload", "value": "783d8830dd4f68da9e43fbd1a0929093726481762d7fe98415274cbde33fe0e3726cf52affe37a889d7ca5f7745081be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630094, "uuid": "ae28a2df-d7c9-4a2b-88a9-52d1cd88eb43", "value": "T1ABE412823364C942C4E982767462857662E2FD4259E2F5CBB6C0F3EF227A618C7CD771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630094, "uuid": "3f28e4ff-3c01-43fb-8a4b-cf8dfd0383e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630094, "uuid": "2d7fdf4a-0b93-468d-8bac-df9db65e5b9d", "value": "12288:ny8oa+Ze7L0iTjzpJlVqptYlbX21UJPxY+0CpQC8244Xs/S5rVgYqxStHAAhMU:nFD++z/lV4k21UJgCmCsKdVgotH7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700630094, "uuid": "5179eefe-5411-4349-beaa-aec0ca236615", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700630094, "uuid": "4a03d3c2-c6c7-4f6d-ac24-e051ea4948e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630094, "uuid": "419f456e-a17f-4e8f-92a7-d547fe7b04c8", "value": "SecuriteInfo.com.Win32.PWSX-gen.1313.26475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5056472-8934-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700657076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657076, "uuid": "518676af-9a80-4235-887b-33bfc1ac932e", "comment": "Malware payload (AgentTesla)", "value": "c5af1d3dbe1d42dc0c2f2292fe4c871e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657076, "uuid": "e48cc286-1466-46ec-be3e-836329f9b51b", "comment": "Malware payload (AgentTesla)", "value": "135fa7a4b8fbf8306f9c6dccf854dd4668d156403b5b019bf135dc8428c998f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657076, "uuid": "1d2bc8fa-49ba-431c-bb41-bdf0cae3b7a8", "comment": "Malware payload (AgentTesla)", "value": "531f4de8a9b81306e1455ad66859224ebe569260", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657076, "uuid": "49b9d329-f475-49b3-8a54-3ece4e0fc72c", "comment": "Malware payload (AgentTesla)", "value": "0d78a4954d0df0735ebed5b41905d4e1725d3082b6deff6ab98cbd02e781da8cb574b2bd546e7509552f2f18ab0cb196", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657076, "uuid": "c7a3fa8e-3b9f-4cae-9a26-0ca3bc6c5a4c", "value": "T1D1B423E750E2CDD1774A0725345BD7EE12AFE2F6812085F81AF82F880BD31958586B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657076, "uuid": "ba501b09-df11-4f4a-987e-a093a0e136e9", "value": "12288:Jr3mYn5Hb+IZPBrS31b1sp/K/72DQ7dFdVMqFt+4tDtEPIc:J757/ZI31b1sp/+AQ7ZVMqF7tDmPIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700657076, "uuid": "164bd71e-21f9-4c58-a3d3-2a9f5fb19afe", "value": 528306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700657076, "uuid": "c853c9eb-becc-4566-b5c8-34291e5c3acd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657076, "uuid": "63f734db-5c14-4434-8e8f-081567a99106", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a65dcd-8973-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700684100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684100, "uuid": "0e7ea6df-e323-4825-a342-5d5cb334df45", "comment": "Malware payload", "value": "b0668b6a1cc6834248ed800b1519e96e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684100, "uuid": "de59d9a9-150c-40a5-8697-7bbc0675193a", "comment": "Malware payload", "value": "1388d124174c383fc4f84be5c90a8ae8a4632cf5531cf8f82dc45d1b92519adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684100, "uuid": "cc7d6155-3361-4e0e-89d7-a5e2adfbc951", "comment": "Malware payload", "value": "04291fcb530f2b49062f6cf0af574916e6d2174b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684100, "uuid": "c99c6a28-4477-448d-a71e-5974b91ef274", "comment": "Malware payload", "value": "99cf6a7b2ed8aef29f580a828216a3e2f874821a710b4591d9312ce3d8f5e056ca6030d877d32cff396c57e147bb0c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684100, "uuid": "5da93bf4-c250-4cd4-931f-2ee0db1ad910", "value": "T187F4EF23603CDAE1F8AD7EF2520507641BB66E5A0235E647D98F7DDAE973703C900AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684100, "uuid": "2d12d55d-9a0d-4db0-963e-5abc3a7c7124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684100, "uuid": "4ac3cf14-a499-4dea-8c1d-3151bb56d4f6", "value": "12288:c8o6xGPrVDsJtZuVXrTMQRK+1ryMoRgAqg9K6OoCiPC8eVfpA:jZi10ZuVXrAQ0WvoRg7gw6OoPCve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700684100, "uuid": "96e63b95-ad49-4827-856b-874019d90c9b", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700684100, "uuid": "fa9dd7b8-3e07-4f44-a57c-f122d603b3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684100, "uuid": "11c637bd-da2d-4af5-9974-edf09379814d", "value": "RFQ-10318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3008e2f7-8974-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700684261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684261, "uuid": "ab5b3163-eabb-4af7-8e05-46b861a7286b", "comment": "Malware payload", "value": "d090724c57674414e7c1829bf9472543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684261, "uuid": "32ba7ec8-1952-41f7-a1a5-cd14af2cc694", "comment": "Malware payload", "value": "1432039b9df958a7375524db980ce9441025a6c5fa8ab2bb854dff0fb50034d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684261, "uuid": "061391b5-2a1c-41b1-99f2-cc40724b619e", "comment": "Malware payload", "value": "5f9b11509b64e7d00401b1d86972f966fdca3b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684261, "uuid": "208fe10e-68cf-4483-85c9-a30f3ebc79c8", "comment": "Malware payload", "value": "26db59642f5feaa0c1a27b15ef176151ba3b155133f3beb0387add84fae07fb2d3762f98b914598bef07581b2421ba35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684261, "uuid": "ff48faa4-198b-4cf9-a65e-eddd5d856b33", "value": "T16094D002F7C188B2D57319315939A7166D3D7E201F289A1FA3E86D6EEE311C16235FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684261, "uuid": "839a4962-f332-483d-8857-debde61b3682", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684261, "uuid": "2b6f6e81-d5a3-412f-958c-1a44e2759d50", "value": "6144:8OYGXaPNxdgSdcq2pVZPOJHAbK/Y1QCPqwdbpZgBJDEFdkYnm:gGqN/XdctpVtkPY+bwd98EQYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700684261, "uuid": "b9106b23-995b-406b-9153-fe7dbcc5f027", "value": 413320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700684261, "uuid": "465266ba-dae0-4945-bd72-79ce9a79b05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684261, "uuid": "158b4fc9-7302-46fc-925e-3244422d64f6", "value": "\u041d\u0430\u043a\u043b\u0430\u0434\u043d\u0430\u044f \u211614-1839-7112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07de5de-897c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700687939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687939, "uuid": "baa08b34-6275-46d9-81fe-c0f6953ba868", "comment": "Malware payload", "value": "f5ef3feaa81059611b79ded01b578486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687939, "uuid": "a502119f-9220-4652-8d59-6c1dacdfa7d1", "comment": "Malware payload", "value": "143c6e7ae3ffbbb27ff67f0cae5b680b3851faa0c8879c1e892c6b7831675496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687939, "uuid": "ff3b184f-34ae-4697-91f0-6653b5d05e86", "comment": "Malware payload", "value": "685d12179574018397fb979a55d80b111b8f5e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687939, "uuid": "a1a0e30a-9459-4562-b6a8-9e1a0609487a", "comment": "Malware payload", "value": "2120f99b0edf5f92bdce94217391ead7c4e7b714ce87f322ab40c831cfc16fa0dd6f62e7580d16cdd945a10cda7478ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687939, "uuid": "a93c8d9e-5ad8-4baa-8df0-fb0b9976332c", "value": "T10EE4F18D766072DFC417C9B6CEA81DA4EA61A47B430BD353A45325AD9A0E6CBCF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687939, "uuid": "4145f411-2c0a-468d-b354-9abba7c5a868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687939, "uuid": "b9a15083-08b9-49f3-baac-80dca0247c4f", "value": "12288:yCfHy8ounwMgXmnJyZgu8I+QgawR5kwSrJM13PlKG5SF2h1MsALV9tp74:yCfFznwsJsEfQLMSru13PlKd0o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700687939, "uuid": "86aecef8-d547-4187-ba32-53801abffb16", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700687939, "uuid": "2e2d5bf0-0ec3-436c-af55-7e22eddae8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687939, "uuid": "142c9c6e-a0aa-4c94-a43e-bdfb0421b135", "value": "Commercial Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca37f5d-898b-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700694482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694482, "uuid": "9f753b8b-0552-4650-b53d-eb3f713b5938", "comment": "Malware payload (IRATA)", "value": "eaedfb1eb0eaab789da96136a9337e98", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694482, "uuid": "92c49f80-b71d-4ba9-8b14-2cdb457ba11d", "comment": "Malware payload (IRATA)", "value": "146a4cf0a66d567224a9943c140df0fa53656040864240f9c0d2f4b684c744b1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694482, "uuid": "5e797ae4-db12-404e-ba1d-81c015c42acb", "comment": "Malware payload (IRATA)", "value": "d420a159ac2205a35bc7ee6443cda614dd2e60e0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694482, "uuid": "c8e684ef-364f-4f36-9535-3bbc5ade0102", "comment": "Malware payload (IRATA)", "value": "6222c7ab26590a8ba8228dc3d31676abb87a15205e5b4ab451648eb77c994d2892ccd821be6e2988d06a496ded1234e4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694482, "uuid": "77927f9d-de13-49c8-b038-a31e376c133c", "value": "T1DF36DFD7F395686BC4F39372817623A5424B4C228F83DBC76914B67C28BB5D42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694482, "uuid": "4059956c-d2c8-4b51-bb28-72ec81d922ce", "value": "98304:RCUhEGU+oNm/n8e8wMjkgLCr8tkyDpMtmyeB547kz:RCGEGVoSgwMj/DDq7u47m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694482, "uuid": "0e5db80f-da11-499d-9064-e1b5d1e01c49", "value": 4954131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694482, "uuid": "f68d8873-fad5-43b7-9138-35fc4f37d1fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694482, "uuid": "a1186051-ccba-434f-9620-6750b7e55614", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaae108-8917-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700644557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644557, "uuid": "ca253766-fcea-411a-916a-d5a0e318038f", "comment": "Malware payload (Formbook)", "value": "b3921aae7e879df91211a4e41d84ea91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644557, "uuid": "f2060ba7-38f9-455e-91f0-1415a3c8a5d2", "comment": "Malware payload (Formbook)", "value": "14fbad2e4d80e603f383e614506f7340aa75f32dd929f1338cddc9469643c0e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644557, "uuid": "f3164545-c4ac-4a30-b43e-789ded70fbf4", "comment": "Malware payload (Formbook)", "value": "4a16de990c021de2da97bedf81b75e2608484b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644557, "uuid": "240c134b-6295-4d1a-b200-53f9c0f63202", "comment": "Malware payload (Formbook)", "value": "73c1f9d67bc4e53af2944b49e47890c92eb0c9e29ec647b5fe2fb20a005aca84e2ac3b47dfb2ae46b0ce752fd728d35f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644557, "uuid": "b59dbe00-1085-48d0-852a-c592453a618a", "value": "T161D42366B49DA7E5EA7D9BF12254240A53F2B12FA2B5E5C96CC020F53938F041B12F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644557, "uuid": "26ca627c-2b8a-4265-bde9-f4a87e4290b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644557, "uuid": "561d5232-a928-46ab-b698-cf5e57e49982", "value": "12288:Y8oqOLCMrg5y0jsEm9MbgVWmcrI5UFZKmnq88aJ0076oEg4/Sot:3tKWI8sHYgEmcrZF0mnq8nnfEg4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700644557, "uuid": "2afd5984-74ea-4bb3-bcc3-5e542f0d7a82", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700644557, "uuid": "8675a233-8dcb-4ebe-baef-4ee6c6edd85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644557, "uuid": "2a1a59ca-3de0-4c25-9056-f9eb60309b65", "value": "SecuriteInfo.com.Win32.PWSX-gen.8445.31183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7592c90-8902-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700635552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635552, "uuid": "efe8ad48-a49d-41b5-8fa8-953d947d8c4b", "comment": "Malware payload (Mirai)", "value": "79207c13b6f18b4d156b5e23511951f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635552, "uuid": "7b52d0ab-7105-4dd2-9187-dbffd3c545cd", "comment": "Malware payload (Mirai)", "value": "159c1c7bb0cefedea18923dd26ca5cf15dd9ea74b8602d6ade6da12dd389be59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635552, "uuid": "48fb1789-12c5-4f56-a69f-d743eb83d367", "comment": "Malware payload (Mirai)", "value": "cf21177d380a0e447e881fff200a18044def2ab4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635552, "uuid": "c14add30-34f1-41e6-a99c-a97a81a57520", "comment": "Malware payload (Mirai)", "value": "3c0fdc5283cc140d15a2b6e3a6d964d242210aafff32e5be5f7a9d76ed2d08f51e8fc9dd0af1e9b1039551ee9f6c4056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635552, "uuid": "d4337a60-27f5-49e3-8652-3efee3438b12", "value": "T1B9634AC8BA43D9F2DC1602B520B7EF338E76F5B6215AF983D3949937BC42A11950399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635552, "uuid": "8db4da7b-db87-4109-85a9-41b127350459", "value": "1536:Dc0fNarwa4HU8Bzi83gZP8SfjLBovCKe9Rbz3JZGH0ik:DOwa4HU8Bu83gV8S7LBo6L73eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700635552, "uuid": "169e7252-d806-44ae-ba2a-42b0ec882aaa", "value": 68144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700635552, "uuid": "ca9c1926-e1c3-43d4-86e5-b1d6c25be799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635552, "uuid": "1ceb28f5-883c-43aa-8578-334725781daa", "value": "79207c13b6f18b4d156b5e23511951f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7179596-894f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700668676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700668676, "uuid": "0e3a490d-830d-436e-a0fe-ef36a98cde14", "comment": "Malware payload", "value": "fca946a64207d8d036f71bd7c9f148fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700668676, "uuid": "bdd364f0-9879-4f20-82eb-5b344fa73f65", "comment": "Malware payload", "value": "167b628e6b915285dfc60db2f709eb550e5007d6a72470d06d6a95915c8b38cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700668676, "uuid": "64c3abea-fe66-4c5b-bb37-6f201eb667b8", "comment": "Malware payload", "value": "603c90959d950140d5c43049ceefc3f9ec7895b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700668676, "uuid": "d82d97af-187e-4cb6-a167-71541afb151e", "comment": "Malware payload", "value": "948a363c001595b92b237e61eb9c66b17dc3632eb42c0f232ee40fe860cca1019752615872a98e00672339dc107f3572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700668676, "uuid": "715c2521-5ccd-4f96-8ff6-97e8946089f4", "value": "T12CD591263A030812CC5910F2DFAE45DE8A084E721F78A55B2BC77BDFAF7D0C2A57A155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700668676, "uuid": "feff8c0d-3350-4a1c-91be-4a2f4c12bdf3", "value": "24576:FeGiWnp16ALhH5utBxeNFU7ZsJRfDbJRiNsexSY9RIPEAGb0hJ8z0/eyO/:4fALhHwyvU7qJRfxAKY4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700668676, "uuid": "1cdcfa1c-2e96-4d60-85bf-1a0fc0cc0890", "value": 2770432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700668676, "uuid": "0fe8f2cd-de7b-4dee-b333-071cf91d4667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700668676, "uuid": "7556f82e-d9ac-40bc-9c29-6a31b07fc0a9", "value": "ma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720266b9-8904-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700636268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636268, "uuid": "7a242818-158a-4cd3-b6fc-d91d695e39f9", "comment": "Malware payload (Formbook)", "value": "304a354af2dee276d8c1e9c427250799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636268, "uuid": "2147d466-001d-4377-993c-e11f17b623b1", "comment": "Malware payload (Formbook)", "value": "1765890faa9407e4000ade68ec2035c593bf8cbf1d1ff4d4d82f392ec9cec014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636268, "uuid": "e81755eb-80b6-4f9f-9aa0-95d0e2e0d155", "comment": "Malware payload (Formbook)", "value": "e2dce96bb2812ada08c765b3d24f9e6993fda5ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636268, "uuid": "8471dd0a-2dd7-47a8-8d71-6f341c1cd9a7", "comment": "Malware payload (Formbook)", "value": "0dc9d764c385fc73fb03ac2e09d4da660176cac5717fd3c08f33b42b3c37a4ecff751d4df2aa608285b3bd2e753ed8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636268, "uuid": "8a0d3d06-a804-4c1f-9704-5f2754f3e83c", "value": "T172D4230537305B31D4692DB6D5B43BD727BBC8838C5EE7535E0A23ACE1EA9834B21297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636268, "uuid": "14fd1e44-eb57-459b-82cf-3f96ab5d4e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636268, "uuid": "b1a6e20b-3934-474d-8f6f-579b86e00f64", "value": "12288:Ty8oy3hi/QBZDrZfxuZybeLTIi34GaP+hTeWDPfusE1NRbYOFJIcN:TFzhiIBdfMCe3t1h9Pf1E1NNYOFJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636268, "uuid": "94a462bc-a841-4582-83c8-8c42bff36644", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636268, "uuid": "d981873c-efc6-47b9-b587-284e7f475a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636268, "uuid": "753ecb40-a4f6-4441-95d8-a54d9f04eb33", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199322f5-8913-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700642562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642562, "uuid": "beda3971-3c3a-4ef7-83f3-c3b9f3956e75", "comment": "Malware payload", "value": "1e6112cdde1f3935e881c5cb778f3837", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642562, "uuid": "b934cc15-1ffa-42e3-823d-33c3b4e18c5a", "comment": "Malware payload", "value": "189fdb6bbc54e465b2c84518be689fa28e77052f9a0618fa1fc7abc859c1ccbe", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642562, "uuid": "c2afc189-bd77-4782-abb3-747a6a4b6d78", "comment": "Malware payload", "value": "aa31f99df107a55ebbb18819ac2da25815e9c39c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642562, "uuid": "08da2b94-bdb2-45c2-8bf7-90f8900a1cf8", "comment": "Malware payload", "value": "8569b77d27cbba82e1d512bc501722ab239d77a642227da00b4baa00c9aa3b85f1e6aa472e171b35f8679e66e58e63b8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642562, "uuid": "8cee1cc8-b566-4609-b12f-63af2b9aa1e5", "value": "T1FBC36BE4EFD401190D5B27E6EC4459B5C5B9846E4622003ABFDC339EA106B5CB7FEB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642562, "uuid": "30ba336c-40bf-44f7-999b-2466cd54347e", "value": "3072:KrSYi2fQDEi5XjPnM1Vlky7KeIXm/LaY5+//CmHfjP:sSYi+Q4i5XjEJ7KJ2+YiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700642562, "uuid": "ae44fab3-a42c-473a-9496-98f7ca855260", "value": 126988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700642562, "uuid": "154e60f5-4364-4d03-858b-7d2906084fb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642562, "uuid": "0341053d-4ce9-4fb6-94cb-693159eda1a2", "value": "order#6000067651 xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d2bdf2-8987-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700692380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692380, "uuid": "be818ce2-4597-4782-ae7b-914ee448aeb6", "comment": "Malware payload", "value": "a5e2251dec5614b891bdbe17d5f57092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692380, "uuid": "6fb6069d-b9f1-435e-b289-8fbee54b0420", "comment": "Malware payload", "value": "1ac869523a732caac2f9b3296174c60fd8ecc9e1c9cca3f991315a83cebcd242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692380, "uuid": "de28993f-8121-4ba7-9710-2838aae48833", "comment": "Malware payload", "value": "c61abdd8b84227a2b1d64f127119507c9dbaf5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692380, "uuid": "47cb73cb-5899-483b-ac29-00cb93021923", "comment": "Malware payload", "value": "dcf22c279125ee918b1182afdea0663f78dc281d58468af0977d141bf1e1de45dec0b385d2373403e21d1977c2cb6154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692380, "uuid": "6f0b20cd-dfbc-4130-876f-54fb2a382e90", "value": "T1FE559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692380, "uuid": "999a3ff3-8f0d-4398-bdda-1d90ef00081a", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692380, "uuid": "1a5a3567-5a64-4e2b-bb89-f9e5bae3e31e", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700692380, "uuid": "f74579a1-35ce-45f9-8210-f433485b82a3", "value": 1322191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700692380, "uuid": "50d73593-9d4c-444c-b5a5-0d690e2f3581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692380, "uuid": "34f57661-4b35-4497-967d-a5250e3d2c7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25deaf14-8983-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700690686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690686, "uuid": "4790814f-da02-47c2-b25a-cb94cca16fdb", "comment": "Malware payload", "value": "925727f8107e978d3440711c937f19d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690686, "uuid": "0187b5e6-aaf7-403b-b49a-bdb9bea4d043", "comment": "Malware payload", "value": "1d0103335dd4be903ab230bedfcccba1e76795366acea493297c593f22efd6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690686, "uuid": "586755ec-d8b2-4f00-a67a-3b490bea1d8c", "comment": "Malware payload", "value": "55ac179a20afe751d5793e1c43a197a946299650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690686, "uuid": "86823197-1265-42f3-9db1-d22116957447", "comment": "Malware payload", "value": "79afed22c83fbb5aaf751196907e48ab0e80baa6f9217897e141cf6af95e550cac0f18590f917b937626b5059e454e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690686, "uuid": "36a2f426-812a-4ec7-8b65-ff6a1eff66d2", "value": "T164953B1132F94B59F9F34EB96ABAA6150B3AFC698F11C6DF1251548E0C30AD18970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690686, "uuid": "959c5e4f-ab9b-473a-b033-02a8aa90ad41", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690686, "uuid": "7ccea021-eba7-41ee-b5bc-cab1319c7b4c", "value": "24576:ZqgTnJIRH4mD7GkbnFKO2h7e7w6a9Dhvho2QeonEXUgkho:ZqgTC4mD7GkbnFl2h6a3vVGho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700690686, "uuid": "5eb5a618-1e63-42ed-bd14-ea5ec46b2056", "value": 2019616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700690686, "uuid": "6c0c0ae2-6dc8-41e6-97a2-4c61ed1cf5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690686, "uuid": "f30dfc2e-2f2c-41d9-8be1-08d93cab3e99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da96eb9a-898e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700695714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695714, "uuid": "6800e534-b30b-44d3-ba3a-4c98ece3d41c", "comment": "Malware payload", "value": "7a793fdbb43f07758c96486a6b0be499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695714, "uuid": "bfa0cad4-c174-48ea-afb7-2d1c29a2b355", "comment": "Malware payload", "value": "1f07e15076b173ec8e047f0f1ecdded49ab8b5d379b9b43c692cae7897f8aff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695714, "uuid": "113f857a-2d5a-498a-b9ea-34cf70e1b2d5", "comment": "Malware payload", "value": "ce9533e3f3b750e6a11c19af594643251b0fc65f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695714, "uuid": "b0e533d2-a8ee-4aa8-a604-530fda61e7ef", "comment": "Malware payload", "value": "d526dc6fd838b6a736e3e8c89b136a07f5b2fe66cec4d4d9d440821ee9c46929c7c6af2a8dffbca503bfe761c573981f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695714, "uuid": "b21f39ab-1e4c-4e11-8388-d376072169de", "value": "T10185E0788BE5820FA4760DB2BC4371979EFF4F9A9C8083484ED9AFDC169B0DB2D06155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695714, "uuid": "823add3f-9150-4ed6-a648-c8bb910d9989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695714, "uuid": "31da5b5f-f48c-4628-8348-0eb0388c21bc", "value": "49152:ubClm3m4KZLkN67GdXgD13Mb4giG1m3N5e:uCxr1kN67GdXyM0gWN5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700695714, "uuid": "cb0a7a31-1aef-4763-8172-ebd41915f68c", "value": 1768856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700695714, "uuid": "0a6e591f-fb0f-4658-a8c3-ea97a1d07cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695714, "uuid": "7e9513ef-2ee2-41fa-b151-cb6106c1167f", "value": "SecuriteInfo.com.Win32.PWSX-gen.24530.32631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d19985-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700663008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663008, "uuid": "e1700081-9247-4379-989f-eae501c2095a", "comment": "Malware payload", "value": "7067af414215ee4c50bfcd3ea43c84f0", "object_relation": "md5", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663008, "uuid": "0891e0c0-33df-4528-b1cb-3d043524d37e", "comment": "Malware payload", "value": "2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12", "object_relation": "sha256", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663008, "uuid": "eb6e93eb-73d2-4a1b-8971-0f0d6f0ae3aa", "comment": "Malware payload", "value": "c331d410672477844a4ca87f43a14e643c863af9", "object_relation": "sha1", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663008, "uuid": "ce6549cf-4787-4852-a64c-721da9e581de", "comment": "Malware payload", "value": "d7492707d264e7150a59bc8dfc2e09633af1ca4711951e462c3a60ab64d1bacc60878cfda99e2019eaa734842393abd0", "object_relation": "sha3-384", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663008, "uuid": "bde12c06-26e3-477b-903b-2b2d6ac30604", "value": "T1C6D02B8AA1225037078102657EA094AF81C5A1188758B854B5A816255DA56301B8D4AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663008, "uuid": "18c3eb9d-99be-49e7-8618-7a3300b9eca5", "value": "6:O/oPn4xRPjwx1lDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wx6JjjqW2MePBPM/ioU8l6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663008, "uuid": "321c370f-b06a-4823-a7df-9c416e20271a", "value": 257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663008, "uuid": "0ebb3ddf-4b67-481f-8c7e-55103af0c41a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663008, "uuid": "fef15c82-95a4-4c15-bc2e-e46fac8cc125", "value": "NSM.LIC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2333a8-8926-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700650943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650943, "uuid": "1e4b5b10-e518-4837-a390-150b78814812", "comment": "Malware payload (Formbook)", "value": "7f45d3ae1250a354a3c0955e0414f9ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650943, "uuid": "05b882ee-5608-47ce-a04a-98833c31ed78", "comment": "Malware payload (Formbook)", "value": "206b596f2a06c33b636698217854ab8c417ae20f50ba59247a7a2bed74ccacf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650943, "uuid": "caef2306-bfcc-401d-932f-455d038083b4", "comment": "Malware payload (Formbook)", "value": "e2242211da4349bb85d1935831957405a4f98669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650943, "uuid": "0e757ee3-8c0e-4141-b7a2-3ac67e255b12", "comment": "Malware payload (Formbook)", "value": "9ff525bb4225922dbef624546149baf389872ff7239a5e288d2375f33f00061742dada28407b7c0e5833385a93b8405b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650943, "uuid": "94772ac1-5957-4838-bfe7-4302cb5c24b9", "value": "T10C540250A7948912D9F2C672183652F1DE7B8EA155504F870F903E8BBC72BB59C2FB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650943, "uuid": "39ce57e3-4432-4996-b379-689ce3586603", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650943, "uuid": "53adc8c9-1dea-414a-9405-8ee8fd5b818e", "value": "6144:TT4DtPsbFhPYwPL0cMVTmsmOriSyygpCFccq22SWJtC3yv9gg3rZ/m:TTAsbzPT0rVasjSFoF5qltCi9hVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700650943, "uuid": "7299782b-32e8-4e0b-94eb-3c35817167e1", "value": 297888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700650943, "uuid": "094e8655-4cd3-4530-b4c4-766b7981177c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650943, "uuid": "31539247-a985-4978-8940-d536cd1601e0", "value": "justificante de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0ed8b6-890f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700641007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641007, "uuid": "d6e7936a-0198-4f93-9204-a777778d9e15", "comment": "Malware payload", "value": "8cc25209a064fb1fa02e8bf02e2a117f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641007, "uuid": "e9f7206a-cee8-4bbd-a699-d341392287f2", "comment": "Malware payload", "value": "21536931ac4e233c220edad5495857d2295c4958ccc2a9c652a2ad2ac29a0210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641007, "uuid": "916dc306-b2cd-436a-a0d3-02f1255dabd6", "comment": "Malware payload", "value": "3ce60829f2cb87257619094b5c25802fe5eef256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641007, "uuid": "31bf6a36-e198-4e63-9f73-dcad5f09932a", "comment": "Malware payload", "value": "55c7c1936729cb1c9b4c7328f76e56737b3a6cd2f47dca626679157d5597cf59603a2ed19cac49836b6d9d2c7f0527fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641007, "uuid": "26fe39e8-b1b8-4b1d-8806-5e270b6177f6", "value": "T1AFD4234674252BE2F63A6BF444706A9543F33B0F5AB6E8261EC031EE1EB8B015721F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641007, "uuid": "8d42e6d8-25a7-41da-a445-5f53e03010d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641007, "uuid": "e8a13246-89d0-4876-98e3-d7f2daebac0d", "value": "12288:H8ooy6jNgTVPaCS9FEKy1oaUIb4+bPWlWwqDX8:cPy6iV5SHU1o7+4gHPj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700641007, "uuid": "135d2b56-14e9-4c2b-8052-443042953d37", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700641007, "uuid": "ea4782a3-0f87-43cf-80c2-755450d18714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641007, "uuid": "5c891e8f-9bd1-4508-869f-2a5a54a266fd", "value": "SecuriteInfo.com.Win32.PWSX-gen.26936.11493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba627fd5-8941-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662588, "uuid": "d46c00da-b1a1-4cef-9800-eb4f29174d96", "comment": "Malware payload", "value": "b866ebfb86a4fce148a4792e9cfcbd4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662588, "uuid": "8d985ad5-bf76-4e51-af33-b9dbccecabb6", "comment": "Malware payload", "value": "22b31d4b15adbf0a29af8b5d52e5fb9ac175b155eb3a0732d44eae4a173992e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662588, "uuid": "4c957d09-af82-4f9d-96c0-b2d689fd4be5", "comment": "Malware payload", "value": "59258592667d2dff104ce4560ff43d74de671995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662588, "uuid": "26f6514a-d256-4e98-90ee-187ed17fe4c4", "comment": "Malware payload", "value": "6f650a0e4770345c2c88dfc8309c3a7d2d012901241c93b53696509d55a0754b364469780aabe24e9c6074e9620e2110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662588, "uuid": "85913e7a-94c8-4c7e-94d8-ac60d65e942f", "value": "T17105AD83B35836CCFDAE43BB69C94A2466E2294609C2D60158B13FC57F21F4547FCA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662588, "uuid": "7137796a-7f49-4867-b555-2f6d46348b74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662588, "uuid": "4f1a5cc2-2a15-48f2-ac5e-117822367df3", "value": "12288:sq8oK/vY63ixmYzgS1Qo7aQJiGtejbt5ZDlNzA+0iz06RDATSkY+r:QR/EMYfTuXbjxtp0izRDAG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662588, "uuid": "c61fb700-05ba-4329-8853-7f0bbdd50ec2", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662588, "uuid": "e5aa113e-4487-40cc-984d-7cccc414b2f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662588, "uuid": "8b0f6496-a083-4257-9152-443070a3333b", "value": "SecuriteInfo.com.Trojan.PackedNET.2542.9692.8159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12acd3d-8906-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700637206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637206, "uuid": "2fbed6d3-18e9-4929-9959-f4e0d17a76c3", "comment": "Malware payload", "value": "6584334b5b107c4d54817f203f21ed87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637206, "uuid": "dacdb695-9752-4c16-b2b0-5a4225040c6c", "comment": "Malware payload", "value": "22c4caa24081fac55d2215bb8c1df3ab0bdc16125e387ffecbbb16150657ac97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637206, "uuid": "1827ae2c-fe3e-4a85-961e-e5e207c72612", "comment": "Malware payload", "value": "c43eaa127fd224f0eb4819b15ae419bf1aa12099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637206, "uuid": "25856999-48a6-4141-bce5-e19971ddcc70", "comment": "Malware payload", "value": "057852c27888e955fadbbce19fb7226139523f94a954807ceacf898d0908d26344a63ad586880800e834841f9b2a12a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637206, "uuid": "7c32395a-d5f6-4785-95e8-74354b52c05f", "value": "T1E4D4122339286BB7E56D17F18021508417F6BD0B66B6EA4B1DC674DF29F1B020F22E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637206, "uuid": "7f6b26fd-d2ae-41e9-b05c-992a7f71739f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637206, "uuid": "db4bce88-0b0d-49a0-aeb6-b82f56159d6d", "value": "12288:b8ohr9Rb82rwkWus0ckjdJcPeGbZ61QyfN1Q8EbrspTqr6Y46aJyBnt3KS:YUr9Rb8gwdu9cWa61QmFcrr6YZ9BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700637206, "uuid": "8980f571-26cb-4771-96b6-6194d9efc714", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700637206, "uuid": "eeb62efa-2b29-4fda-a79d-a492cf885edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637206, "uuid": "f6e65e53-7248-4808-9590-ade847c67ac3", "value": "new PO 0973692736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4599d48-893c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700660484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660484, "uuid": "ccc15f86-ad6a-4102-84ad-08644ccee82e", "comment": "Malware payload", "value": "6a23afbdeeb0d62a82585a6fee6a3d71", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660484, "uuid": "44ddd927-f13e-4b65-a16c-cb82454902aa", "comment": "Malware payload", "value": "22f159acaee38a5f6d16445b587b177493a0ead73b6d0e58f6fe913ddbf1f258", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660484, "uuid": "9be5bd40-993f-44be-a283-cf79f8f83fc2", "comment": "Malware payload", "value": "4abf5fe49a31c3208e3e07f1bf021486d8fecc97", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660484, "uuid": "c04d9ce8-1857-414b-b43a-e7aa86298a6e", "comment": "Malware payload", "value": "ffb1b0b708214fbd9bc5d2343771da1ca0d3b1d0b9b877cba7e0494f6c365769e19bb44a47bc82e26b25f577f2113273", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660484, "uuid": "4c51409d-a714-4bb8-8884-320e4813319e", "value": "T11F659E2076C6C436C4BE05703A6ED76B157E7E700BB188EB63D81A2E1EB15C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660484, "uuid": "99b2d298-a3fe-4b5e-bd09-31e1cb5719a8", "value": "24576:AB57NC63vosTi0cNOAqJAkMpYkAIvn9pBo5MTGq5YVJrTsgsFHCYdztdfG8NQGa3:45QCvosTi0sOAZnWkAIv/BoaTzuVJHsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660484, "uuid": "fe7f12bd-f276-4e5a-8c08-1fe58cb2eb96", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660484, "uuid": "fa80c44e-40a1-4a38-a4d8-dc9272d3e8b8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660484, "uuid": "8f2f5a76-f420-43db-93fe-a96cccbb561a", "value": "nf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5279f9b4-890f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700640939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640939, "uuid": "b5754422-cd19-490c-85cf-1cf518d8f371", "comment": "Malware payload", "value": "b8162dccc95c2ed40a3fd946dd127242", "object_relation": "md5", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640939, "uuid": "c8186260-090f-4f0e-a1b1-c0e117f746a6", "comment": "Malware payload", "value": "23ecba0be777d9b7a5683d0939d9ae17c4427c46e51ff959e91785d83c60efd1", "object_relation": "sha256", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640939, "uuid": "5fd167fb-2c92-47bb-8f9d-4938bbaa0fc0", "comment": "Malware payload", "value": "27899142d055dcce7ad3288028c8e3187421275c", "object_relation": "sha1", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640939, "uuid": "fbd73450-0e5b-4b0e-8919-8c6abcca2b08", "comment": "Malware payload", "value": "2362712e14cec5543e5dfbaaa7071b27b991de66907a19ddbd1d45197f4a743e4c13162d59abcc67639384ed8b9d5410", "object_relation": "sha3-384", "Tag": [ { "name": "ai", "colour": "#8C207A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640939, "uuid": "40971d3c-1fe0-4e19-aa50-3f4c488f3426", "value": "T1D8A46270FF02F12BFBC8D4F811B8AE0EC4AFEC8A76954951421A1695CF39B94F9B4548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640939, "uuid": "3dc9ab12-d2dd-4447-9400-47f305617441", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640939, "uuid": "b7377c2a-ac22-43be-917a-3d6c16317ce9", "value": "3072:AkBGWOsTIJgIDU5A/cto68pMABlZQ2wpFD0ravSGKBUGYDxJ0y5t8:A1ssjn5Mp2w7g+VKvSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700640939, "uuid": "fa5f6d1e-e174-4b7c-889d-d4ee5deb3e25", "value": 488104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700640939, "uuid": "0073b5cb-4c48-40a4-92b7-ac3e2231adc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640939, "uuid": "45ee0cd5-bd30-414b-bbf6-e4968ffb544f", "value": "Voice.ai-Downloader-alphaver-9aab5f151e93466090a2c1fe0b2e9d6e(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d935ea0c-8944-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700663929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663929, "uuid": "3598cab0-917b-4626-b6a8-281a1de90f2c", "comment": "Malware payload (RemcosRAT)", "value": "85027e318fee9d7267f30f087ebe449e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663929, "uuid": "9f4fbe74-ef1d-491b-8b25-e6b68322f024", "comment": "Malware payload (RemcosRAT)", "value": "240078f7aea5b0713ce09bf10b143142d51c35d3e08b852085bf975bfb590f02", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663929, "uuid": "fc85e84e-f054-407c-a48d-82941e9883f3", "comment": "Malware payload (RemcosRAT)", "value": "32ae4a192a6d46494ed88c786cf596dca6b7d252", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663929, "uuid": "0b2ddb6b-515d-4cdd-b532-42c31006b76b", "comment": "Malware payload (RemcosRAT)", "value": "36da01ae6ded4f659ab59b54b4ffabe999f44a8331b75196c0da2b17c7bde5ef65bfff5aaaf94eb4d2879a49c0e70546", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663929, "uuid": "ea433427-6ff0-4ec6-902e-ca2f65a7bb6c", "value": "T1D5842316B1D2C4A7FAE60BB1587EC3C5D72ED1041826C72B57A88FE736510C4EA984DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663929, "uuid": "4c3a7de8-a595-4489-8df8-864f01c95eb4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663929, "uuid": "408077e7-67f0-4c81-b0cc-f54f999e6c21", "value": "6144:ABlL/aYxGycH+5R7bTT6DD4pf/xuzvVA8hKPe/48SUUuX4dV4gPw2vxWJD3gnk:yMYxN6uR7g8pf5CVA84Pe/4nuO4L1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663929, "uuid": "36e102f5-df24-4cc2-9cb3-6a6dd8f4c6ad", "value": 373920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663929, "uuid": "a7e4777c-5665-4eff-8bb6-14f6fdadb9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663929, "uuid": "94483c21-80cf-4400-849e-17334952f543", "value": "rFACT08654567890K00.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c012b6-88cd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700612699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612699, "uuid": "6f9ee629-4cd2-4298-b884-1ce0afad4ab1", "comment": "Malware payload", "value": "bf15c68df0cae4731bbd973cb07ce8b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612699, "uuid": "4b49c466-fcb8-45f4-9a3f-2b1afcce3a39", "comment": "Malware payload", "value": "2535c11698e9f6e32edf1406ebc61f210122168c17fce8a4351ff08fe0de0c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612699, "uuid": "d93a91d6-4a10-41d6-913b-9b22a61b5bbe", "comment": "Malware payload", "value": "44d4df6b076eae9917163a365a878b9a312f777e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612699, "uuid": "1e7feed5-5dc7-4275-aaab-462a20219be2", "comment": "Malware payload", "value": "ff9688bd84602fce7ff9d12310bb1b8456a3fb13f78cfce06ce7af9ab129203d9dae96a77bf924bdb0152c36ed0e876b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612699, "uuid": "ce3aa7c4-f87a-43e5-a89f-70fa6b42c6c3", "value": "T1A5445C125391B861E6134E328E2BC6E7665DBB618F15E7AB2334EA2F04711E1CF63F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612699, "uuid": "8fbac189-575f-4006-8b2d-adfc43cf86f6", "value": "edffd74b291a0c850c46a44e0038abd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612699, "uuid": "2bae2e3a-2c38-43d2-802a-e4da3827c29b", "value": "6144:FXRIKr8D2LFDhMBFvvOfj5TJ0oXKWFR4q:Fh/8D2LneF0jJJ0qKWFRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700612699, "uuid": "45fd4f25-2c50-40f6-b9d8-81dc284f94d4", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700612699, "uuid": "885903ec-db1a-46d4-a3ef-a22de098d0a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612699, "uuid": "50505ef2-f841-4df1-9aa9-08ff559a2f54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba033943-8978-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700686210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700686210, "uuid": "903a2349-f343-44db-bbef-629f27a808e0", "comment": "Malware payload (RemcosRAT)", "value": "123d714786c87a95699bd0e09b54ce9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700686210, "uuid": "08aa86ec-b3c4-4623-b799-86d26e01a94a", "comment": "Malware payload (RemcosRAT)", "value": "25ad65700d96ab435cbe3070cc5189ade55537add318b907b57fc27b6dcf7110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700686210, "uuid": "c9cbcf3b-4931-4114-b7a1-b56ef3bd501e", "comment": "Malware payload (RemcosRAT)", "value": "b5eb9bc9fce502e296762ad93cc3d5c4410df8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700686210, "uuid": "28fb1f44-bcde-42a2-91e7-a3f89a5ad5c1", "comment": "Malware payload (RemcosRAT)", "value": "befea5f329b421fd59fdbaa27367c43c1b9dfb5d4c1babe26c19f6c4233833d4d486d84a33edab51c04530771c2931be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700686210, "uuid": "fe38d5d3-45a9-4a71-ba68-0eaac10128d8", "value": "T13A0523471A010ABBD368DFB7227FB1374BB4F826E45AC1154AC85E5E7469F10872A0F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700686210, "uuid": "e873c05d-d327-405a-a9ae-e03a4fb61aa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700686210, "uuid": "7c3daaef-61a6-46f4-a30b-d45e14fbec2b", "value": "12288:9uy8oiKcDtI5kT9w7zqTyJ043Ue2lRugAJrAVdtpDf2DqKXdS7vTu3LevhEc58xi:9uFgGtI5kWg9e2lRTAGVTl2W84i7evj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700686210, "uuid": "011f2b75-e766-4e17-a395-9cfe176d204e", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700686210, "uuid": "2b79de2f-b534-4f73-abb8-8e1eb7e67293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700686210, "uuid": "8514d996-9ba9-4e8c-9e8e-837f8da90711", "value": "PE09876500900000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0a1599-891e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647423, "uuid": "6da95524-04f8-4d6f-9cdc-0860988cf1a7", "comment": "Malware payload (Mirai)", "value": "22635f891e9e5aaf0bf090c383281876", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647423, "uuid": "195b34ff-9df2-4040-8460-b6349ea8abf8", "comment": "Malware payload (Mirai)", "value": "25de499bb58260cacf28eeedc60bd7d5c25abf99ec92c28369f54a30bec7343e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647423, "uuid": "a0fd7c00-2624-493c-835d-c6c37382158d", "comment": "Malware payload (Mirai)", "value": "0d68493468fb700aa021760008dc808a9901f44e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647423, "uuid": "aa9921b5-e829-4909-81f6-02c67810c932", "comment": "Malware payload (Mirai)", "value": "0613cd5811e581be0a074a7d4b7bf94042b6ef009d54b323baabc6df7cd01c23332f1b8228283c0520bb60917adb5633", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647423, "uuid": "218f669d-2305-4c8e-9f8e-0290fb646c10", "value": "T193E2F1E142E0DD6CCBB059369C7BC81B0F0997FC8AFB27561AAC37D869A24444A33657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647423, "uuid": "5425afca-59d0-4166-825a-f07e3ae3afaa", "value": "768:g8Lm6CTaRKzL4UlL9k0nnLywGEkEs+M9q3UELdN:dLJCTagzL4SlnL+Ed3L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647423, "uuid": "6acab392-07fe-4a12-a4fa-c5ea3bbf0de5", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647423, "uuid": "cfb4723f-f50a-48e7-a902-380db8cf11e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647423, "uuid": "63168a82-cf17-4be4-b116-ece9df967eca", "value": "22635f891e9e5aaf0bf090c383281876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5612419-8903-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700635924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635924, "uuid": "509ac5be-88cb-4306-ae3e-19fdb454eb0b", "comment": "Malware payload", "value": "e8536f1b0e5c15dba3ab0d52e323ce52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635924, "uuid": "3ab155e0-ae21-405b-afd6-41e93fd8fd09", "comment": "Malware payload", "value": "26194c26b5412d22a2d59b50efc917df3e05102a5b1d0895e5c199c58c377211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635924, "uuid": "3c94aa08-2783-475a-b94d-d6a6f98a1809", "comment": "Malware payload", "value": "76d811806cd946fab7914d8784e951a1f0f2f44d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635924, "uuid": "05536cf1-6ec6-4e1d-9c7e-73d0ffc25585", "comment": "Malware payload", "value": "4afcc787ea68157eff2bd6a2ef332536cfdb51a02adb53875c4803cb2c64e360c6e522574f5f6247fc6a572a327a5e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635924, "uuid": "f54ebf9a-483f-435e-97e8-ae2fd01c09d2", "value": "T111546B1365E0FC31C49607358E2CE6ECFB6EB8215DA58B7B26543E6B39302B1D65B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635924, "uuid": "81429baa-044a-4a09-92c6-e05418f76195", "value": "c001cbd1a4a4c74d1eb06d60e4b8b11c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635924, "uuid": "44e3121d-960f-4460-8c44-3c92b0671535", "value": "3072:wmh/5wB0miT6fYq0c5LCYDPKSvFdL7ujt3/t0L5NVIhzlvT4DxQAO:xswgYqpLCOdv3fuxVEVgZL4xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700635924, "uuid": "6d15daae-de1d-49dc-9d9c-a08ba48e327e", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700635924, "uuid": "2a7c52b6-fa0b-429c-a765-6556aa3147f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635924, "uuid": "7d7fd60c-a3b9-42c1-b66b-a3973015e7b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c893ea-88ee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700626642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626642, "uuid": "f4bfb606-7238-4f49-b85c-ed83e6556d4c", "comment": "Malware payload", "value": "848687af063d13869f5dc56bdc32c673", "object_relation": "md5", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626642, "uuid": "f3fb31be-dea4-4a06-9e72-fa6c66148aee", "comment": "Malware payload", "value": "272ccd5f4a963ab0f039046ff622008cdb9f91beb53ce64ff30aaaa59bbfa7e7", "object_relation": "sha256", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626642, "uuid": "b3703413-9025-44f9-8fe0-299cb79676c7", "comment": "Malware payload", "value": "ff7b8b609b5c2ae0e41e621dfa39d2d549dd4ab4", "object_relation": "sha1", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626642, "uuid": "20ef4662-59ad-4874-8e43-7fc7cc4f8d3c", "comment": "Malware payload", "value": "78aefe97fe34e750f315055aea2435c289f31d84b6d2fcadca2fbd56b436bfd91b02c9252a191836475d69aebd095315", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626642, "uuid": "70f7def3-b7ee-4fe8-9c7e-bbde9fe20925", "value": "T18F94237730FBB4C7D6FE07E9D6766436AA1C368CBD8A48504E2227CE5669D608049FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626642, "uuid": "b7695bbf-4eda-46f0-8861-b8bd1aafc478", "value": "12288:lgITUpAtUiRyTXKcH+W5G506SiNKS677ZJMga9:eITUpQyTaC+qeKS6Jugk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700626642, "uuid": "488a98b0-d065-4f56-904e-2335832df2aa", "value": 417199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700626642, "uuid": "88b6a4bd-f116-4b15-aca9-0372f1d603d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626642, "uuid": "f1d38531-d533-49fd-8023-54faeae48d73", "value": "GPT5 Pro for PC Installation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4b6c4d-8941-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1700662352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662352, "uuid": "902c0c2a-d9ab-41ec-99ce-b81df1e45f73", "comment": "Malware payload (AveMariaRAT)", "value": "e17420e728685a256ae3c845ba2c6c34", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662352, "uuid": "df4d45f4-495e-4bbd-b0d3-2be240e4a137", "comment": "Malware payload (AveMariaRAT)", "value": "273c7d66a2746646c43e4c870ea99def6bfb8d7210cafac4eeda64c50b2f8e83", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662352, "uuid": "3d83ac21-d62d-4c56-82c5-34b8a10767ea", "comment": "Malware payload (AveMariaRAT)", "value": "c4f3bc5379f6a0829214c00a1fa50fd689b4ed93", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662352, "uuid": "1bb8d5cd-e40c-4208-98bc-107e49598e3b", "comment": "Malware payload (AveMariaRAT)", "value": "66ebf45da555afd874131b707b2efc719b7fb4f3a589aaf04e350ad1662893cfcebf9d6eae89dbfbaf2df83a858d9bc1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662352, "uuid": "a8aba48b-4bf5-4e71-b8d2-f9ca04705fec", "value": "T1ED25AE83F481249DF8EA463779994F26E1E92D5A0D03190193B03F54FFBE9C297D0A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662352, "uuid": "77a34abb-929e-440f-a383-0f0c0d4e210a", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662352, "uuid": "19ea5605-d196-4056-a8e6-6f5eedf61d26", "value": "24576:HNA3R5drXMKUAA53vO7T+wTLsEfsVgFXNRoOu:q5Mz27nTLBs6FXNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662352, "uuid": "1909f2ff-71fe-4d3a-b4b1-21afd4070e2f", "value": 984226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662352, "uuid": "eb489df9-77a2-48fa-b0ad-64c4f87ccf8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662352, "uuid": "e8107fbd-ba9b-4a42-85d4-cf0e95ace599", "value": "z1RecibosdePagoconfechas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2635bebb-8943-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700663199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663199, "uuid": "6eecc842-a9be-409c-af36-e57d94111d32", "comment": "Malware payload", "value": "e12644b0f677e238a4f50a80bbb051fd", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663199, "uuid": "89bbf31b-8c56-4c61-b74c-69ec8bbb7dfb", "comment": "Malware payload", "value": "2a7aeb4d4000fc708ba4c0d05a96645615d2368fa2ba6a6fd3f78c81a7eb4968", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663199, "uuid": "d2f87f63-331b-4f45-b70f-52723491c9d9", "comment": "Malware payload", "value": "57d979a88095663b386743ab4fcef0e6e480eda7", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663199, "uuid": "12614404-d716-4e63-b2b6-701c75928d28", "comment": "Malware payload", "value": "0a1485116d2562c8e165f83d11c0a4b7cc09b797ab762483fbe9204811c22d4054c20c2617db7afd9a5e0a7901fc6d09", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663199, "uuid": "4aa6405a-746e-4245-976c-bbbb751850e8", "value": "T13F9422AE09120F259BBC572E137EA24939978A2C2710F95A774DD498E33833615FFE4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663199, "uuid": "f863ec56-cc55-447f-90d7-3baa1621bd5b", "value": "12288:W3KcxifAfaRDyIU2Pe7mZxu99580GFz5MAABD:WvaVZU2Uzr5oz5CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663199, "uuid": "ccfce2ab-075d-431c-b310-8e0038518242", "value": 440506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663199, "uuid": "4bfccb15-5df3-4b84-810a-329da4863141", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663199, "uuid": "b8e8ce99-5d6b-4c01-89c0-228c3c967186", "value": "nProforma Invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da36976-8920-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700648125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648125, "uuid": "2017fd8d-a9de-4f39-a20f-10ba86c78df9", "comment": "Malware payload", "value": "c0ef9d267c5557088c0724b75f1d10b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648125, "uuid": "e96ac582-2321-4030-aa6b-f32ae7896acb", "comment": "Malware payload", "value": "2b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648125, "uuid": "e9ef9570-e0b0-4dde-9ca0-f63bc3c2472b", "comment": "Malware payload", "value": "160a3a4bd2522bf2da9959d46bef2066d69b4e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648125, "uuid": "498e9d2f-5a96-4dfc-9660-3f7dd5d667be", "comment": "Malware payload", "value": "846fd2c9cc521339cc8584ab6130117034cce24e98840440e524e8ac6d462cbc3ff0e4a40d7cc26d69deea6e85e61249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648125, "uuid": "26758baa-5e73-4495-a109-6d96f5166cbe", "value": "T1FC5633461A830AADEDDF75B0C103BEBCB0F02B7A4996CA4C48DCD797D9772E502B1612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648125, "uuid": "1fc29a04-94bf-4321-bd7b-ee4bfb866cf0", "value": "4606041c7eb9dc2ea0c018ff25cd5fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648125, "uuid": "b5ac6a30-2614-4b9a-97ec-d5e7a8b161f1", "value": "98304:Pl1miR1gYgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJvHfc10YS29F+bfbJBQJqP:ZgYgNvpbXZ778hsIvY6j15fc1S26TbvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700648125, "uuid": "b38f5a1e-70f3-4003-8ac4-c6564e4aae78", "value": 6023832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700648125, "uuid": "42f7d860-d0c5-4ce9-b492-88c8749b3885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648125, "uuid": "5f368d3c-9c04-4891-9f9b-ebc38340c96e", "value": "SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.29544.5170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91496271-892f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700654788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654788, "uuid": "ef3711ea-08ab-4d49-bdd0-d19f122d3dc9", "comment": "Malware payload", "value": "2a90a7ccf98e12ba57583e1e012eca18", "object_relation": "md5", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654788, "uuid": "90703f35-5585-4881-b8b3-115a91f4fb8c", "comment": "Malware payload", "value": "2bcc8e7439a0170a9adb90d9deeec8675027ac39509a8aea8494700abbdb37b8", "object_relation": "sha256", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654788, "uuid": "15f7a0f2-bf44-435b-aada-485a938cd764", "comment": "Malware payload", "value": "66512ffb8c58d1444622ff64f189cd7db7dbde1d", "object_relation": "sha1", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654788, "uuid": "258d1fe8-0032-491b-baed-3e18d9566888", "comment": "Malware payload", "value": "2b292cf77e0a80b7886a047a9cec2ae74900714ed22f834e9ac7260ca0ed99d11e999d367c6168256f6f7c040cf22cc4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654788, "uuid": "027120df-d384-43cd-adf4-68e724cf390b", "value": "T10094E102F6C284B2E5731D325536AB11AE397D201F349B2FA3D469ADDE311827235FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654788, "uuid": "ac83f9c6-dcbc-4af7-bc21-6aa3765a631e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654788, "uuid": "c3f3753e-328a-49f8-9101-b79dd04e5851", "value": "6144:1OYGXaPNxdgSdcq2pVZPOJHAbK/egjnOtOjgndbpZgBJDEFdkYnC:xGqN/XdctpVtkPewnOtHd98EQYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700654788, "uuid": "054241a5-d0d2-4e4a-a249-582f6fbe64ab", "value": 439208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700654788, "uuid": "f580f180-4ccf-4371-b6c7-9aea83c858d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654788, "uuid": "f9ee63d9-a7e0-4515-bb31-648cad96d1bf", "value": "\u041d\u0430\u043a\u043b\u0430\u0434\u043d\u0430\u044f \u211614-1839-7112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a019855-8905-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700636710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636710, "uuid": "83180146-2c14-4f71-b5e7-bf632d349817", "comment": "Malware payload (RedLineStealer)", "value": "5eb52d8d6cacba971b26880c0754dcfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636710, "uuid": "3c08215c-90cf-48f0-bf84-3dd7206f67f6", "comment": "Malware payload (RedLineStealer)", "value": "2c46b4f2c31fe8cac74904e56a8da9677e048e521a8d189d003e8245eede2ac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636710, "uuid": "df40ee58-547d-449a-98f4-9194244fed95", "comment": "Malware payload (RedLineStealer)", "value": "61b6148e864ce84cbc6a6edba23149a6a5896f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636710, "uuid": "a7bc5a7f-d580-49df-9335-dea7adb672d0", "comment": "Malware payload (RedLineStealer)", "value": "c4ba347f8b919350a81e6ba05e7686a38292c249e99efa961b1794ead55c0bdf29f41b75824f066983176777bc836642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636710, "uuid": "73f63f2b-cc17-4270-a301-4a0a1d067d7b", "value": "T146C633F9AE4C7E78D4565235502140B907E5BFA2CDAED623863FE099B8373C250A7D82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636710, "uuid": "4b92adcb-0a70-4047-b94c-4f483c1b5c9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636710, "uuid": "a5ac73fd-53e6-4518-8fc4-6d9c7f79a3ed", "value": "196608:SOPJ7kaCxVl35vVMIbLQgk7OZH/WxWv8liUfh6QJh0yAc1G0lQlMvQqjNd:SOPJIaC3dMIbLtk7OZ8Wv3UfhGi1GGWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636710, "uuid": "3473a3a5-a75b-413c-8e58-48eb5ee7cbf3", "value": 11987456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636710, "uuid": "0d49a4df-56b7-4aba-851b-fbd43dd8deb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636710, "uuid": "d3823905-02f3-4516-80b8-4bfda79f2b34", "value": "5EB52D8D6CACBA971B26880C0754DCFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d562b35-893d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700660634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660634, "uuid": "fca99ff0-de8e-4da2-a966-1fa2186043ce", "comment": "Malware payload (RedLineStealer)", "value": "f4a69e01c63d9cbab97380585ebb68d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660634, "uuid": "81d74fdd-868a-4b3a-9c76-bf466617b63e", "comment": "Malware payload (RedLineStealer)", "value": "2d30c615e8b35d6d6e8ef9ed724214caa177d6d25c8c7062063482560921c3ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660634, "uuid": "64c1c9c0-ba59-4cc3-a9e4-f35117980150", "comment": "Malware payload (RedLineStealer)", "value": "26c23aeabb990db85eaf7cb9ab8864a63ce1457a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660634, "uuid": "ed66b241-ffd0-4cbb-95b8-b51d12c889d0", "comment": "Malware payload (RedLineStealer)", "value": "6d18a866833b7b8cfcba39b46eef2769675a35a99117bb17d77cdf1e6fb1435cc30c34ed5167002f4121fc5a6a6a0599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660634, "uuid": "fccd62ae-770d-41b3-89ce-4b66fe6e469c", "value": "T19CA52B1172F94B59F9F31FB96ABAA611083AFC69CF11C6DF1256608E0D21AD08970F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660634, "uuid": "c46c32db-074a-4684-be39-8fabca6413b4", "value": "c7fb2b0f7d1b9bb69de473555ebdc92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660634, "uuid": "fbf8e4fb-8a2d-4b6e-82fd-1b11bb1fd64a", "value": "24576:2ziodJIRDMXPGXnI3GMKC98j6a9DhvhNO4zu:2zioTXPGXnI3GMu6a3vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660634, "uuid": "8efacc77-1371-410b-947c-2eea3e93d4c3", "value": 2228470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660634, "uuid": "35a6133f-8579-42b2-973a-da7af6f52837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660634, "uuid": "0cd24e87-a894-4190-8d9e-65ee777c8a39", "value": "Soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15582531-88db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700618503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618503, "uuid": "3648a5c8-22f3-4bbb-bfc9-af984557ba29", "comment": "Malware payload", "value": "bd8531e9686b57161b1189ce1f6f282d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618503, "uuid": "1b32ca65-1ee0-46db-a5f5-c28dc89fefa3", "comment": "Malware payload", "value": "2de500618c8ba340dbbe615cef8df65d9864e8b6bee7fa78c16421a38b1bd185", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618503, "uuid": "fa9e1dd0-1a7d-42c9-be93-abdb2f060d61", "comment": "Malware payload", "value": "9579d0e4209274e1bbf05a9ff97da5533846251d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618503, "uuid": "ce309827-cfd0-457c-b731-96ea7c83220f", "comment": "Malware payload", "value": "5b87158503db96e62d4226d36a53fcaf64a9a176d791cf29f18359914ade5dfddad6f22cf836c9091d8830df4bb4ba03", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618503, "uuid": "e4c0ee24-4791-4cb8-b4c8-9eec01e19f76", "value": "T10506E087FB58992FC87740F249AE5231625B4D168A839B476D44371C387B6E83F8DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618503, "uuid": "3d9925fa-96ab-4dd4-a01f-a279cf539a2b", "value": "98304:Ag7V7JP2/CaLugPrnwW4UIBXQne22FdfoTYrqeKw/iIZ:AgjPiCpNWvM3LKw/iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700618503, "uuid": "3da52cf5-4d37-40ce-ae34-bdce2ff2a641", "value": 3973339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700618503, "uuid": "6609943b-cffb-4a31-915b-2d8368587fcd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618503, "uuid": "34fe8705-b5b3-4428-b169-4f457a17f695", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da488bff-897f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700689271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689271, "uuid": "ce219ee2-ed64-491e-be25-343a1bc5bfff", "comment": "Malware payload", "value": "e061b4b19ab70e99e11fb764b7a8e6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689271, "uuid": "412497c4-8e3b-4c8f-ae5d-ac898e856909", "comment": "Malware payload", "value": "31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689271, "uuid": "395def05-cdb4-40db-b1bf-bad30c74f65f", "comment": "Malware payload", "value": "a6f05208b7b3d46b44cd8d413ab782fd38dc843c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689271, "uuid": "b5a36c55-9a8f-48f7-bd16-9ca1fcd0d5d2", "comment": "Malware payload", "value": "bb32b2a429ea35b999757ecb8bad08f21f1e7558a5ed0554203db26c45dd812094782feaecea8d2ac055f8ed57b8da08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689271, "uuid": "7f5b5482-ae58-44b0-b5dc-08bd58cebb82", "value": "T14CF52632E06879D5C4780E309B6767F04BDB8E613452CDE727A4412F42BF2AB235A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689271, "uuid": "b1bdd80d-4c4d-4064-890a-173b2007ba96", "value": "071337bdac48f0dfbad94960251bde83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689271, "uuid": "71278898-95b8-433e-9a0b-7f4dd03a1d0b", "value": "24576:I1dyyz8mJsZg1kIFSBUlnOFhBc1OBwNN685bqgaiKSbb9Z7GpcFz9srUpBf:I1dJsZ2FxnOb7cpXTZscMwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700689271, "uuid": "3733dbbc-4f9e-486d-8f9a-74801a82826b", "value": 3348992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700689271, "uuid": "67cc223d-bad7-4136-992a-4a60abf07111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689271, "uuid": "9224e53b-e00f-45da-89a2-aa16348a6068", "value": "iyi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db70921-8940-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662057, "uuid": "76caa484-b066-4043-bdff-0bb41881261f", "comment": "Malware payload", "value": "e9d537c74f65526432eca9204ed44c0a", "object_relation": "md5", "Tag": [ { "name": "185-163-47-243", "colour": "#701FBC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662057, "uuid": "b5f626e6-51c9-4556-aac8-e2f14856c1f3", "comment": "Malware payload", "value": "320ede6948fb2f47b1fb93d4b719d9c89c23a2ede3c72649d8cab27209270f15", "object_relation": "sha256", "Tag": [ { "name": "185-163-47-243", "colour": "#701FBC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662057, "uuid": "d23ced61-ff1f-435a-912c-ca6c6736501a", "comment": "Malware payload", "value": "1f62466a09ed08961110fa5b9fb919ee2ee829b2", "object_relation": "sha1", "Tag": [ { "name": "185-163-47-243", "colour": "#701FBC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662057, "uuid": "e289458b-5ae4-44eb-85dd-d79d9d1a33ac", "comment": "Malware payload", "value": "41fb7a131cc5ff345e7bd5e2fe7d306c0a2f06a271f9c6b35a2fdeac7ef6295f6a3fd05bfcd38f6f5a97ccea21f9d13d", "object_relation": "sha3-384", "Tag": [ { "name": "185-163-47-243", "colour": "#701FBC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662057, "uuid": "9ba5b58c-ae13-49a7-8162-c22938700be4", "value": "T199017B621A5AFC6E5557F2C67AB403C07FE34110B44D353167800C8F3D36D6988EE9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662057, "uuid": "cd500545-4b4e-4af8-8388-c72322242424", "value": "12:6fxS2hz7YU+Sj8ZGShR8kkivlnxOZ7+DP981E7GXXfDWQCYnmSuHbdqiuYepaA7j:6fI2hzEPI8ZNR8pivlnxOoG1fXXfD/Yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662057, "uuid": "aa0af548-152b-4144-aa07-c8d06d341b18", "value": 701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662057, "uuid": "356493c0-6c5e-4f27-ad11-a35c37f81488", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662057, "uuid": "9671426e-d677-440b-b329-19febacd7291", "value": "client32_1.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f7ec8a-894a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700666237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666237, "uuid": "a922ec51-f29f-4e27-a4e7-dde52afd8633", "comment": "Malware payload", "value": "f06e1768343b34e8b974de3256da7b6a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666237, "uuid": "1ab1b97a-e5db-435b-88f0-63c55fb34340", "comment": "Malware payload", "value": "32db927e746e182c80dd1d8db9db1a28c1c9ffba0b8f7ba423a598195d66d8a0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666237, "uuid": "f2ae969c-a50a-4f58-9a54-a3e9bbc7422f", "comment": "Malware payload", "value": "5c3e6ac4b08e1854f8a04847ba8670a7d9a632d2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666237, "uuid": "beb88833-8c0f-453b-918a-ce265f387cdf", "comment": "Malware payload", "value": "d137eb804162ba6e29a721eef4b92b69ce768eecc725bab532d052b618e646faad07072b58c25841615c521e464cfe58", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666237, "uuid": "ff09407d-84de-4a1d-950d-e808667b45c7", "value": "T14FF4CF1176C79632E1AA033135BEA7A01B7DFC305EB1864F9384B69D2D712D09369FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666237, "uuid": "4ca2a178-1498-4de3-86df-69be573bbfed", "value": "12288:hNURUFb4H6KJF/pDYkw0gCvoKWg6AZznX4kB9LyYsgFQS5gVQRXDw3ghjbDA:hNDOxtwYXNB9LyYsgFQS5gKHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700666237, "uuid": "8c66a860-342a-4590-b067-9381e81a5cac", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700666237, "uuid": "39e91864-11e0-44c7-8be0-4ab4b81fdad5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666237, "uuid": "8632fcd1-7279-4f8a-a85c-a0616f8cdfe6", "value": "GoogleAI Pro for PC Installation v1.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5c0d80-8944-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700663935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663935, "uuid": "3bab7154-fda1-488c-999f-f82d577affd4", "comment": "Malware payload (RemcosRAT)", "value": "49bf94149036b79f5b8f1350dde4822a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663935, "uuid": "5d7e3b30-4a8e-4a18-8eea-9804403344db", "comment": "Malware payload (RemcosRAT)", "value": "350b880f0d6decd8465dd8ae66631ef343049b3184d8dc1c3dfdac27a2e7f044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663935, "uuid": "c6b0b5a8-dbdd-4462-9b62-ded343a3ba97", "comment": "Malware payload (RemcosRAT)", "value": "682fa9beeead55b00c9b088094f8f7a1c7ab47fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663935, "uuid": "8bcadd55-e943-4cb5-9e28-500e2f408375", "comment": "Malware payload (RemcosRAT)", "value": "2c73b9d4a68f608a87427d62566e89de5ca59655892f93dd42034030b53f818e34899b7a04f1d2570bf3b5be44ec01b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663935, "uuid": "ca3c8d5a-e09b-454f-b02d-2d9e9ecf7a3d", "value": "T1B45401005BA4C86BE4E1863268350AFEDEA79CE198505F0B1F60BE6F7C326B5452A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663935, "uuid": "f73f1fc8-b159-4c7c-8b2b-e5d9f6f16899", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663935, "uuid": "93e77304-59c0-41a1-8504-e2455d9f7416", "value": "6144:gT4DtPsamsHBrJw4FkSxwojgO05YKxdLjdaZWAYjjuirZEZb:gTAsamshNJFdbkxdSVquNZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663935, "uuid": "34576f2a-9a88-4e79-a3f1-32802fd6992c", "value": 290544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663935, "uuid": "a70d7fdd-7532-4f8f-ab00-3942bddfdd26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663935, "uuid": "3edd9b61-f66e-4830-8e59-0168c914fca5", "value": "rRFQ0588904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16b60f1-892f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700654896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654896, "uuid": "1b36d3b2-cea7-478e-8550-ebb1a49b49a6", "comment": "Malware payload", "value": "ebad1f6a6d31d3bc41c4dd032c65b5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654896, "uuid": "85339318-7e14-4e1c-a557-624687b367a4", "comment": "Malware payload", "value": "36316d947ad6892d08d04e0508b0cc08640f64e3b22b7e28c0830862cd9a151b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654896, "uuid": "0244ac1e-088a-4ea1-a615-5b4bd54aad37", "comment": "Malware payload", "value": "27a35676e86151d4f9f48ac2ca97a7bffdca79bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700654896, "uuid": "34bd9a5e-d011-428d-863c-966655341d0d", "comment": "Malware payload", "value": "bb95e9c20db7d59a3c68dc408eb1d8264b9ede890f95d6e1ce479dce0afd150da51aa31c11f8f82e1095afc53a2a1c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654896, "uuid": "f440c10c-2769-4c7a-9ba4-f84607ea5c51", "value": "T17E06336A2A60EECAF1FF417A933A08207693789097EF77257D1FEE50A5301496FB501C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654896, "uuid": "05a0f6e5-2a4f-45c8-be40-86b37bbe9670", "value": "1f416153d5cef91bf0d9c0b7f434d966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654896, "uuid": "efdf35e6-45ac-451d-a3ec-c80e6de2010b", "value": "98304:U/mPsUJQZ5BLHYl3vKQLLh4JE8Ls+0bGAN:PkuUL41td4JLEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700654896, "uuid": "18f71ec9-6b44-4085-a317-ba9adfd0c1e9", "value": 3964484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700654896, "uuid": "c1b5a99d-cdbc-4f15-86cd-a7831000e0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700654896, "uuid": "c22dea1f-65ad-477a-a526-4de53e506a25", "value": "KEYGEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4becf2cc-88e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700621171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700621171, "uuid": "2402734e-deb8-46ac-af88-468208f54364", "comment": "Malware payload", "value": "ffdb7ba3b7fcd9e02f1d1d185e9a1888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700621171, "uuid": "4d80d183-a7ed-41ef-a972-2d05f183aeb0", "comment": "Malware payload", "value": "36b09681f86888e59266dde33d69d3374b85ea8f68f9993b45ebbc6c29432e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700621171, "uuid": "95f36fda-fcde-4fb5-903b-a4d732f25c29", "comment": "Malware payload", "value": "c37eb7593d1f4ac7b9dbcbe86b02de4dfbe4a65b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700621171, "uuid": "547ce2e5-4c13-4590-aba5-318adfe94d4c", "comment": "Malware payload", "value": "0fa0891d3d203127c21a6454b6bf442f44b5b6517b82389abacb344dc9a7c0315e0e2e09bb2e30078e8d81f31b0e4b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700621171, "uuid": "721bcded-ad42-471a-8ea7-b198f54e8264", "value": "T1E9559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700621171, "uuid": "42530cbd-897b-4dfe-8f70-5ac3f9907394", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700621171, "uuid": "59096973-55d2-4ebf-8810-8acedd391471", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700621171, "uuid": "3077a01f-59fb-4b7e-b418-c60ea9b5ae24", "value": 1322002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700621171, "uuid": "f13d1429-99a3-4353-8b9d-f5e988246d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700621171, "uuid": "f9f8a38c-84ee-48d6-9c1b-557f89ed5c96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0244261-8965-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700678114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678114, "uuid": "e11e56e8-c85d-4953-b99c-93f452484bfb", "comment": "Malware payload", "value": "4c2431e5f868228c1f286fca1033d221", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678114, "uuid": "4378fb01-1723-42bf-adee-4e261db46d22", "comment": "Malware payload", "value": "3847eec2194dff08e78cb53f4f82e21279f2404e75141a6c49587174ed778e0c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678114, "uuid": "817cd86a-813f-4f6c-be61-bb6dd714ac67", "comment": "Malware payload", "value": "4c6fba17cbe9c9ba4d2820159446f6a5f4af2130", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678114, "uuid": "b29f5128-0460-43a4-839b-d629f63a275b", "comment": "Malware payload", "value": "3c1756225a66b9838f69079afe54d209c66f92be60309ed0c78a72802976ac8c8f2af07b22560e53ff426847fc289278", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678114, "uuid": "6661f4a4-86c4-4b0c-b3b3-7a2b0c07b7b2", "value": "T1CDE37C6934FE001DA0B3FE536EDD24EBCE5BB939292DA44A2481170F9791D40FE22779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678114, "uuid": "5ee16771-408e-44a0-9fcf-49ea633eb2cd", "value": "1536:QhhjxQKfAVLzezXwBLzchcJedZTI2Oa+kQSfVy/12lO7ehITLsno6HdLb0SXyr8B:sc4UaXjmtngnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700678114, "uuid": "85ef984a-f44d-4a9f-8192-c5725e5fb4ab", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700678114, "uuid": "4dbcde11-8395-4b21-b79b-a076dc8f0fdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678114, "uuid": "2bb37b8e-a6b1-45a8-99d3-6da19d5e986d", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f647ef-891e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647408, "uuid": "ecc64c24-de63-4c81-8c1e-1d7629bd48f3", "comment": "Malware payload (Mirai)", "value": "2ba0bd42bf84ba6244579ce10d98a020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647408, "uuid": "b936a3c3-b80b-46e6-9786-e9514829ebc1", "comment": "Malware payload (Mirai)", "value": "394abc867b18adfc254172ff3fa25b7b5db9b7e26b06dbbf8ab44d337ad5a0f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647408, "uuid": "256882de-9973-4302-aef5-d861d2a795ff", "comment": "Malware payload (Mirai)", "value": "4be9b2ab8270ff42659236137618c86f23b25e4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647408, "uuid": "15b66989-ee30-407b-a544-eceb1e8b400c", "comment": "Malware payload (Mirai)", "value": "06e33407a60ef940d9231d61ccb3ec8f484d0f0fff4b9ec6dd3943ebbd78bf8eed7beeb23f9f7acfc9354f6410a26f5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647408, "uuid": "5e22dd9a-fa08-4dea-88c6-1a1ff6a981e9", "value": "T147C2E1A394E9CD09C863413B6E1F16AB513C3529134DEA1E333AEBDC23464B4A176DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647408, "uuid": "86ae49a1-a009-4f68-96f9-246e7d7650c1", "value": "384:MRGE9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5cwd/DyZTYHHJC8oytPFnAqV/LlTL:+5+Kcrb9VDJeIwkTYTlPFnz/ZJFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647408, "uuid": "c11a86ca-6c4d-45fc-9955-04b8d1b7e9c6", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647408, "uuid": "3f8ade65-b42e-4e1c-b86c-99c7bfd03b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647408, "uuid": "45f23e71-4573-4185-a7dc-b9f573b8e7e1", "value": "2ba0bd42bf84ba6244579ce10d98a020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e9d6a-897e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700688583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688583, "uuid": "496c8819-7d10-4514-b838-11c04dd639f5", "comment": "Malware payload", "value": "d84049cc950621bd7456a69b893f1386", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688583, "uuid": "cb18d4e3-b78e-4dcd-bf33-c649cfd0e9ae", "comment": "Malware payload", "value": "3a7b0405708dbb541e9a134ae8b16765cd3df0edd5661590d48a6e1a75e184e7", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688583, "uuid": "41ed560b-0d3e-41c2-baac-1a329716724e", "comment": "Malware payload", "value": "b662666abbc70206c757b407d26d17ef05e3234d", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688583, "uuid": "9f6d9c13-cd74-4009-9d71-1afb22484d06", "comment": "Malware payload", "value": "5cb90e7a76584a16ce6b79bad038391a4d94319bc35320d1458b94759599ab0f57f180728517ae2fbf8729171fcb2201", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688583, "uuid": "95a75636-991d-46e5-92b0-f17d904e085d", "value": "T12C869C8551D0276CB83F6CA011AD6923DA0E392FCE9C0D61C3ABCB64D7E726D76B6134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688583, "uuid": "3c553ab6-be56-4c93-b044-47b8eb56e6ce", "value": "196608:mlijbuKQwYNBPC46m5oBFPFbo8Mr5lNVe:ml8uKZYNBPC462ovPMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700688583, "uuid": "aa89de1c-cb53-4527-8e2e-b46b4a6c16a1", "value": 8101668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700688583, "uuid": "4928b880-8cbb-4110-9c9e-6b01cc254903", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688583, "uuid": "ba3b38a7-a286-4c9a-9072-b8911eec02cd", "value": "install-tool.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d64af23-891e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647400, "uuid": "8d78bf2d-66c1-4bc4-b10f-dadd11478111", "comment": "Malware payload (Mirai)", "value": "47dd078f2cfb97b88871ce672c109b21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647400, "uuid": "6ffe16e9-b780-4403-843d-a92eb9704821", "comment": "Malware payload (Mirai)", "value": "3a8ada80a93dfb4c088554f1bd06fd0b89cb6ba66f39389b5d4bc0b371664f63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647400, "uuid": "e4516e7f-236d-4fcb-be78-fefbf742ce35", "comment": "Malware payload (Mirai)", "value": "fe7f40c5e0a7521aa60d8c96ccba2f7d90051261", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647400, "uuid": "6bce8d62-874f-4fe6-9103-3e0163e88a14", "comment": "Malware payload (Mirai)", "value": "daced919a7b95601cac0a0ec85eced40c45ffa8842f04e80433130e5682b60c51202a922e9c9b4cdfe6a92dcaafb335f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647400, "uuid": "e5218e8e-215a-47df-a794-ace7bb8ffdf2", "value": "T11233E1225704DC22E5F5F9FA6FD5088DBC9C1FBC876F693222B499A4519318247F8E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647400, "uuid": "61f5e0be-4942-44e0-be1a-10ee869b79ad", "value": "1536:UP+rGKDZN103JdOSB8Roe1L15J6RN2y3hcWt1:PrLvICDoe1L1z6RfFt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647400, "uuid": "5daf40e6-4525-4ba4-93ba-428a075d24af", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647400, "uuid": "9388563c-4b95-4785-be0c-e1894d043c08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647400, "uuid": "21319fd5-0022-4c73-9345-195b11f069bb", "value": "47dd078f2cfb97b88871ce672c109b21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6deba86-8910-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700641510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641510, "uuid": "7d183e27-6b68-4027-bf60-f27b0959527c", "comment": "Malware payload (njrat)", "value": "0f881e4492e3d320aeb6758a482dd48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641510, "uuid": "33605951-5d05-4557-8b8f-54ee096f80ea", "comment": "Malware payload (njrat)", "value": "3b911eac4683ba40627e7bebc0c3f589af3a257656f8fd9fb268d6189bc0f22b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641510, "uuid": "bbafaa9d-b977-414b-95ba-57c41c8a4e9a", "comment": "Malware payload (njrat)", "value": "4cb5325df52f37d3f56339cf63b1774689a45caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641510, "uuid": "4790b6ca-98a3-4697-abf2-1c1677a996c3", "comment": "Malware payload (njrat)", "value": "19d39e785516a3c2996ff03e78917c4bb5c0b6e54b21528be0a277a6f10c85d4ee4e2287237f4294904f478d7906fd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641510, "uuid": "23858ebd-fb16-4b6d-8141-f50a4396b9a3", "value": "T13C93D74977E96524E1BF56F39871F2004E34B4871602E79D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641510, "uuid": "0354b687-ab61-4b73-be1e-b855aa352067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641510, "uuid": "4cb10f69-9cd8-43a9-abd3-83161d48d299", "value": "1536:0QzGER1tMnnwlOU5CVYFjEwzGi1dDRDEgS:0Q/MnnwlOUAVYyi1d99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700641510, "uuid": "8687c5fa-120d-4adf-9678-7468ac43d324", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700641510, "uuid": "b39e3e39-2468-456b-8bcd-31f8adb94476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641510, "uuid": "eb31879a-40a9-467f-bfdd-1d68af4d9434", "value": "0f881e4492e3d320aeb6758a482dd48d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb29ba29-8964-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677703, "uuid": "0bb0f412-1eee-4394-a6d3-6c79d8471bf9", "comment": "Malware payload", "value": "6349dd85d9549f333117a84946972d06", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677703, "uuid": "a9d1debb-8de8-4a88-95d6-d00ae78630e1", "comment": "Malware payload", "value": "3cfb6514e51f40a4c325e04a35c174af4dab95167019e6aa36a2c422e35d7b72", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677703, "uuid": "330d5df0-8af2-45fe-9b16-1de6c6c0f083", "comment": "Malware payload", "value": "e1e46550f77b4cc2560668865d68169f5a641601", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677703, "uuid": "b30044ed-acb5-4a70-a738-da6dc4c01946", "comment": "Malware payload", "value": "30bb7a98be879c070556db31ef6b9c75b06482e7bd77a3bd65b0267f29ecb2e918c05912a60efd9d61d3aa998747bfc1", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677703, "uuid": "390c8111-c674-44e9-ba6b-ce35f75cdd1d", "value": "T1DBE37B4165EB811DA1E3BFC16FFCA5A9DEAAF476252E302B0452474B87D4E80DD4233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677703, "uuid": "02ed4a09-2191-4e95-a63f-bc304e5d3c61", "value": "1536:U/eqaFsu5OWqj2KfkV41f5OB1j2RUE2imeAbiFJbjEV3TiK85dI3TZdcCu6lv+4u:q22bbjW9dcCu6lJuymJeSmpnyfZvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677703, "uuid": "19c6c900-89b5-410a-87f3-b0a78ddd5def", "value": 148420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677703, "uuid": "07457f20-fad8-454c-98b9-ac08da9cba40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677703, "uuid": "3959b1fa-a663-4823-ac58-bfd7eaa2c726", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b31949a-8904-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700636122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636122, "uuid": "6a16674a-36d0-4e54-8ef0-767c9f199752", "comment": "Malware payload", "value": "25d50163c4059a23e98045fec52bb62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636122, "uuid": "4a1ac9af-a636-4928-b2d4-e290213d4e32", "comment": "Malware payload", "value": "3f0b8cf01f75b4a227b38b31f39f3d64ae9a552c64fd66e50077b96bda280b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636122, "uuid": "0a0bd77c-a19b-4624-96c3-bd14a3c0e235", "comment": "Malware payload", "value": "040597acaa8960453805421305e6e312a31605f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636122, "uuid": "f427973f-25a3-44fa-af44-c071b077f0d5", "comment": "Malware payload", "value": "dc34325c2852156f3b97789266783a88b00860bcd3063564f62c87316abd9e3d1406519c3b9fd5177eff47176b7506af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636122, "uuid": "d9999326-8b9f-4f43-8b7b-b51c826605dc", "value": "T177F4BEAC325076DFC857CCB6DAA82C64EA6034BB830FD243946716AD990D997CF245F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636122, "uuid": "bfacc163-8480-456f-8020-156873e61282", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636122, "uuid": "87bb29b8-d558-4d8a-b4de-2f8582d97f50", "value": "12288:gZO8oGN6/DRPXOjmyT9KWsYEk+PTOghfxNpA8/Ijn54AtWY+fsX20ZB8ZmTAcpu4:S/Ehy9bEpPTOgh5vA6AITfsX2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636122, "uuid": "e3f86b6f-06e9-4294-ae55-f8dbafba355a", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636122, "uuid": "46a0418c-c476-4a9e-baf0-e2947feee3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636122, "uuid": "116bf585-34ca-4769-b949-b69e87cd85ce", "value": "Commercial Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dec99ec-8977-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700685492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685492, "uuid": "a466c44c-20a7-4b40-80e1-b6018732788c", "comment": "Malware payload", "value": "19395fea893e3dcea476504227d56be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685492, "uuid": "daff7fa0-02ee-4d9e-a8cf-502f8c6323e5", "comment": "Malware payload", "value": "3fcb840d5e65fc86ed5637bdcbab0ecde764d360ebe18a5e5d6795811dc1c622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685492, "uuid": "faed6f57-f326-4e88-8f27-6b91e89428f3", "comment": "Malware payload", "value": "f86b35526cd61c8aab3911b11ca692225e341906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685492, "uuid": "a827e106-22f9-4d9d-b7b5-587506708033", "comment": "Malware payload", "value": "82e392672b06bf40a1a4e60b6d1bc49ae87f8af2f77ee9be8707a32074f123b7ced808486fbfd126f19c59614bd043d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685492, "uuid": "6dc53770-102f-44e0-87cc-6cba525094c3", "value": "T18E52E7D89EDC45F2C93B47B68CB637032623FE9A4C667E192C1AB24858335511A73D8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685492, "uuid": "84d68e73-4a78-4aed-8796-0db811d00831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685492, "uuid": "2c0ff560-0622-4a52-923a-82d2bd42f5a2", "value": "192:Uebp41yqqdcA32GG0s4LqVrTC+xV/knQi1oo79ED607RQ:UeboyqCZ2GGOLqVTfknQyMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700685492, "uuid": "5763544b-27c3-4ad8-bf30-5dee82642636", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700685492, "uuid": "00683ff8-6fda-4156-a440-8af9d7cd6940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685492, "uuid": "64f72f39-c03b-41cd-9810-08d1d2425169", "value": "202311218800-INV62009HX66549.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80aa68c9-8913-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700642735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642735, "uuid": "409964db-627d-4694-b191-ea731880d01d", "comment": "Malware payload", "value": "44f1969222ef8e3f93456f9babfa8f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642735, "uuid": "2fe4a386-a333-4f2f-8aab-3c4a2b4fbce2", "comment": "Malware payload", "value": "3fed70f075c8a28be02a126e69734637b633d46e2c2c382e41a274def4d3c784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642735, "uuid": "df826f95-c377-44d6-a26e-928b75d764b3", "comment": "Malware payload", "value": "d637e822138026bafcbd0726ab6748fc29ce8899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642735, "uuid": "c148bdc5-3639-49f5-a7f2-619cc0fe3052", "comment": "Malware payload", "value": "59c1eabf6d1ad064892471268d4cd95228524852a6123322767686fcd26f9ec5b8eaa77e32d2b981abf23f966445c13d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642735, "uuid": "d1b9787d-2627-403e-8707-f69200ab34c8", "value": "T13F64E0C4B16181BADF6C533D51324DD109B2ED1F0AC1EEAB529CBE26357360386ABB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642735, "uuid": "8d38b27b-6675-4f6b-a080-5c4a816a28dd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642735, "uuid": "b2103dbc-daf1-44df-8e4f-8f0665500c09", "value": "6144:YNeZz2KU3/oXmhH0a3E38G51d2QHQO7UdNys3IZ0tlRjZoN:YNTBamZP68G51dfH77yyUZRjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700642735, "uuid": "3d1d5801-e45c-4d9f-815d-766248b3aa01", "value": 325592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700642735, "uuid": "1f1d8434-4a64-4c43-96fc-c00b3bd8653b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642735, "uuid": "3079944a-45c3-4573-a063-18f1580078c9", "value": "0010528 - QLP RFQ 12166712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a960e-895c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700674220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674220, "uuid": "9fac505e-2207-4412-809a-fb0aadab3e45", "comment": "Malware payload (Formbook)", "value": "ae7060c5601894ec5c50d229ea5417ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674220, "uuid": "10094f43-94d6-45e8-99d6-85af18da2905", "comment": "Malware payload (Formbook)", "value": "40d0636d3ec2287a07009b05a8bd7d4143b6cbb35eba9c23d9cfd239c8f9c575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674220, "uuid": "c9971621-04f9-4488-b440-a55b93ab41ef", "comment": "Malware payload (Formbook)", "value": "b338a8e8a6cedfca7ad0432d766604138d481735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674220, "uuid": "5c3c3285-a427-4696-abd0-0875e873f3fa", "comment": "Malware payload (Formbook)", "value": "55614f004d69d04208ad6751850829f049d3edcc2f978364aca759d7a6d49c4b6090e10f7f3dd9ebe121ccc3a27f934a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674220, "uuid": "9534161a-7edc-4b8e-b6c3-3c469b4c7b3f", "value": "T1BD84221033D9D853D48449B14CA7D7B8D239BD086A09FA472B507FB77A2D1FF2B0A16A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674220, "uuid": "b1df9021-229a-4a00-860b-7c4c35398510", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674220, "uuid": "af5cf344-525c-40b6-9b76-ba291f802eac", "value": "6144:XBlL/0F6wKv62AYP9ke+uyJEEp2XnnE8qP2QOyCwT3yLmMgu9cWdq1bj8HyxOf:R26y2AE9kb59qnE8YlxTogn91bj8Hpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700674220, "uuid": "3b8f04bc-278f-43ef-9348-bd3331b4ee82", "value": 407022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700674220, "uuid": "bfeec2cf-d6c4-4e21-a27c-c376c9027c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674220, "uuid": "a43f7ff7-ce4a-4874-858b-220f9b2c74f7", "value": "ae7060c5601894ec5c50d229ea5417ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764dfb4a-8941-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662474, "uuid": "4768eada-2875-485c-93c2-efff26738681", "comment": "Malware payload", "value": "953d10d3800fc8ad921265198c533289", "object_relation": "md5", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662474, "uuid": "a1ea2559-f1b3-48a0-9d95-86952cfde98c", "comment": "Malware payload", "value": "41ea9558c922d41865d83b1a3491a6a283064e6bddc2ce208dc3eaa8d9dd939c", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662474, "uuid": "65f18b68-4311-470d-80df-2d66e09f429f", "comment": "Malware payload", "value": "7f50fcb6b0a6f6d518bce9e9ebbc9436d8359679", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662474, "uuid": "5cb40857-6e3f-4c36-9fb1-d25374ea5d6d", "comment": "Malware payload", "value": "1e8c2fe2a43a07d177274f5e515957b2378f161c087860df83e8982a35e03f74e1fda77bb8e916df4618dda68e216554", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662474, "uuid": "498ba47b-8e60-481e-8538-5d38908184d9", "value": "T1A601DD06064FFDEE169BF2D77B3401C01FE34041E4883A316A805D5F5E36C6580DEC98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662474, "uuid": "bfef66b3-a189-4db4-b2ef-10019577823e", "value": "12:TrxS2hz7YU+Sj8ZGSGpcmlnxOZ7+DP981E7GXoKIDWsC3CYnmSudmkT:TrI2hzEPI8ZapcmlnxOoG1fXtIDvC1MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662474, "uuid": "6360acf0-34ef-464a-a2df-960ad46e51ce", "value": 665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662474, "uuid": "276928ae-d884-4902-a072-79306d842f99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662474, "uuid": "9e59f1e3-850e-415a-8bc4-187db1fe6768", "value": "Client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300d0f07-88da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700618118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618118, "uuid": "75c3ad0c-264a-4f1d-a305-64a042db8437", "comment": "Malware payload", "value": "e9803cbb6c6983f66221c2806cb4db29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618118, "uuid": "311c2ddf-8841-43bb-b298-e00c9ad27cd4", "comment": "Malware payload", "value": "4329b1deaf46731c0e7a55e4ca9adaefa6daa9f8f6015c8ece22dee784898c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618118, "uuid": "4d6e7636-fa71-4d49-820e-d21c814b2c67", "comment": "Malware payload", "value": "be7dca4853a2202ca6a39cea5baf3c6019c48950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700618118, "uuid": "7552ddc5-ec5a-46d6-a2d1-367acffa9e72", "comment": "Malware payload", "value": "e13419f22c5474308bb0fea635f522cd422f45de112712467f58eebb4f7d5f01e6fcf3205c1a3606c5e28599fb88b569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618118, "uuid": "3324e1fb-e7d9-4686-887c-1a03848f2ea0", "value": "T1F1B6C001ABEA8D2EE17F5B71E4D4727B5FFAE5076713EB952044E292B413320AE4113B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618118, "uuid": "79fd41b2-7632-45b5-ad8a-219db35f21fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618118, "uuid": "ccc6ba6c-d320-492e-a942-ae897b3c0b12", "value": "98304:5YyXHUFVhcJu+3gPqajeIef22tXG9su3/IRGL/gCVzcXcbDwelg2RMYKqUrNqEK0:5Yk/0ef2B9L/NcM42RfKqUrNqT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700618118, "uuid": "4fd02608-2ca8-4925-9869-6b6776769c95", "value": 11436904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700618118, "uuid": "e667f64e-c133-4397-99cf-377c91f1659d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700618118, "uuid": "5ea22269-13cb-4e7d-9019-2fbb9c884ada", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78247e2c-8942-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700662907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662907, "uuid": "92965df1-624e-4e3d-8b30-11b2b6bc240e", "comment": "Malware payload (Formbook)", "value": "c0d9ccf847d2e8e5d001728f1df8c0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662907, "uuid": "39ae4615-244b-4bbe-bb71-5a179f009d86", "comment": "Malware payload (Formbook)", "value": "433f52dfeda7fdf7af9b7bc1b34bcf0f31b89d5ca460ab1adad42cb67bb13415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662907, "uuid": "d47c698f-7f64-4994-802f-6aa80e0c79df", "comment": "Malware payload (Formbook)", "value": "bf643217c06100f6b721e91156eef5ab5cfea590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662907, "uuid": "49cedecd-8c4e-4d25-8b68-4621b3fc506c", "comment": "Malware payload (Formbook)", "value": "92252cdf9700f2c353dab25440f93b41f0bde88c3d7e2dfee6404f990abd2091ea865b4c6e17e9d16fa989d7c563e9ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662907, "uuid": "135779a9-b1bc-4279-b328-184d24a9b4eb", "value": "T1B0D40224B1786B62F7BD67F5456085284FF67BAF27A5E3181CCAB0CB2164B0849C1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662907, "uuid": "8bb895b0-04c7-4b1d-95c2-7d76e7b38248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662907, "uuid": "7e3b47ed-ddac-4339-ba51-348f52352b18", "value": "12288:iq8oTHgDaMyD9mKc2WsYrK/1d76uYK0oa/YhcE/YzpVuLs:a8gDB+3xNYCKuYKxaAhHoqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662907, "uuid": "d8a7def3-b081-4877-9d64-531834417bd4", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662907, "uuid": "2a2204e8-3767-407c-9033-d816f5c9cdaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662907, "uuid": "d68093a1-2770-4333-96fe-a855e2a70ace", "value": "gVqScblsaurRUdD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd675b2-8943-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700663208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663208, "uuid": "f889b2cb-61b9-47b0-a197-b2e7b46c14ba", "comment": "Malware payload (Loki)", "value": "eed10a2131ad6054666c90b63bcbfafc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663208, "uuid": "bbe9af67-7da7-40f4-8485-68b5f4befbe8", "comment": "Malware payload (Loki)", "value": "43b8ec3e053adc3cfd5be75a52308d67321adca8e7df131d037d3fb11a68add0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663208, "uuid": "281109bb-0e79-4e34-a035-949043c90035", "comment": "Malware payload (Loki)", "value": "162f26b0537863c2292c2b308a4b38666b389669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663208, "uuid": "a9e6b10c-a911-4005-8b42-010b9c599345", "comment": "Malware payload (Loki)", "value": "b671ee2cfc5ced649a9207816ce38461fe35fd33fc55b67a0366d67f458aa51c8ff581d22dda87af0bb7dea45228e3c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663208, "uuid": "5b25906f-83b9-448f-9545-61e585bdf82f", "value": "T145A4121122E96B41C7BD2BF6042065C1D3FB651E56F5EB18CDC634DB2A62F054A02FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663208, "uuid": "fd48e8cf-caed-4810-8225-8b9cbb1fe32c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663208, "uuid": "1c31ea4f-7a4e-4614-8d72-9af39b0b891d", "value": "12288:y8om7lbRDfNAZH34To3e3TvZzT0iHbl2NahYo:FF7lbRx3TJ0i52wOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663208, "uuid": "3085a6fc-7391-4c02-bb4e-d69b331c8285", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663208, "uuid": "1785fbe5-a4af-4cc4-a582-b3327a52190e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663208, "uuid": "d1066ebf-36f6-47e2-8694-4425926f8fa9", "value": "rProformaInvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f607e087-8933-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700656675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656675, "uuid": "ef959cd9-de5c-411f-89bd-1b1e628a6a13", "comment": "Malware payload (RemcosRAT)", "value": "a8f21d79369634f852ce26e5113b3719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656675, "uuid": "77f511ce-d585-4f9d-93dd-a0e9eb66d684", "comment": "Malware payload (RemcosRAT)", "value": "440bf4ade63b87eae52d65ed736ef6a8427aa6cab59669244419ca5580eda1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656675, "uuid": "06484a0d-e1d8-4f59-8eeb-d6c30270f44d", "comment": "Malware payload (RemcosRAT)", "value": "a43bf11bb3853b15129e0d4bdb3c0fe21b3bd977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656675, "uuid": "a1c3e129-9968-4756-9c89-a286250bc0b5", "comment": "Malware payload (RemcosRAT)", "value": "a363b51ac44a6b82f1d74cd69511f3648eb2c915b8c6ec1be5e0d59123dbd6f736bacec563608e0a3bc93fb8af440515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656675, "uuid": "3315e73b-8f65-4029-a9fd-daec2e92d165", "value": "T1CF9533A926E9C7CAC445EB301638C1BE13626E097CDE6D50C1F97E9BB440FA37A5C5B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656675, "uuid": "3c83304b-71c4-4b3a-9894-a0abb3e6e62c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656675, "uuid": "3c28ccb1-00f5-4a5e-9204-ffe171a8f773", "value": "49152:KSj3ECneZI//7SE6y+Bcpo6GfTpea0Z2:xdeu//77cBcpC0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656675, "uuid": "0cd0ef5b-bb22-49cf-8175-ee4c6e462f18", "value": 1954304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656675, "uuid": "be7074a9-34bf-4ce5-9281-1ffa9409b91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656675, "uuid": "71bafb14-efab-4f55-b6a1-3ab725496d1f", "value": "SecuriteInfo.com.Win32.RATX-gen.21306.22425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7af31f-895a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700673415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700673415, "uuid": "fb197f9a-eac4-4c98-98b3-bcdb2bb46bca", "comment": "Malware payload", "value": "282c632ddfb9fd05c9fcd190948fa839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700673415, "uuid": "67007bfc-71a5-400e-9905-717c34aabfb4", "comment": "Malware payload", "value": "450b711292c4325402ca90b7ac06436b80504482b37e223fb08465c7fb7e9d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700673415, "uuid": "e2593f18-6b78-49ec-891a-cf6ddcc4c29a", "comment": "Malware payload", "value": "6e61a35a348dcb791b19bb60cec93e121ae9dfdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700673415, "uuid": "2897479e-5f2d-48fc-9949-221b3e476bbd", "comment": "Malware payload", "value": "905017acfe0acce4c9413a9077b86e106787ce7b88318cf5e5ad948113abf1a3044c1bab01a9ec852b17303cd3c32f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700673415, "uuid": "12fc1c0f-5808-4dbb-a9f4-29f0edeabc88", "value": "T10E65F1137DC1D2F4E0B90877C4E578284620B67A2C1F1C59D93AAE4DAE2BA5F09CF51E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700673415, "uuid": "ee35c237-7ec3-4470-a0f5-8421d1b97e05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700673415, "uuid": "1c3d61f0-c858-4d29-8134-9fd88cd3d2d1", "value": "24576:/vP1Kq4asSCBgwnX57tbTmjhD481VoYM6bXLwHv8FKVUe+PwRRcD+jFDXBys:/Eq4aIBfnJFSRGYJb0PEK3xRQ+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700673415, "uuid": "d767ed73-3866-4979-9b77-fbe745d78b41", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700673415, "uuid": "93e12b4a-a3b1-47b0-a225-df93d25da833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700673415, "uuid": "bb627bcc-bdb7-472f-9e4f-3b342179f162", "value": "SecuriteInfo.com.Win32.PWSX-gen.10825.24449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b4f88b-8962-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700676450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676450, "uuid": "5ac89ce6-d6bd-49e6-b702-2d44a675cfc0", "comment": "Malware payload", "value": "640f7766001291b62fa8060d5154c3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676450, "uuid": "b6e69563-f67d-403c-8215-7486ca916c38", "comment": "Malware payload", "value": "4530a5f93255f6cc636a719a65300fff24a84e217432ecd15db5151eda930bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676450, "uuid": "f17521b9-ddec-4613-8329-f38685fff496", "comment": "Malware payload", "value": "5b1a52ad4310b9bddaf7854ca7a41136e3d0d0bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676450, "uuid": "a2fe7477-9fb8-44ef-9327-b18ece592a70", "comment": "Malware payload", "value": "3c775f77f84f501b7bc11765238fe64c4313468ac1c6967963fd9fbfa29c6eedadddd41d600dfc632fedaa42539473e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676450, "uuid": "6842c78d-90f3-4a4c-8900-e8fac8656ee3", "value": "T1DA447C1375D0FC62C45643308F2EC6EC7B2E78619E69B74B33583E2A69B12B1DA63351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676450, "uuid": "07132c02-e0ea-4c72-93a5-942f2cbbad43", "value": "c368fa427f1f3f59d6f5623ae63cdace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676450, "uuid": "b2e76a2e-6dbd-46ee-bac9-fe424f9fe52c", "value": "3072:Jk3o0QdXuKvfy4gKBmw9MxCqNkhiVDAs35t6WAep+72:KqAQg4MxE0kEjAeMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700676450, "uuid": "1e43b3dd-3df2-4e03-a46d-be40d6ba7eea", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700676450, "uuid": "6f78b6a2-3942-4710-843b-f6fff1586bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676450, "uuid": "13e16821-8532-47bd-8aca-ddc9e7a4a4c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed4bdb1-8989-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700693332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693332, "uuid": "adfe60d4-0604-4d08-8a0d-56f87805def7", "comment": "Malware payload (IRATA)", "value": "55bbde9a728861adc50f4dfe75779673", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693332, "uuid": "e8417913-78da-47d7-a32f-dbabc8c704fd", "comment": "Malware payload (IRATA)", "value": "46376a2e274187d650e8b0b30ffb2bfd0e9fe717dc50e158cf9415bb58e02e7c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693332, "uuid": "f068aa22-3b27-4d59-aa60-cf7ce55ef5ad", "comment": "Malware payload (IRATA)", "value": "5b14809ae73301df7e11d38e474219cb4f4f25d4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693332, "uuid": "6c2570ed-6194-46cc-b671-7f1f6d5d04b4", "comment": "Malware payload (IRATA)", "value": "bf8e882a14db61ceeeae0a54e060c1124c4e81e96680c4eb98eb15cade3eba0c937ac96d793269408535c6fc41bbfc2c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693332, "uuid": "6fc4c1c8-7459-498b-beee-09aefe31cd4d", "value": "T1B8D52357F2656C6BC8F2D37222B46736017A4D199B43B386790877FA68FBCE44B806D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693332, "uuid": "efa875ae-07fc-4619-b4c5-1217c28b304b", "value": "49152:r/GE4yzFFXQfORfp/JpPQxw1j6jbRvUdwRbANwveZmQhTES1MW6LYSxcLIEUIb2:zGs7pp/sy1j6jbRvUdGbANu2B5PMW6Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700693332, "uuid": "2c0122c8-8bbc-4857-ad02-08b06c1a5731", "value": 2834562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700693332, "uuid": "d0a30e3a-4bfb-486d-889e-865fa4a3ad9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693332, "uuid": "e46c67a1-e4a2-4ec6-887f-4fde3a905360", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efeb31ac-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638626, "uuid": "bfd5b399-9029-490f-b0ed-d269b3bfdc82", "comment": "Malware payload (Mirai)", "value": "97e03a3fb44f6e94c5c22f7c92f9d31a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638626, "uuid": "0301bff8-ffb7-4f60-8a78-6e8eea0f26c9", "comment": "Malware payload (Mirai)", "value": "47c1c22ff2d43048bc1855c2c9ee2fa1ef9f2738b9ed43666484ab5b18fc9391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638626, "uuid": "fc4a125d-071a-4b3c-858c-b30c53e8c246", "comment": "Malware payload (Mirai)", "value": "9c433873f04ce1bb7750b15e0a61ec8b1cfc8fe4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638626, "uuid": "acae0f5a-e812-4dfc-9ff6-a0874883b2b7", "comment": "Malware payload (Mirai)", "value": "5fe5476a29dcd7b3994a6e1d836e5f421800214b0d842269ea792e3996e74166fa7ebf5f0057a9855109caa9b5291b90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638626, "uuid": "bf8df6e8-5ab9-4f2f-bbc2-e117d5c73363", "value": "T19D93B41E7E258F7DF799823547BB8E22964837C627E1C141E19CEA015EB034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638626, "uuid": "1c7d710b-6418-48e2-91cd-0a784eebd590", "value": "1536:Z+NOusT2iv4UnaGZYfovI96ybjoFObugQu0N6O7VoXmLdODJ:puGbvrNY+I3bjuOou0N6O7VoXKcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638626, "uuid": "be798e5b-e46d-4a4b-bf2b-47eeb4e30eec", "value": 97584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638626, "uuid": "aa55022d-af4c-434e-a7ec-0f936866bbf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638626, "uuid": "57ae2d9c-9355-461a-a655-f99df95c5e22", "value": "97e03a3fb44f6e94c5c22f7c92f9d31a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7977439-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638612, "uuid": "76857b20-55e8-4d7c-8a40-eb90af13a3e4", "comment": "Malware payload (Mirai)", "value": "161c3c3e0205e1057ae14b4ce4604219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638612, "uuid": "0108a98b-9b07-4a03-9af6-1ea7e9b512f8", "comment": "Malware payload (Mirai)", "value": "48e371bf5e4e9554a6a27007cd28b7f472baca0d4e26624cc1d092f7c0d29994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638612, "uuid": "20832d32-048c-4fcc-a0d1-5cd76ca2b7f1", "comment": "Malware payload (Mirai)", "value": "f2f8888a901fc3949455933762f58ff0b32fafd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638612, "uuid": "372cadd4-1d48-4dbf-8c56-ffc3aa2717b9", "comment": "Malware payload (Mirai)", "value": "f7caff355f25dca6f47102c6a32c0a1afc2efb65caff21a8475984ba3db692ba81ddae54f28bab1b8519a0bf0b8da4bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638612, "uuid": "2a1a620b-03d0-46cd-8b2a-e731ef38a2d3", "value": "T10A734CD9F4028E3CF98BD5BD94160E09BD2023D567970F27E6AAFDE36C731546A02E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638612, "uuid": "6e17dd10-f9a0-4825-8785-325ef8bdf7fb", "value": "768:0ecNzmQtwZGB23gdj2a3tmRikohDvtAhOXuK8ohUJE3k7YrTer4VfOksp/:0Wi23gdiCp+K8ohnk7Yrar4V/8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638612, "uuid": "e5dbc3dc-e73c-4f1b-8a26-39d975ee4e39", "value": 75920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638612, "uuid": "765e8d6c-30cb-4f0f-b6ed-dab4651ea177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638612, "uuid": "4e73bbb3-ab47-4b58-ac9b-49da2c534a3e", "value": "161c3c3e0205e1057ae14b4ce4604219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353b34d4-8963-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700676968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676968, "uuid": "08ee3169-c5c2-4206-9c37-a0cf08526054", "comment": "Malware payload", "value": "83d4e47ed80ac0a117a468df8b887752", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676968, "uuid": "6667621e-2827-49e4-af6c-4c5f64ea5fcd", "comment": "Malware payload", "value": "49d3c686ae86a04834d1e93dba8693119056a53d7ca742afb09a91232cb77c12", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676968, "uuid": "c1dbd29b-3ecd-49fe-95a4-9d442b06449b", "comment": "Malware payload", "value": "56fbb17834fcb27b9ce38116cf2fa4c8a5273ca5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676968, "uuid": "aa362de4-6547-431f-9efe-c9fc9ab27f11", "comment": "Malware payload", "value": "24450c88a16a8392f00f67146e9361697e3e92c49b15c868147511862cdb4131ee36d61fedf42f6f44c71f2a135f15d1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676968, "uuid": "265e51b4-d020-494c-8f66-3738b7ccabfa", "value": "T1E013F13EC4623938CA791B7D55C809D2E7740106930EB8EB3595FB2C9BE0A6B4F1938C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676968, "uuid": "d22e6440-5203-47e3-b15d-d19c71529cc9", "value": "768:Bj8cIi70FdOmbiP3dNQ823HWZFZNnZV/u+Xvn7hr618EwMaXdfxYHk8p1:BrfAjXUtNn23HoNr/uMvntWwltfxCFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700676968, "uuid": "8a35692f-e7cc-470a-ae0a-76ecf506563a", "value": 42159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700676968, "uuid": "39615ada-0afb-4c5c-b1b1-89ccf5724a43", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676968, "uuid": "3c326d79-d91c-4672-8248-7b07ae8aa359", "value": "83d4e47ed80ac0a117a468df8b887752.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2e76a9-8962-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700676605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676605, "uuid": "aac71fe2-516b-4855-ab05-7fa4a3eaee01", "comment": "Malware payload", "value": "8c64181ff0dc12c87e443aae94bf6650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keygroup777", "colour": "#BE9905", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676605, "uuid": "de625caa-ae39-4f96-b33d-515c612343ec", "comment": "Malware payload", "value": "4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keygroup777", "colour": "#BE9905", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676605, "uuid": "71f042c6-a1d5-40e7-8798-1581925d5cbf", "comment": "Malware payload", "value": "e91d7ebd17912785caa3e71ef1571dc01b1cd854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keygroup777", "colour": "#BE9905", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700676605, "uuid": "2e623ae9-fb91-4715-906f-75e3d902eb47", "comment": "Malware payload", "value": "caf40168c4865c859fcea5de53abe686e30ac5a956fda070e01ccc84e33b3e3301e1e23739a2da33513eff65fef5719d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keygroup777", "colour": "#BE9905", "exportable": true, "hide_tag": false }, { "name": "MBRLock", "colour": "#332A9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676605, "uuid": "10aedd17-d0b2-4e51-84a7-bca1f4150c80", "value": "T1BA84026131D38171F0F38A3419DAF7674FBEB4524770918ECB5A561A2D31781AB383A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676605, "uuid": "5d833860-38f5-4ab7-81cd-61fb6a1f09cf", "value": "ab8fd60b3da01515e6706e8d122c633f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676605, "uuid": "57ae7058-e693-470a-941f-eef829e986fc", "value": "12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700676605, "uuid": "8c22668b-209d-4365-8f6b-bb1d2f5e5743", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700676605, "uuid": "2b2f5987-f305-49e7-9ebf-5a9d5d5d69c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700676605, "uuid": "cfd94f71-80aa-40e2-a131-398eadf32bd3", "value": "p2pWin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c5060e-897b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700687595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687595, "uuid": "85a6fd8b-4c2b-41fa-b21a-413c47d3a119", "comment": "Malware payload", "value": "e4777c8a77f06cbe0219e37694e2ee7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687595, "uuid": "79f4be90-47e6-4acd-8285-b9f51e728410", "comment": "Malware payload", "value": "4ca13f3226cb15e79c2fe3042ead216641b3dcb538fd3f549a4ccc846b8afb23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687595, "uuid": "bb184ac5-1b16-4b27-85ff-d4c9020a832c", "comment": "Malware payload", "value": "98656d171f91e629c715179306583b59016cd6b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687595, "uuid": "691f7c53-677b-4765-a3ae-026459b8dfb6", "comment": "Malware payload", "value": "98ee0b52e734daf48f647debf682860fcad10e134c1efe20430d32502983fb2987b5f0daf09e7a37777ad559e55aec99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687595, "uuid": "8d8b61d8-a015-4642-88cb-5473187634dd", "value": "T15396CF05A7D98D3ED97F4A31D2C1B56F07E2E617A31BDFAA6214EB216D037006E0127B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687595, "uuid": "1f32fe96-b26a-45f7-8666-13cc27189de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687595, "uuid": "3d49ad35-1972-4b55-8a24-ba149ba87823", "value": "98304:DIUZW2smN5zFS+DKsU55Wybnzo8NS9Bg2RMYKqUrNqEKc:DIUQGN5zFS+DKXzHx2RfKqUrNqTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700687595, "uuid": "303c5165-5246-4e29-a13c-4ca818c6f683", "value": 9038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700687595, "uuid": "3c05324f-81d6-452e-8347-5bd9aeb8794d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687595, "uuid": "2780db66-9901-40d8-91c7-191f0a0d484b", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dec5fa9-897e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700688552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688552, "uuid": "eb62bf3d-52d6-478a-84be-283433139a20", "comment": "Malware payload (Formbook)", "value": "9296bbe4730f54cf8a93c3e3c2cd9f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688552, "uuid": "c0c370c1-5a8c-4d97-b970-bf923d71862f", "comment": "Malware payload (Formbook)", "value": "4fa40e3581a918c9056869d70903c1cece412ef17ad7dc2e26526f3963bfe015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688552, "uuid": "541edb23-59de-42d1-ada5-c85d12e26805", "comment": "Malware payload (Formbook)", "value": "616f9832443df6922b4dea91f5e062b16d8e4cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688552, "uuid": "113990d8-b2c6-490b-9277-eed83727cd8e", "comment": "Malware payload (Formbook)", "value": "758c88f905971cd82ea272df99b59c1489c1163da6d5c863a0bef95d00de8d00b6f7cba6586d70456ddfdf4eada76eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688552, "uuid": "e3f87042-61d0-4900-9140-20d1572815ce", "value": "T14BC4125529AD3BE6EB7F5BF21469141417FA930E7871FA4E2E8059ED14F0B000B22FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688552, "uuid": "463202b6-05d1-4c6f-9050-d7b67a75fe5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688552, "uuid": "6cbfcbf8-33fa-4585-a2e5-f5f3bbe81bf8", "value": "12288:b8osMC5THIVWFqNPdEJ23eXVGE5Od5q/lph8tvN6SMcH:YzMC5TSC8Pdu23eXQQoo97EHMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700688552, "uuid": "dc5383eb-7438-4792-98c5-e2ec58ac38fb", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700688552, "uuid": "c5b1b5a6-8eed-4930-b9fa-cc15305b2e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688552, "uuid": "c8d084f3-6b30-4139-95f2-28a8fb89fc40", "value": "\u041f\u043e\u0440\u044a\u0447\u043a\u0430 \u0437\u0430 \u043f\u043e\u043a\u0443\u043f\u043a\u0430 \u043f\u0440\u0435\u0437 \u043d\u043e\u0435\u043c\u0432\u0440\u0438 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27616ece-8974-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700684246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684246, "uuid": "08e182ff-2e04-4740-9924-33a4593f649c", "comment": "Malware payload", "value": "8096dfaa954113242011e0d7aaaebffd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684246, "uuid": "31bf424c-a0d6-4074-a53f-5b6ea66b575a", "comment": "Malware payload", "value": "50f5e8f673915508d2add406f1c72de5112a01a1b3fdd41b314029c796a7d754", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684246, "uuid": "5bfb92b5-c3be-4dfa-b32f-f5b4505c76cd", "comment": "Malware payload", "value": "fa7a9c86744c233efa9289e919ec1ebb66e1ee84", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684246, "uuid": "b1d37207-c9ea-4a8a-8618-f92e7cc97237", "comment": "Malware payload", "value": "329c41697df6c15827f40af44988a5b3257bf3538f319ed2987402b0a550ff86e86a9b3ac6969225287f7a59265e6895", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684246, "uuid": "d85b2ce8-1ee9-4656-a487-87b1b794b45e", "value": "T145A3652575EE010DF1F3AF80AFFC55AE9E5BF936293A951E40400B0B5B92E50DE9133A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684246, "uuid": "29e94c62-c6a6-4625-8793-aa0ee37c31a8", "value": "1536:UjScJFIf0TwlkPfPLyLn3w5xN/JEuWKQctkRjt7JMsnm+ddE3T6jjPP:QPLyYbJNQtRVJMFuEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700684246, "uuid": "f109bcbf-3834-4e24-bf26-106df80f84cb", "value": 105530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700684246, "uuid": "d27a28e9-8257-4a5a-a6bb-e27f79c6267a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684246, "uuid": "25ac4fca-3044-4c36-ba69-90638a8c80c3", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187ad3fa-88f0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700627527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700627527, "uuid": "87af4635-3bcf-4658-8063-bc195c175f1b", "comment": "Malware payload", "value": "e9aca5685fead00b3640aaa413e03e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700627527, "uuid": "289f6c55-9808-453b-8c60-c864b63a1f0b", "comment": "Malware payload", "value": "5116598f5fbfafee4fc6514d5c6db3019e8e8841e788ab65a80fccf250ddb055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700627527, "uuid": "f7990988-236e-4c90-a40b-6b5143e0c21d", "comment": "Malware payload", "value": "79b34520714f4bffe5a105d7bec5894ec36c5d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700627527, "uuid": "17699b3f-dfe9-4f22-a792-9ec17eedc44a", "comment": "Malware payload", "value": "480a6cf6d59368525d4d814adf03c827920a0a1bf3d948036a56c12243771587013629f293e80b5888d4d3c120e2f701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700627527, "uuid": "b62fcf6c-fa2e-444e-8b20-4f22ef77178f", "value": "T1B5559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700627527, "uuid": "2db6c32a-d6e6-4c30-bb3b-26c56a027e10", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700627527, "uuid": "180cd061-0ae1-4830-a496-aeac109ff3fd", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700627527, "uuid": "6efe0a8c-dcb5-4590-94d8-b89b85cb4e73", "value": 1322018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700627527, "uuid": "92f546a8-0bf0-49f3-a8d3-a38f3086e2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700627527, "uuid": "8b1ae311-f9c8-4dd5-b3c0-1ab6cc31a40e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee85a9b-8988-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700693090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693090, "uuid": "480c8aec-858e-4d33-9af0-80322224a9d7", "comment": "Malware payload", "value": "474bb663d4f4f856f25c9c9e3776afdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693090, "uuid": "51f8a3a9-0175-4919-ad6d-f5a935a23276", "comment": "Malware payload", "value": "52561ff3d9b1ecac75cbdfb406992f710551148dd79ee5e5370efde2e9cdfa82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693090, "uuid": "647ddc48-a2f8-4976-b269-33b576171474", "comment": "Malware payload", "value": "20d9cd25b32f86c608afa2772f886a74fb415e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693090, "uuid": "1281ed2c-3e73-43f7-887b-f400b4178709", "comment": "Malware payload", "value": "aa4b232b8f088b21569f558fadbac7cb948fae2ca6ed0c479a840cb9caf4c73407fbf06dac9a3f4b128589a0837d5209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693090, "uuid": "c1bf462c-77ab-4003-9421-ae9368b6cc6d", "value": "T1B0C5C457BA434CD2CD9511F2D3E14748CA099C3A0B18A5AA39C7BBEEAF3C1CB457D285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693090, "uuid": "3d11bb48-4a22-4b70-ad0c-ad633f846578", "value": "24576:igqpa9/1wCcJ+VzJMdtz7v7xEvhGJZKJnEqSK73o8x3lmclSWQwWd8y5x:igqyVz0hlEKitcclSvwWW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700693090, "uuid": "224ca797-75e7-4e4f-96cd-d874cb19435d", "value": 2543104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700693090, "uuid": "4772ec12-5e91-4114-b4c6-9b6bb5695a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693090, "uuid": "e1d9e15d-03a3-4508-a32d-0c7a635823cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c63237-8940-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662228, "uuid": "9ccff8a9-bc2c-4f8e-936a-21b86ed860d3", "comment": "Malware payload", "value": "fb7cc3159fb055ea2c2b7572dac6a4f4", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662228, "uuid": "6d7a170e-3d7b-48c3-8315-fb72522693fe", "comment": "Malware payload", "value": "52f01b9882f6a0025e6e7c3d039b13c7a249f0fe3fe040de87a9d2e584e807ce", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662228, "uuid": "b4804377-67dc-463e-8f9d-412e19ad8a3b", "comment": "Malware payload", "value": "fb17371598dc79616b3ef8f23ec27142051844a3", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662228, "uuid": "18f3f575-1477-4bed-920e-3bc0f708c698", "comment": "Malware payload", "value": "4a4051174e86d40b685b8614b8853b83995d7e577afe5c0a65178df34043345432dd9f1f9945129e86f719ee752e40d8", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662228, "uuid": "1cf58a23-0f45-43ea-8d53-75dd3a5f4037", "value": "T1E64412AC198F04DDB72B05368710E53D2F5EB72F6A806A6A0068F5D3D6791CDB3F052A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662228, "uuid": "dc43f17a-92d2-4eb2-971d-ec1e3d2fe989", "value": "6144:Rc9Ettqow3q13I1pCVc59wMcTSidjeXLgePa:RsEtVw6upCzHSke0ePa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662228, "uuid": "fb857020-4f57-4a10-9be8-3135b1029feb", "value": 257780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662228, "uuid": "bbc4e016-cabe-408e-9447-100a554a5108", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662228, "uuid": "934234c7-4aa7-4a38-8782-7b9a21274e07", "value": "Kingston.QNAP.06636.6530.247.log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aede998e-893b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700659992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659992, "uuid": "44396403-726b-4b76-8bc9-db3c5e325177", "comment": "Malware payload", "value": "e98606a70fae60c24e8b8404b448a126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659992, "uuid": "0b001ea6-e844-491a-805c-35d1bd3e8b70", "comment": "Malware payload", "value": "53b9e1c8b5adaeb0154b3233df41cc3af1db88fc9ae45f55b581d611fbc22096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659992, "uuid": "b0f21aeb-3d29-4ca9-b0e3-bc20dee4ce32", "comment": "Malware payload", "value": "3e15d45a384f9f882369b9dc0851acb99e081a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659992, "uuid": "0c0dd7d0-a95b-45e2-acb4-c3ef4b31cb2d", "comment": "Malware payload", "value": "c179355b95730feeeb17cadc3156b03a74a5b0d2c240355c2f0f4c91eca7f8037303907b33838a3ce9b1c0572bf10eeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659992, "uuid": "1b1e025b-c603-48af-8a6f-faaec80a149c", "value": "T1CCE4021071A87BA3E77E67F54595512C0BF637AE127AE3185CCAF0CA51A4B098E81F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659992, "uuid": "23a673c5-b44a-41f9-b506-743627fb3f12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659992, "uuid": "fa3b796f-817a-43fa-bcc0-39a6ec68915e", "value": "12288:2q8om6/YMJbg1JIcPbXpyrIjavOOOt/UY7E+dGi0oDo5yeT4lB:Oa/DCTTPbpysjZt//7ZGxazB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700659992, "uuid": "5b42141a-4e9c-417e-aba6-727846ba84c8", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700659992, "uuid": "f887dd23-dd15-4662-bb48-d4063ae8b520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659992, "uuid": "a58c4f94-2a19-4840-8a35-03125871dd7f", "value": "LAM CHUAN #710036288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af2725c-88e3-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700622029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700622029, "uuid": "934aafd3-5593-4031-a002-741cb81e41a7", "comment": "Malware payload (RiseProStealer)", "value": "e93f0dd1bdc48132b499c205d9ba8b95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700622029, "uuid": "7bb809b5-47a4-4445-98a8-22fcbd9bbb15", "comment": "Malware payload (RiseProStealer)", "value": "546da075bf48313dd849e8268a283df761439471a2385d369208e9c7bef5463a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700622029, "uuid": "f2c6d954-4d2c-40db-845c-f45f180c0048", "comment": "Malware payload (RiseProStealer)", "value": "0760e8713c5591e29fb7df707298f54f96464309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700622029, "uuid": "09eaf45a-c463-4ac5-9945-3cf4839830f6", "comment": "Malware payload (RiseProStealer)", "value": "47c1c274291186e06c57b1c5098f163011259a7e0703236c22419f08956fa0b5ce556803d08c2639aa65170c3f2d0062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700622029, "uuid": "8e9b778b-d378-4c3a-abaf-7e74eb0b1486", "value": "T1E2559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700622029, "uuid": "5fa75220-fe2d-4d78-be9d-01a7fa0cf4da", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700622029, "uuid": "80e250e0-14d9-4d58-9520-5a0d5356b57a", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700622029, "uuid": "d281d1d3-577d-4f1c-b492-f4a8018d4a91", "value": 1322005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700622029, "uuid": "f67f8567-9451-4ea1-9054-0dc55b602144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700622029, "uuid": "440ced17-4c32-4c60-8f9a-f9f81804e19d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7c289d-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700663025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663025, "uuid": "ce232589-c2f3-4280-8a2b-9052850f13dc", "comment": "Malware payload", "value": "6384eda7e39fc09eae5c31b89e23db17", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Decompiled", "colour": "#7452D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663025, "uuid": "90aa8c38-aad3-4079-858e-6fece8c2e9e4", "comment": "Malware payload", "value": "5546ddc2c95e31616e68bc50cce8ac90fa5609397cf34a3d212f4bb39558f70b", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Decompiled", "colour": "#7452D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663025, "uuid": "49fbb8d9-2f72-4ac8-b345-53547bbb0ded", "comment": "Malware payload", "value": "3e60870a54fdd7b7d06bdb39bc0f7dfa864a3e6e", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Decompiled", "colour": "#7452D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663025, "uuid": "bb02e16d-1c89-4561-9c1c-295a60797f7b", "comment": "Malware payload", "value": "23f278a8a1379660f636ddc9be8eab9aadc57545d54800f3369d5c5e64dc09d533995575fa7822e36e4f29e80229a2d7", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Decompiled", "colour": "#7452D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663025, "uuid": "408d6e2b-3461-4a50-9d12-c6ffc9924395", "value": "T19DF45340856BC187F861D24130F7F7812B277C6636EC1B76266EE399EE9A5CD0D8C6C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663025, "uuid": "ae7426df-e0eb-4113-9038-80e15b997cdc", "value": "6144:lkRlHsAaApAMxYZsxtwikB26X7qz+4tDxsvYVfwsNnqGcoGNr:lkRlHsjApNYZkiX7UVxsWdn/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663025, "uuid": "4ed29eca-aa6f-429a-ab67-7cb4c0238a94", "value": 743574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663025, "uuid": "6b1d6b3f-1d2b-4848-aa9a-f7b45ca5d6f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663025, "uuid": "25bc9ac7-f38f-4373-998f-815a22cff154", "value": "Kingston.QNAP.06636.6530.247_.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfa19b8-8917-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700644555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644555, "uuid": "315c1ac7-38f5-4cc5-9e4f-dde46e0d4018", "comment": "Malware payload", "value": "6b0a37137d17f0567085049d8594c696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644555, "uuid": "c2e5d5a6-1caf-474b-9de0-818c3ea00244", "comment": "Malware payload", "value": "55bdcc2b5a25a711fb46e9ac4fd88da91c65f799f9faec3273f818b5a65c20fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644555, "uuid": "f9a9541e-89b6-496e-a373-a41ca90145e1", "comment": "Malware payload", "value": "313b9567951fb5b18e234110d9aefebb6892f9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700644555, "uuid": "3d248aa5-fdbd-42b4-bb98-37ef9202f6c3", "comment": "Malware payload", "value": "3fcff38b4253506d961e7b248af763d0f5e3110ab6d0d408d5748a4ff88ac3c4d747af898baedd518af3809b97ccf62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644555, "uuid": "78cee54a-4468-4812-a9de-fda3b4fa1b85", "value": "T1D5D612633C57EC0567B38EF8F52EC1D3E0EB60863AD18455926F19D9282B531C9B9F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644555, "uuid": "815e557d-39ce-40cf-92bb-b3b5a1adb93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644555, "uuid": "da8be9fc-3d25-44c5-8765-687a6b74f6a8", "value": "196608:6ZCabeKeMMH5/wzo8EfRA6JIi9medHY1/vRRCUDz/1NGI:2Ib75SsA6J/X41/JRCUv/1NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700644555, "uuid": "46b97217-098a-4e85-9eec-da4bb6334979", "value": 12896768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700644555, "uuid": "414c5e0e-f60c-4954-be94-92d265c72b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700644555, "uuid": "3c552c94-bd01-4527-a338-6c183a2e8a6a", "value": "SecuriteInfo.com.Trojan.MulDropNET.43.21623.5556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919f60c-8943-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700663204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663204, "uuid": "9db52c34-b1c3-4a3b-89aa-fbd6910104cb", "comment": "Malware payload", "value": "b5fd85946946953191703846fb14d026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663204, "uuid": "e6a2d502-d1c8-45c2-9669-c1bbce60d41b", "comment": "Malware payload", "value": "563c1a60acbb3eec3df8b5e4b899b7ead92012aaa5b6482bb2d9f20143a5042c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663204, "uuid": "5088a536-2ace-46fc-b217-6ae8e2c1b498", "comment": "Malware payload", "value": "2c7f493dd2f92fc84a0d7bd5a22b1b147313bd35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663204, "uuid": "95ddae1a-f922-4bab-874c-69faf6812a8e", "comment": "Malware payload", "value": "317866adbee4ffd028b45e3fb351abb5b2045fa54ad1a60f2565cd59fa828fac8bd31fca37e7d2fb8e2d3f1784421052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663204, "uuid": "f75bce9e-5061-4eb1-90e0-7e0a0083fa61", "value": "T1272533453AEBD612F8F072316961D3B622E5096705606D1F6F5C7CAE3B32D91EE0B20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663204, "uuid": "2cf50047-77d4-4c3a-a051-013bf1acc3ad", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663204, "uuid": "3ece93da-0301-469c-8c12-aca7b3fe1990", "value": "24576:yNd2HcP+2N7nhv5yYvCxBHv8SZDgsw91cskhx3y:iucPN7nhvo0CxBEwu11Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663204, "uuid": "a11312b1-d5a2-48fb-bc5a-7668255b08f6", "value": 1029264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663204, "uuid": "22d72f4e-20d5-4a00-ba7f-f55b0d25b717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663204, "uuid": "173be9eb-2ccc-43f6-8aa9-145612c744d3", "value": "r0010528-QLPRFQ121667123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dc7b51-896f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700682391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700682391, "uuid": "7ccc70c1-b71b-46d7-b771-7b2488beaffb", "comment": "Malware payload", "value": "aebd1af8b70c170116d20ca2d9360273", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700682391, "uuid": "eca22d4e-2316-487c-be6e-84d9561bbe9e", "comment": "Malware payload", "value": "56a16410b5b5ed3a6bd500a49266f88d2ead665d44a3aef9626d734140d3afea", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700682391, "uuid": "ff77354a-6d17-49b6-9255-a52c6e392b7e", "comment": "Malware payload", "value": "dd315045af77de010f0acfe390958d88c969c9a0", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700682391, "uuid": "0f7c51f1-5482-4290-9d9c-6194ee510515", "comment": "Malware payload", "value": "1e401895a4ed808ada238e33d25ad63795c20c89ab889c17e3ea8d5232d54bab44190e456b63510e2a30c1fc0c92fdf7", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700682391, "uuid": "4de3bca8-ba57-4b40-ba29-87c8723bed69", "value": "T1B2D5AE1A35CAC636EB7E82306679D77A61BA7EE04BB104DB63D43A1E1E305C10276F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700682391, "uuid": "0c9c845e-77cc-4e1d-bdcd-000258c83ae7", "value": "49152:GG8Q14uW8zBQSc0ZnSKnZKumZrFq4Fb6HXr1iWnYs4ntHurpllQ6acuxtZOSRF++:H490ZnpKNFnWnpuxd1YLBXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700682391, "uuid": "b2b94bdd-848c-446a-a06d-7178178d7a76", "value": 2886144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700682391, "uuid": "2db8beb5-6eaf-48bf-bca2-1651ed2263cb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700682391, "uuid": "bb4845af-4907-42bb-84d5-70790f913579", "value": "Cheat Space 1.4.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb673a7d-8941-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700662590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662590, "uuid": "a5f5cebe-fd35-4622-82c1-616b33b4a6c9", "comment": "Malware payload (AgentTesla)", "value": "4d1586a1a2a741602afaf8e6338e0b66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662590, "uuid": "78d96551-a539-456c-9dd1-6f6439391984", "comment": "Malware payload (AgentTesla)", "value": "58902f188e6682f84e8db14bde288fbfdea7127490bd2ae8c42593de55d33c94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662590, "uuid": "db11b6f8-5d2f-4a2d-b803-608bd73ed2e0", "comment": "Malware payload (AgentTesla)", "value": "9482dece0409aad24c22c9bf4088df9e7f441ffd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662590, "uuid": "55b42c42-2cf9-44e9-ac90-c58cea7c2581", "comment": "Malware payload (AgentTesla)", "value": "d97c6511cbcfd516078de4cf6bd1634a0754926613ec99ab024cc0e02b76130f59b5ee025c3bade9267fd3aa83c72010", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662590, "uuid": "f112533f-b3a3-4d24-ba43-8e4a04bfcf89", "value": "T1AAD4232375E9D352DBBD8BF544011B0587BAEA1FE479F18A8E8412DE15E2F444B22F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662590, "uuid": "7b401f93-d739-4d60-a520-3e9a0626a660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662590, "uuid": "f5715f1b-1a1a-4f06-8098-4238bf9a448f", "value": "12288:Y8oXvpLS0LB/tzV2MOI7SpNhaDEHB0sBJJ3nQdBKAy86gK2:3+XTzIMWhaDEh0sl3nQdkoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662590, "uuid": "90ceff5e-c025-4f8f-953a-b120521062d7", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662590, "uuid": "96ff6408-ac24-4d31-9ec8-3e35830fed0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662590, "uuid": "7e808d93-75ea-4261-a38b-f96a78abc001", "value": "SecuriteInfo.com.Trojan.Inject4.59820.18239.21451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc55256-88f4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700629231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629231, "uuid": "0200b7d5-b9ab-46ad-b356-a4ca605450d7", "comment": "Malware payload", "value": "76df921427ba1410a4d85a50a54f2d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629231, "uuid": "2618184c-b0e0-43ce-acb0-74595555700f", "comment": "Malware payload", "value": "595586e83cde2e83072b025e5199b451eed4a290b3cd7640c7e6df90ba364aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629231, "uuid": "6a9e65b2-6ccc-4510-8999-7ea63fa16acd", "comment": "Malware payload", "value": "8de1f203bcb8fa9a3a0c05cc18fab8f373047823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629231, "uuid": "d0f8f9c6-d29b-446d-996b-3784fc7449b3", "comment": "Malware payload", "value": "7c256db86f4ee53bdab2d461c07729c341fed172c7d3b2d6a88e7f1fc5426078b6a62a3db46b641ee8acde78de2b8e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629231, "uuid": "d426ddca-64c2-45bb-b14b-0761846aeb38", "value": "T10A559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629231, "uuid": "0248f3dc-574f-429c-a963-ad0238a3791b", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629231, "uuid": "1d8d0c87-4ede-4d81-9dd2-6f7543fb0be4", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700629231, "uuid": "c982909d-8394-409c-aa85-0758c3147eb0", "value": 1322023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700629231, "uuid": "4db49ca7-b3a1-4bd4-b511-170e41519d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629231, "uuid": "407fb47b-156b-487c-afe6-441f34c42373", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a744e692-896c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700681025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681025, "uuid": "80b2e75c-3743-4397-879d-e56de20eb12f", "comment": "Malware payload", "value": "8b04a758d5cdead7c83f07b04ab4a754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681025, "uuid": "729671cd-fa8b-4107-9fc8-c801f50bc8f1", "comment": "Malware payload", "value": "5e057872fbbd900706c93471529d122d558c0d49836dca41ed296ed3fe67566c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681025, "uuid": "bee2224b-fcac-4fec-bce9-e635509f8484", "comment": "Malware payload", "value": "d70a838b3c3aaa7a930605291a89e547d28b173a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681025, "uuid": "6a7d6b3a-44da-444d-b80f-0dcb893c67cd", "comment": "Malware payload", "value": "88b651517828d47c6be2338de2ea48a73971625e55803d8b05a17d0d5337f87486b26937322dfbd67bebcba75e1fef47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681025, "uuid": "12907f46-50e6-40b3-b062-735b0ff53ad8", "value": "T1EF16C0203633E708E81D5531C1E7D12A03FB9CA2F6C4E75F36A8362D9D723DA8E4559A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681025, "uuid": "76547992-871d-4077-8152-0c7236fe7dc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681025, "uuid": "3d3e07fb-2c8e-413d-befe-a25f440b1ae1", "value": "98304:AYcA3f5OLXTsYxk1z3XCstNGlwH2mx90rfv7a+2hyxUidT9:A43ILDsYw7XvNGlcvx907ttdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700681025, "uuid": "7c53ee7c-7c33-41d1-8d5c-77d7bcf7694a", "value": 4087560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700681025, "uuid": "9c87fef4-ec31-4423-ba8a-5b1ac2da2988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681025, "uuid": "f9c178fb-fde5-482a-b984-440618df411a", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.JCM.gen.Eldorado.25286.19168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a912aae-8904-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700636148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636148, "uuid": "63611f94-993a-4992-8acd-824630836369", "comment": "Malware payload", "value": "ca36190ddc4907be2dece16457b45893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636148, "uuid": "6a28cc65-e467-4efa-804d-7ae89b74377d", "comment": "Malware payload", "value": "60b0830b3d046627ac7d33aed8c3c8aa871d0f235c831ef9acd14f938faa0a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636148, "uuid": "4476e65b-1764-4333-9d2b-aab69f1942a4", "comment": "Malware payload", "value": "39e45a531cadb253f9a51fe64a080922faf8bee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636148, "uuid": "d36ba112-ce72-4d7f-9b44-1186d27ef285", "comment": "Malware payload", "value": "343296801cf35507a9da80fdda5db359fb0df048737d64fa867c897d43108f5c08d63300433351c598ef372b04384d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636148, "uuid": "b71384d0-e70f-41fd-9c91-0f7023bce151", "value": "T1DE156DD1F15088DAED6B06F2BD2A653024E3BE9D54A4810C599DBB1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636148, "uuid": "d45cd162-bf9b-486d-a1bd-31cc115504e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636148, "uuid": "48b16d08-1160-4b22-aa99-b028c4ba0c96", "value": "12288:B8obJ1SGYdrG1gm8mSGiyUm7jj7jOb7nPTDm4UqTtevk6x:6OSGMqgf5+3ju7nP/mHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636148, "uuid": "78dbcd0a-91da-48a5-8786-3c458a36a2c3", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636148, "uuid": "038b8922-190a-4f10-8867-ba6f2b5e3793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636148, "uuid": "e2f4732c-eb2f-428b-ae7f-a2b049397f7d", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923473c6-893d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700660803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660803, "uuid": "de6f648e-98d6-450d-b4b0-6d533f4a797b", "comment": "Malware payload (AgentTesla)", "value": "f9ec01d302011f81bdeb43d28169b3b7", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660803, "uuid": "7749d8e8-1fa2-404e-9b9f-2ad9361b5bc3", "comment": "Malware payload (AgentTesla)", "value": "64548b61203f7f11ef1aef667fe19bbab564f43a62abdf0ddd89d5330a298d54", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660803, "uuid": "fea60da8-bfb6-4694-a207-ccf2c28363de", "comment": "Malware payload (AgentTesla)", "value": "833d20e6c08f67c3b9541dc1d6c11d754aa6cb78", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660803, "uuid": "b45c0c0c-b6c6-4ae0-bc4f-aef578940ca9", "comment": "Malware payload (AgentTesla)", "value": "0e661a46f8ac1c3126d8e38aaceb451f809625d2a7e62d5fd478d12da95f57be53f85b27ac5fad1d9a3ddc9b9ae3fc48", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660803, "uuid": "e74ab6b1-0e13-4201-b9e6-012ddfe87e18", "value": "T192B33FD6DE080175EC680BB055735E37193FBEBE9CB4AA4D359CB0B51BB31A2042672B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660803, "uuid": "ee2c7e65-cecf-4c0a-aa8d-a700436d5454", "value": "384:TarebUqIH2VIGJfZf0iTbZ0yITJOHOfHgNN0G+37Zvj66QnzVcTaOidKjWPe9qbu:T3/p0IETJOHOfHgNNU766QYaOiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660803, "uuid": "521a8553-4a15-49c6-b5a4-a8e296531d42", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660803, "uuid": "6f1275f4-2249-42cf-9ce1-03c5ca52b079", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660803, "uuid": "606fdcfe-27ab-4b5a-b9cb-75392a3bf263", "value": "norden de compra 211123_Arvilab srl.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82546cb-8987-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700692703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692703, "uuid": "528ebe86-3984-45a4-9af8-3d00e21f3a02", "comment": "Malware payload", "value": "862bc8adac85c4c24691580f8e9cc830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692703, "uuid": "a90290dd-0681-43e2-a71e-099a8f31ec6c", "comment": "Malware payload", "value": "652517904b568a2d5de03180d87821d06bfaf6afaca530bdc4521a1f35e3e976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692703, "uuid": "f868f9a9-7993-42c6-8905-038bffc4e82b", "comment": "Malware payload", "value": "dcbacac408b4a1f6d0aa684fb15455f8e6ee4e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692703, "uuid": "251f0213-8c06-4c53-a503-cd8ccc918574", "comment": "Malware payload", "value": "9eb4ca5285d71a23914aa7b0ce77664a5fb4e1247604f5b6967f254a3c8ef84f0729ca1bb5bfae5e4ca2b91cc2f125fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692703, "uuid": "526b3e78-1f19-4d1b-b609-3d7bbcde60a4", "value": "T169569D9032EA9B8EF2F30AB4527996024439BEE3CB16C2CF9555607D0E21FD149B1B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692703, "uuid": "0a8727d3-fa46-46d6-8098-4157a51d9837", "value": "c0224814c9bcdcaba8a3c894ef9389f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692703, "uuid": "ac9d16ce-d776-4b94-b7fa-da9c9ba4db18", "value": "98304:AtBMENiC03DcQyGb7BVTUw3MspLMsiYkfJSas50Tw1:nEt0g7WnF3MsdqYsJtp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700692703, "uuid": "fe7e92d6-0016-42ca-9f4e-eab0074ac40a", "value": 6341464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700692703, "uuid": "7466f27a-492d-46ee-8814-63fef9dd1a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692703, "uuid": "a8697150-7358-4bab-9b27-94707b4d87a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85de5b18-8989-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700693424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693424, "uuid": "186b7d81-201b-4cf0-b4b5-3cbc49ad0084", "comment": "Malware payload", "value": "00c6c8c1825b2a91859ce8bd8f89468b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693424, "uuid": "b2fd0cd4-3d73-4329-99d3-7f77172b1cd7", "comment": "Malware payload", "value": "65283a60a4a81ceaad94179b9555c1420abdc9ca49843c765098e5fa1e039efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693424, "uuid": "8b82e13e-8d86-4e69-a21d-2a9e7a707532", "comment": "Malware payload", "value": "f5c9cf77f246e9feefae9f1f9c9d3776066c79f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693424, "uuid": "cf0ffe48-5016-4073-a6d8-f50cf334fd7e", "comment": "Malware payload", "value": "0c45efbfce299d26cf6968a477c07a0204d5d24ca818bda996503eadf538e9b85785bcf6c411e7d664d0626ba1d47eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693424, "uuid": "81cf05f0-317b-4c5f-9fb7-3c5aaa10e850", "value": "T1D3446B1365D0FC31E45247318F2CD6EC7B6EB892DE69B74B36943E1A69302B2DA63311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693424, "uuid": "75cf55e4-170c-4327-9ec7-0cb159bebd06", "value": "b1987f19009bd4af7032badc4f248687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693424, "uuid": "4559533a-ff4d-4c9f-aca9-50cd9b48fe4a", "value": "3072:IWc+u9QZ8u7yCBkbGUxGlsi5Oj8foz84eAaY/fF5NpqXPEIPT:8y8u7LkklOjD81AJ9puPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700693424, "uuid": "4a40be76-b0e8-46d4-b42a-6a534c04fa46", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700693424, "uuid": "6b60d33b-b9ab-44e0-9be6-5e13611da864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693424, "uuid": "b9eef23f-3f41-4ee5-9a47-43af154c7a21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17afcdf-8973-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700684048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684048, "uuid": "3859ac48-7bcb-4b65-80e2-852ae4a015ad", "comment": "Malware payload", "value": "83500309a878370722bc40c7b83e83e3", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684048, "uuid": "a7fb7cc6-c80d-4571-b746-5138690de26a", "comment": "Malware payload", "value": "668ef6c539a86d33a2ffbf8f1e0fa5397afe1d2aabbfa366d518c0f118b0f192", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684048, "uuid": "ac447112-f2a8-48cd-a718-4ca44d62e2c1", "comment": "Malware payload", "value": "3ec2a76dad86d1bef1f0b56d57754deb896448bb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684048, "uuid": "d1907ef5-da9c-46ce-9c52-650c7eca9084", "comment": "Malware payload", "value": "88693b2c6bc2e4825d39c99aa11d2e8e5cbfdf02a14d5de19c9968347f6988f1855dcecdcb5c8b6d6540581c31cc39a0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684048, "uuid": "01e36724-0194-4f86-a79c-be633e7c29fb", "value": "T160B37C1175F7601861F3AE41AAD4B1BBDFEF75366A2C99EF40800B0BD352984EE91336", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684048, "uuid": "cf282008-8bed-4bbf-a724-7c8f1979ec3a", "value": "768:s0D97w0TLopp7l6Sg//y9T/dTNE378SrvtXEn7dRWVVEtIOiouXyEnEqEoEFXJps:sgLSF9DI378WtyD6zye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700684048, "uuid": "b15f2fd2-0c8e-4acf-bcc8-89eb5865a088", "value": 107474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700684048, "uuid": "b536e1cb-1698-4cad-a4c2-2560e715896c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684048, "uuid": "d63e3928-e44f-4b26-9931-d489c9229b5e", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885b9a17-8958-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700672383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672383, "uuid": "ebdd25eb-f073-4945-99ad-304e09c508ca", "comment": "Malware payload (Formbook)", "value": "08be0b23f7706fcfddf96ae258a67249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672383, "uuid": "78d3d0f0-0731-4477-a38e-a10b2954ffd3", "comment": "Malware payload (Formbook)", "value": "66c7d769249d9da750ff736b447f0573c7cd5432a680e3a72d09bc1e238e83d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672383, "uuid": "d16af995-60be-4756-82a7-df90caf68c4c", "comment": "Malware payload (Formbook)", "value": "54b9491995dda5b4849c5f10afc53175e0f67bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672383, "uuid": "a853191e-fa73-40a7-8619-919b798ea019", "comment": "Malware payload (Formbook)", "value": "e8a875a8c7c3f66c1e598f823150c946a67678c6183b6f546e707bca4cd3ec017284dcf3f4571d3f21e064709b60cf47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672383, "uuid": "ff5f4f0b-404d-4784-a5ee-eb237e67ee0a", "value": "T1B895F171EBA0C171DD732BFF6C3B5690C92E7E542E5928351BE530891EBA781383A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672383, "uuid": "ff3e9d7d-9af0-4cc4-bf32-41953a7503c4", "value": "5ad58dd99cd3bbf2c166bc1ba7c8b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672383, "uuid": "7cd1042e-7d8d-4436-b00d-526e05d1f05c", "value": "49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4FMyqChsyfue9T:aDqRMXpcOXX8Za31CuCchMXC+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700672383, "uuid": "e2d5c56b-5d3c-42ee-9e77-044468472012", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700672383, "uuid": "0c0e27e4-3cb5-4e39-91b3-1228e208104d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672383, "uuid": "c8260056-dbd9-41be-a38c-e9b11bed3d79", "value": "Order confirmation, Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a37bed-893b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700659983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659983, "uuid": "134c2365-ee8e-4861-8554-1c8b44f3c49d", "comment": "Malware payload", "value": "6ec22ac2aff881542d2e7da5b414dbff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659983, "uuid": "ddf9b2bd-1e24-48af-8973-e9ad51f8c318", "comment": "Malware payload", "value": "677a1777767171950799d14028b6fc98caf82322c120e5a7d5de8434b479816e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659983, "uuid": "5f407c7f-2ba9-4b0a-b3a8-8cc52917a3a1", "comment": "Malware payload", "value": "124493151b8c6009be52e215ce683151743389b6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700659983, "uuid": "3e7e26b0-2330-4f14-9576-5b40e2858ba4", "comment": "Malware payload", "value": "2435a4604f2fa6ea0f2b6c265f4c6d496691c17a8642ca14b645d1ada15376536012a42bedbfd3ac35e5dda581391713", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659983, "uuid": "9d444ba1-7c48-43d1-94e2-6633e89bd747", "value": "T1D2D4232A20C9F59B68522F77489A51CCB54D620550F66EBDC0066F9ECC4CD6F8F9F0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659983, "uuid": "c6743dcb-2db9-4675-8b60-acefc7e20428", "value": "12288:Mr8RJhbp2ORuMprxIwpwqJFXNcrWj8vAOOtb8k76aZGiouMxp3TI/0RUC:M+RlYwNJBNcCjTtbp7hG5tp3TfR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700659983, "uuid": "a0bee4f2-935a-40c8-9b54-4f6d47e8fcf3", "value": 619095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700659983, "uuid": "3e89795a-98f6-4462-b258-e44f6853ca5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700659983, "uuid": "0bd5062d-2eb7-43a4-9f11-1f9f1e3d3fe9", "value": "LAM CHUAN #710036288.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2f6e95-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662751, "uuid": "55423d50-bfb9-4541-965a-6d3d6134ada5", "comment": "Malware payload", "value": "68cd06ab9f5f228f11f67c504185894b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662751, "uuid": "f81cbd82-2343-4b65-a074-9e5923f215db", "comment": "Malware payload", "value": "6802027e1d2640359a11f34493375411e4a999727e11dcb98f676317e2ba6932", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662751, "uuid": "1f21d510-ffda-4fbd-a980-e9cbc0ef44ce", "comment": "Malware payload", "value": "ca01f125c653c44a11b0a5d14091e27e28cb7d0c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662751, "uuid": "3dca5904-e199-465c-8c6a-45ea3fdfdd1a", "comment": "Malware payload", "value": "fb4ad288623697479fedf0f5481b048a408cdb6fb1e17df56199b0cb172fd9b6b7a865aaec9eac90d29860a629675019", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662751, "uuid": "f7eef82c-1050-48ad-8bdd-f34091a87ce2", "value": "T1ADD4233DE6AE38B5529FAD02F9B50D21E39B57C0339AAF75F170E14997040EF1E22099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662751, "uuid": "272f3094-7e40-4bca-b599-d309ee1a193d", "value": "12288:zMh+17AEgp5JYPDuZSsoZ3GdVk86yvN3+ijqArj6zIH10y+6TOjgpzmGy:g+Fg4KZeZ3GtVJxr+A0yrTP8Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662751, "uuid": "c98d95c3-2f63-4214-be63-8606e7b675a0", "value": 647955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662751, "uuid": "45998789-d997-4dfe-81b1-361ff62213c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662751, "uuid": "aecc2a3d-d45c-45bf-b090-17ca2f73ae5a", "value": "PURCHASE INQUIRY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e470c7-890e-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700640509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640509, "uuid": "fd02327a-1ad4-4470-b322-e434cc12332f", "comment": "Malware payload (Stealc)", "value": "4f6498645602e0c32d122c783934cb0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640509, "uuid": "91485f32-120e-42d0-9b3b-ac6ff3673a22", "comment": "Malware payload (Stealc)", "value": "68f6ce06f665b89a0f03385ae3b6ecfd399d259c78f614c571be462f527c43da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640509, "uuid": "f16ee49f-dd39-402e-8273-e77b4a2c5f0d", "comment": "Malware payload (Stealc)", "value": "a3cd4c623e474110aaa72f8b77bee9e039843b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640509, "uuid": "d2a81ed6-a9a2-4431-80a0-6999fa38cd5e", "comment": "Malware payload (Stealc)", "value": "bc8ae9930d6498d1498b7e35d392c54da11c53fcdcd99d161885fa13db04a9f307913b0be2b3efd288218f4694fc1152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640509, "uuid": "1e431696-adb4-4d71-8d4f-bb1b99be6b47", "value": "T136546A1365DCEC71C49602318F2DD6EC7B6EB8238D698B4B36582E5B7D302B2D667312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640509, "uuid": "d884c568-82a9-4585-9b4b-a614ca087110", "value": "c001cbd1a4a4c74d1eb06d60e4b8b11c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640509, "uuid": "6e5f81ee-2368-4a17-b608-cd1cc93d81ca", "value": "3072:ql4ndwmpOZPIyjYo7/KkqpEDi0sRpd8oaAMxMYL5NA7vT4DxobOT:1CZQAYo7iisRroRxMgA7L4xmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700640509, "uuid": "84c55c17-cd72-4c9f-8987-8d474ed9fe9c", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700640509, "uuid": "0af8e929-7586-42b3-bd8a-1687930c3b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640509, "uuid": "f268e701-1c99-4c25-a83c-f0f5e30a3921", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3815763-8901-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700635089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635089, "uuid": "2f194822-cb86-4807-958c-a73bf9b224e9", "comment": "Malware payload", "value": "cb51df17776fd29c5224c939ce2495f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635089, "uuid": "47b4ce9e-c98a-466c-aa33-12eea87606cb", "comment": "Malware payload", "value": "6901ec63c2d421d936a33503232e60a3b80316220c0b29e52622e5c9ceff8994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635089, "uuid": "1e34af2d-b2b0-417d-871c-ee40c71e4393", "comment": "Malware payload", "value": "35a15c04394d4266b8b812ebf898fe0224aa978a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635089, "uuid": "757f3975-0c4e-4ae9-97e4-db00cf9c3d11", "comment": "Malware payload", "value": "985f307c6bb99dda7ff7c5b621b40348d97ab3a1ec6c7ec68dccda078dc7a88201c40129aacd0acfa9934a067414f29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635089, "uuid": "812eab28-f95c-48d1-86bc-1c55ed23f0cf", "value": "T10A546B1365D0FC31C79203758E2CD6EC7BEEB8298E65876727183E6B39312A1D65B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635089, "uuid": "4fc252bb-277b-4982-ad44-72138f3a1a80", "value": "c001cbd1a4a4c74d1eb06d60e4b8b11c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635089, "uuid": "bd990575-510b-464a-bedf-fecb1e39fcec", "value": "6144:QuXyCYmaHu+JyiTLII7ZDNLtr4lL4xVm:QMyCYmsZsiTL3tDNLql0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700635089, "uuid": "55a69220-9477-42c5-8b18-9f2a32636a8d", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700635089, "uuid": "c9dfe9e9-6343-419f-ab3e-2e51a991abe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635089, "uuid": "c0651d1b-a79c-4fe9-a294-b0b7164b589c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413f5150-897d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700688155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688155, "uuid": "3798d947-cd9c-4b90-803c-3d505ba6c1c8", "comment": "Malware payload (AgentTesla)", "value": "b9ae234ebfa36f591b3c1da16474db2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688155, "uuid": "a34a1f04-c3e1-464f-be2e-94d066fb7cd7", "comment": "Malware payload (AgentTesla)", "value": "69715fbd58afc0f39fe10b0672b80ffbd4fa4752b85eb2a7b016ffc758e5e9c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688155, "uuid": "cb8c331c-5324-4458-b740-85ef85ba26df", "comment": "Malware payload (AgentTesla)", "value": "dbfbf1af74493c8283aeb9a36973fb30d5750325", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688155, "uuid": "ad181f19-0d60-482b-9988-386348cbb5c2", "comment": "Malware payload (AgentTesla)", "value": "04908a9b3ec059b64a4d6799a9d95d4a1d976888a86788ce72f0c42c688524e1a5799802e01a02e474cf5e04c98f7d1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688155, "uuid": "3f218463-45aa-4f78-9367-9eb718a9b0f2", "value": "T1490631023E49F791C1C96E7B42DEDE3943A0D4E349736787BF04BE681850266AE3527E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688155, "uuid": "2b676fc7-b835-4a74-bba4-1ffdfd9eaa9b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688155, "uuid": "a1f8e45b-0452-49ec-baf2-f72c780669ce", "value": "98304:n1zLjxIlfhtrw6C80I31RjtXuFdHTNh2d5Uz9EU:nk1htrw6C80I31RjtXuFdHTNh2d5Uz9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700688155, "uuid": "d763530d-0dad-409c-9c90-e26b262a88be", "value": 3659776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700688155, "uuid": "89fe87ad-3013-4d0f-a7dc-c5708f425cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688155, "uuid": "6acb5777-4449-4460-b720-0dc23c199c64", "value": "PABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZhXMYfNaBrM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9900fc61-88f9-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700631609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700631609, "uuid": "5cde78b6-f940-4faa-8c60-aff4aae71b63", "comment": "Malware payload (Loki)", "value": "a9ab88b26a78c228dac77ef3edeff872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700631609, "uuid": "471601b4-5376-468c-b370-9dcadc033279", "comment": "Malware payload (Loki)", "value": "6b0516642e5baf8ceaea3fabe4456f60f643531befc1185102215fcf28e4017b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700631609, "uuid": "2b4fc203-3dec-4763-85a7-6441005a00c6", "comment": "Malware payload (Loki)", "value": "6632b648acd2b51df7f9bdf72e5fe359ff19a374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700631609, "uuid": "b3d16d41-a969-40d6-876d-91d7d66b8a06", "comment": "Malware payload (Loki)", "value": "678edcec9517d479c7fe2c09cfcf0852705dc9b10d731937b636a5b66963db5528301d5d827b9d6949e12e083ccaee8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700631609, "uuid": "2a923734-f3a7-495d-82b4-9e951b4700fd", "value": "T18CE47C62A3A04837C4A3353E6C175B547D36BE10BA24EE863BF91D5C9F3C6C635291A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700631609, "uuid": "6eb65559-bf51-4274-b8da-861a9596aa42", "value": "c728e6f80294f1f6e35dfefab1edb9f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700631609, "uuid": "9840c5dd-8a23-46c7-9ef1-0388be6b5668", "value": "12288:Qupj9D+r+YHWdAQ7t1IF4KB70yBWnDVeUGPaJB8SDcB9M6yFl:Q2RI+Os7tmL4ysDUUGPaJBVYy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700631609, "uuid": "62cce92b-02af-43b7-a451-a27d3943d4af", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700631609, "uuid": "36c7b05c-c3b8-426e-9c30-f97da311bb75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700631609, "uuid": "cc53cbd5-f6e6-43a4-8668-7077d2af1448", "value": "A9AB88B26A78C228DAC77EF3EDEFF872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00623b3e-897f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700688905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688905, "uuid": "cf78f22b-383d-4df4-9723-978d30e3707e", "comment": "Malware payload", "value": "d1dd8cc25570c149fd0c201fe74385e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688905, "uuid": "c3f05455-d37b-493c-8cfc-efce98c537f7", "comment": "Malware payload", "value": "6d2cdd0db9fefca23ee97cb400ec39012511511846114b3fcaaa633183830e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688905, "uuid": "0713e47b-2d2c-41ec-99bf-a58ce6641498", "comment": "Malware payload", "value": "ce6f8621bb60c6a4fb0875dc4bb2aff52dfe68df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700688905, "uuid": "a9f09f27-e9df-4fef-a276-dd9feda474cf", "comment": "Malware payload", "value": "9a558266ef1963a69643647fce3489b2ce7ab5a5c46bb403a5a4460c6be1c15512594e4e1b1d442d027240d092605928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688905, "uuid": "e0133aaf-f6ce-468e-9738-e0cbae45f613", "value": "T16995F1B19BB0C171DD7726BB6C2B8654C92E3E642E6D283A1BF531890E7A7C13C36147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688905, "uuid": "c003b576-bbd0-46f7-9c84-41314de74f90", "value": "5ad58dd99cd3bbf2c166bc1ba7c8b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688905, "uuid": "13c910c9-1844-468a-aab3-fd1f5e0ed8ac", "value": "49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW40MyqChsyfue9T:aDqRMXpcOXX8Za31CuCc4MXC+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700688905, "uuid": "2e50f3f6-84ae-4da0-a3c2-9c9e1b5184fc", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700688905, "uuid": "952cf81c-cb2a-40c4-bd93-00674314fca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700688905, "uuid": "0cecb0a8-f485-4dec-bffe-bf4a6f46df40", "value": "U prilogu je predracun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2793d582-8913-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700642585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642585, "uuid": "153fd189-2a13-4b2b-8ee6-5122a352463f", "comment": "Malware payload (Formbook)", "value": "1b4223056fa5594228b539dcc481a9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642585, "uuid": "f031f520-a1bf-40d6-88b9-54c5bc17a797", "comment": "Malware payload (Formbook)", "value": "6f3940be662f3aee053506bf0e2f4d2aeee6b6d83589fbb5ac09ee1a73aa28a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642585, "uuid": "c5447711-4a98-427c-8cc5-ce72326a9a1b", "comment": "Malware payload (Formbook)", "value": "5e1cadea976b368be9631478aa81139897c528d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642585, "uuid": "041ef12e-77a3-4857-81cf-0be587b8cf9d", "comment": "Malware payload (Formbook)", "value": "410139fc629a5c757e0f4391c04c37a91c59d75d67cd69031ddd8ce61ad385a009985e91908178fa2e45e62a5f0ce161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642585, "uuid": "837192ef-c1ae-4e66-ae3b-d23cfead5201", "value": "T1F285E175AFA0C172DC673AFB6C2B8285C8193E942E5928761FE831C95B797807C35387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642585, "uuid": "2b014c5c-eb31-47c7-b62f-70ada359e9c5", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642585, "uuid": "017d9d75-8046-487a-ba49-c533593c678a", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW4MMyqChsQ:bZmXX8Za31CuCcwMXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700642585, "uuid": "0a01f7c8-87c7-4e81-85f2-ee1b5bd21dd5", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700642585, "uuid": "905fd784-f988-4925-86cd-cd48e8545b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642585, "uuid": "4bf0c6d9-b2c9-4270-8e2b-71e52849cda7", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198919a9-88fc-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700632683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632683, "uuid": "ebdb2b95-d37b-442e-8faf-b793c8dcb19b", "comment": "Malware payload (Smoke Loader)", "value": "9afead92d2204c3b3cd91b1f1d33b835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632683, "uuid": "fcbfcbc2-1f19-4085-8281-fe6eafda9d63", "comment": "Malware payload (Smoke Loader)", "value": "6f735da34e90dce7418f49a7d25fa183650fd9fe681804a9ab5f80d3005b1c5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632683, "uuid": "cf2dbbc2-efb1-484e-98bc-73e6fc41b6ec", "comment": "Malware payload (Smoke Loader)", "value": "3e98940b870d4ce110789008de5774e0d96adf11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632683, "uuid": "a7d868c8-0fd0-4227-a3ed-9b67d187097d", "comment": "Malware payload (Smoke Loader)", "value": "6ddffcd585ca5ba83d30ce87a83a44ce650f23f005a186aae060c8f4dd6eed1c7c54fe7043d9a736bd443b7e3ec50ca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632683, "uuid": "048ed524-f39a-45ef-9a8b-b5aea4988ac7", "value": "T1D0D6017553C85829BBA04C1650F26FDB0CC57AA07A10B5FA583417EE9DB0B74C93BE8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632683, "uuid": "bae79e23-7cfa-4610-b9ef-9fef48be9c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632683, "uuid": "3f11004a-6096-46d5-add7-d62a91e16911", "value": "196608:AwHBze5uglOtQYrWEZfK5IgAO2N2ZGay7QMB2+FyWio4xiE+7i6vxV8jv0c44:AwteUEBuaZQ8+TF4Y3VrY0cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700632683, "uuid": "c98152b6-a2fe-4ce5-bbfb-8e4ee27894c4", "value": 13147136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700632683, "uuid": "d2d42716-e9fb-4ef6-a50f-cc8b43495d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632683, "uuid": "d184bd0a-0d91-404d-af9f-95e42f6e4080", "value": "9afead92d2204c3b3cd91b1f1d33b835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb88764-8922-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700649362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649362, "uuid": "7a466140-2aea-43f6-b149-1c4582a86dfb", "comment": "Malware payload", "value": "8aa34e559dd8482fc84edef70f556a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649362, "uuid": "94b30551-2eb9-41b9-a5b3-50c6641f2821", "comment": "Malware payload", "value": "6ffb397504a5245ecfc94e0f2148e6a15d546ec9313b8f0df8046d3b715a1159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649362, "uuid": "460a8aa9-2cbc-4840-ae0f-b4f06e9546b0", "comment": "Malware payload", "value": "b158e4e252a629bb81a4a6ce85b363737dbdb62e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649362, "uuid": "092676ba-5324-4880-a86b-b75d51f685a3", "comment": "Malware payload", "value": "d36d2553e7fd7bbdad1f92b45650608f0b7ca8d17c5b31027a84e3b8ec43cb15a7727079835089c4fe8fd20aa4d72c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649362, "uuid": "3c488ebd-8a10-402d-9c74-fdece46f7222", "value": "T1FE559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649362, "uuid": "275aa475-d660-4b17-87e5-75ec213d8907", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649362, "uuid": "b17fbd37-dc1e-4a0a-999a-826bcb98193a", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700649362, "uuid": "ca7f7633-9884-4633-8f08-7bf6e21b5de4", "value": 1322073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700649362, "uuid": "34f93db9-6fe5-4248-bcae-2f99e1412507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649362, "uuid": "5f641354-3bc7-4135-afe8-7cb39c16fb1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3176362b-8935-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700657205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657205, "uuid": "a50af8a5-99f4-45f8-8758-95f7af54b979", "comment": "Malware payload", "value": "d062e7ff0cad847bee875d172dbac019", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657205, "uuid": "0967b68c-a9b7-4ad3-b4b3-9201120048ec", "comment": "Malware payload", "value": "72a97fd1a28f419ae5595383aee282825f0c356893fa499d310340faeccbed51", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657205, "uuid": "902b6c69-432b-4a9b-aad8-111901ba4a58", "comment": "Malware payload", "value": "9176763078850f91025657eeddfb76f864616bf4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657205, "uuid": "ad662c11-d295-4338-a180-838b64c2aff4", "comment": "Malware payload", "value": "6493d2cdf13fa91a4b26f7c0b4c06a8c9568fd94d8d85d9834d7c4742a1366bb55d9ade679bd0b5543ab473d55b44e6e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657205, "uuid": "3664b176-708f-4cae-827b-9212e50791ba", "value": "T10BD0A73AA5C1D0568A8210AECF76B55C542191778C14ED0F721E1731BF05C975A831A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657205, "uuid": "39363a78-77a3-4192-9a88-71d87bd3078a", "value": "3:IlvUvyPBlLAdXPyShL0RdwqgxLfFKcTuGFF/aUF9vXnPONYB+/KWeXJHo9mt31le:IlvE9DhL0Rq9PFk4KY/WIJdtnPNwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700657205, "uuid": "fdd0b36f-6570-42c8-aaa2-8a662db477c3", "value": 259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700657205, "uuid": "f969d1db-3e8d-4735-b5a7-2935935d40ba", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657205, "uuid": "fec7f971-459d-4b53-bb17-0a369b4c1183", "value": "test3.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11825ac1-893d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700660587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660587, "uuid": "80f74bed-35dc-4eaa-92f1-bad7462b6366", "comment": "Malware payload", "value": "5de8a53252f7936c76faed665958ede7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660587, "uuid": "46be8dd9-992c-4a22-85f9-29377cebf721", "comment": "Malware payload", "value": "7384dec8a7a13e1709dff93154c0cd796055798a19fe470f30c211a991d46849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660587, "uuid": "98dc1001-eb14-4687-afca-cdeaa905f64a", "comment": "Malware payload", "value": "8507c24f624e17abcd03bac2a125f5effad52295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660587, "uuid": "d0bdf632-fd09-41a5-a5f4-bca572bf0b4e", "comment": "Malware payload", "value": "d3f4cdd4ec11886b3883e81dc40118766193f57d1b40e4fa57ef2751d0a3343a2b5d9ad0c356d4f8794042505ca74a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660587, "uuid": "418ab0ff-4d43-41a6-a051-5b443bc4048c", "value": "T14B64D0C4711181BADF6D833D51728DD25872FD2F19C0CE9B52ACBE26357221389ABB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660587, "uuid": "a1900368-b824-4eaa-9abc-315a4b7fd3b6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660587, "uuid": "203a1004-7dc5-4653-9fd4-17f30d05c7b5", "value": "6144:KNeZz2KU3/oXHSR0a/r8Z6YXar2VTXgOQllchjpV:KNTBaHGXrk6Ikm8RlKhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660587, "uuid": "bb6c2c54-6d89-49f2-b3fc-0cc242122ca2", "value": 319456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660587, "uuid": "a8a5bed5-7031-4043-9e25-b6f4b20a5917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660587, "uuid": "91a42573-c183-4775-ab73-02ccae2fe34d", "value": "rIMG-WAA0211202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aac9eaa-88f1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700628014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628014, "uuid": "19fd58e9-0c1a-4f06-91e8-402c0315d997", "comment": "Malware payload (Smoke Loader)", "value": "75630b66b2aef0b34117217acf9d8367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628014, "uuid": "82308990-6a56-4366-a154-1e248bcde106", "comment": "Malware payload (Smoke Loader)", "value": "748c26e1f5c15693e97403c0e228b60433d4f051970fe13704174a90f824f5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628014, "uuid": "89dd6879-f447-4f63-907a-6ed03b232e8d", "comment": "Malware payload (Smoke Loader)", "value": "12c07908ab64b47985ef606e924fca30a32c6de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628014, "uuid": "54c8e526-edbf-4b63-9b6a-a03f25993ada", "comment": "Malware payload (Smoke Loader)", "value": "42f6ca4508d7c3b0e2643468501a668f29376364c3ccb346b8d96e2970037b23fbde4687aa48d2926a6d443cc3b11c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628014, "uuid": "27a8a2ff-377f-4ef3-b5a6-a6b14ce3a137", "value": "T115446D1293917861E6134E368E2AC2E76A1DBF618F15E7A72334EA1F09711E1CF63F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628014, "uuid": "859121fe-ffac-4404-871a-da496d6128f5", "value": "edffd74b291a0c850c46a44e0038abd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628014, "uuid": "48cdc47c-085d-4c22-a4a8-0fb9d24a9a0a", "value": "3072:0caEhmxJOUiRwz7MiFhZL0Ng6ySlxr+IVE6HPzSqcudH10htlmmgxP/cIDP6cPB:j/y4UawvpVkg6lzr3E6HbSbtFkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700628014, "uuid": "b458a8c7-e215-458b-b449-1e35a5c241c0", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700628014, "uuid": "cb6c5668-a842-4cda-8013-dd5b27dc6a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628014, "uuid": "e4dd801e-1569-4d06-a4a8-9eaf6cd3edb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1e8737-8943-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700663452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663452, "uuid": "03a3bb0a-5139-4b17-a899-5bdf43c6766e", "comment": "Malware payload", "value": "1cebf0114b0d9d55a9be7e4448052033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663452, "uuid": "7fcddaaf-5740-404d-ae6c-7df67cee6651", "comment": "Malware payload", "value": "763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663452, "uuid": "6bb1f78b-6960-4e6b-94b7-9852ab26f898", "comment": "Malware payload", "value": "ae4b6043183c32466e3eccce346ebb2b53298a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663452, "uuid": "16fb02ea-0a22-4258-b8d4-be989e1d01f4", "comment": "Malware payload", "value": "fef3a2e3a9df98c9403745354b29d69b5af7ac53168691dea51e610ba1283cffe2e2ef13a8fa5700b029cbb47786e1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663452, "uuid": "9bfacba1-ed88-4ae8-a54f-097d527d9d7c", "value": "T17333F1FCFE460A4AF2E4D9335273845C956F176C4D04A45ABE1CD60229BB4BA727823E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663452, "uuid": "eecf26bc-dfc3-4042-bfd0-efec8b3ec802", "value": "fb96a22cde262e44c4d3cd35392d69f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663452, "uuid": "73d4731b-a065-4be2-b3f9-ef60e29a017b", "value": "1536:IDOnfPe1Vfn332CUhMAB/TeduudGaOQQW1:0Ony3m5hjB/T0l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663452, "uuid": "80479adb-0140-4a7e-a576-040ebe67133e", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663452, "uuid": "962246d9-cb8b-436a-975c-e780b66f7fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663452, "uuid": "baff96f2-1929-4503-9dec-ef3bf86d0bb3", "value": "AntiRecuvaAndDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e89d35-8904-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700636108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636108, "uuid": "63d39070-765a-4eb9-afdf-18568d72162e", "comment": "Malware payload", "value": "dfc9a452597aa2889d28c9116f38b413", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636108, "uuid": "5a70af8e-0a31-46b2-b314-10aeaba02578", "comment": "Malware payload", "value": "774417338c050c1df63961768edb9f22d453e6a06d73a1d34545124d5032fb50", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636108, "uuid": "75ee47ed-85d3-4edf-91c2-c8f679f2ba71", "comment": "Malware payload", "value": "8de889c6e79f2dd5b728808b9fc4b7387fbe1c8d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636108, "uuid": "2d558286-e052-4a41-9c37-91d041bc1175", "comment": "Malware payload", "value": "6cb6eec7e52dd8e98292efd141ec362bca8fb9aa61a9ed5ddda9bf55b39e89f9d25aec763da7d9c029475a8ef85d00c4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636108, "uuid": "ce502000-b47e-4e16-87aa-6641132bc10e", "value": "T172F4BEAC365076DFC817CC76DAA82C64EA61347B831FD243A06B16AD9A0D997CF141F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636108, "uuid": "4e7d84dd-533a-4cb6-9778-652035d2413c", "value": "12288:EZO8oGN6/DRPXOjmyT9KWsYEk+PTOghfxNpA8/Ijn54AtWY+fsX20ZB8ZmTAcpu4:O/Ehy9bEpPTOgh5vA6AITfsX2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636108, "uuid": "f56eda6c-9049-41f6-bf48-048234248711", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636108, "uuid": "96bd7b55-68ce-4079-b6ee-656118c2d765", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636108, "uuid": "702650d7-bbd1-4be1-adcc-8230c53abe80", "value": "Commercial Invoice.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be5575c-8907-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700637385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637385, "uuid": "76d98b5a-14ec-42ec-9f02-cd778ad05b6c", "comment": "Malware payload", "value": "9c49bdbb34c0ac606c4f14eae62f0708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637385, "uuid": "059c866c-3f55-49f3-ac24-011d39de63cd", "comment": "Malware payload", "value": "7865d83ed058b8d6e126d57f219f7fee5c50f2ede1df3d379099d7b0d2c6bd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637385, "uuid": "b3df72f6-dfc6-46a8-a037-a1d6b8f014af", "comment": "Malware payload", "value": "bd91921c5c8460b2aff1fcd5e208db89cfbc4b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637385, "uuid": "869d0d89-65a8-4c2f-af8b-400a06b41a4f", "comment": "Malware payload", "value": "96ffdc939348b30579d7b2a47f83c6b09c509dea6669beaee5acd2f7404ee5c0eefcbb4573c1d02f00fc8c6b8dcabaa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637385, "uuid": "97d374d3-4b37-4c29-b55d-2415106ffd1d", "value": "T15FD4234208388AD2C58B8F79B9731A7843B2B63F6E5AC64969F1189C637E7154131FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637385, "uuid": "c2c9ba9b-4bc3-4e5d-9ee3-8d07aec2b484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637385, "uuid": "33b5ce79-ce49-4b2c-88c6-973fe57d2be6", "value": "12288:My8oOe6RuaBnnB/0+sF1Ec9cFjgHrEc7FZmg0iSMG7Dq10R:MFD8aBnYF1EFjyEUFZmg7KD/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700637385, "uuid": "f12c7dc2-4fa3-404b-baae-5c6df13c5284", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700637385, "uuid": "e8fcbc96-4cdb-4c9b-a62f-37dea4923bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637385, "uuid": "27ea632f-9c5b-4115-a334-f1a19390a28e", "value": "SecuriteInfo.com.Win32.PWSX-gen.30485.8753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f98e22a-896c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700680824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680824, "uuid": "d4810721-31e7-464b-a354-8fd51c3dbd6f", "comment": "Malware payload", "value": "0207cbdf2a7dbebf40f44693e3c1190c", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680824, "uuid": "9919022e-8410-4d16-8618-492ab18601ac", "comment": "Malware payload", "value": "788d5d8f2c970f8bcfe2e32771305d11fce9697dd96573c75d77ba61b9139bb7", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680824, "uuid": "25a28c2d-3131-4a9d-810a-fe4e403a4683", "comment": "Malware payload", "value": "415db1131b830ced44f77901bc103b1259cc748a", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680824, "uuid": "c282e14c-ebce-482c-9471-3c237e54940c", "comment": "Malware payload", "value": "5f8391ea531e4bb86ce17cbc39c6de1570512a26bea95aa2c5cd43b3306ccb222d1687228251b2304863c23ca3613df3", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680824, "uuid": "7381a60b-efcd-41f8-b8ad-4f9d82b62fe5", "value": "T1FED5BE2A35DAC637EB7E82306669D77A61BA7EE00BB100DB63D43A1E1E305C15275F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680824, "uuid": "64b2ceb4-ade3-4159-98b7-54c630ffaca0", "value": "49152:bWtUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZoULu4l8:v30ZnqKzFnWntuxPLffjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700680824, "uuid": "0192321e-c18e-4b9d-b792-dade9ef639e5", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700680824, "uuid": "863294fc-970a-489b-9878-29eef6eff727", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680824, "uuid": "7e80baa8-a419-4733-9ee5-c53edce62c09", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3c07db-8982-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700690319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690319, "uuid": "9ebe2884-59d0-4ffb-9787-a488af489f20", "comment": "Malware payload", "value": "1059ddc076d8754e992f08b29c24f86e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690319, "uuid": "391e0bfa-9e27-4681-9b2e-19740c0fd565", "comment": "Malware payload", "value": "78c845f53d2bf914d20c871e2cd6a41d617d7e6316d9e235abee02a45b8ded86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690319, "uuid": "b61791c1-f49d-47af-bffb-ca4ca0b396f5", "comment": "Malware payload", "value": "5cdf69253fd9978d9d5500aa7c98fd6a2f12dc8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690319, "uuid": "4a1c9a9d-e595-4ce8-b3cd-b604744c67a9", "comment": "Malware payload", "value": "a96ad9029908a44059649f32d7b6be6a848f14b5b9fa0a555f6a4c30bc007c55aa052b8587aae3a56f2e3f27f9f3afc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690319, "uuid": "5bead80c-0682-44c6-bb88-f6e5d73d8b1d", "value": "T133447B1367D0FC21E55647304F2DD6EC7B2EB8A29D25874BA3183E6B29302B1DAE3351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690319, "uuid": "6ebef066-7a19-4a77-8498-8fb686fdfa0e", "value": "b1987f19009bd4af7032badc4f248687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690319, "uuid": "2fc32920-0f3d-4d19-8f35-a6e55c59b695", "value": "3072:KOyjQHGNCumvusA1VKT3cGn3f63PIFPvhVtF5NN2PEIPT:hyCumvxSKQE3fGgJN2Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700690319, "uuid": "45bfce12-ae5c-4c6f-91e7-dff75505863a", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700690319, "uuid": "1816d1c1-3b1e-46f0-89f3-e747a5130a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690319, "uuid": "ea51859c-2165-4236-bf8a-0f76b9deebd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45357a9-893c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700660457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660457, "uuid": "d627c441-2bd4-4576-8478-a439a185c9c7", "comment": "Malware payload", "value": "4751d03825a24ba776849a298ea61e58", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660457, "uuid": "287c3c10-baec-4efa-a450-e700760dade3", "comment": "Malware payload", "value": "79138652202f0e114c24142536d52eef141667488402084ac1c4cd5346bdc086", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660457, "uuid": "2e205467-d934-4433-99c0-85ff82b42623", "comment": "Malware payload", "value": "abfb989a33094ecff94f661813a09b7615bcd454", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660457, "uuid": "51b169df-db85-434d-9b2a-a0fea8f8474a", "comment": "Malware payload", "value": "1f7e31497bdcedb964447e2d04e76b9826c7e57de31fabf47513e803e4cac7d606b47304055e296849923e6d52c36693", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660457, "uuid": "26ad73ca-9988-4377-949f-74bb42a628a9", "value": "T12EB42336961F6D8C7AA262FAA8FDD02F694573CE320124FD5E82F910E57A4ED1C1C607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660457, "uuid": "d38ddd0c-7e7c-4f22-ae73-a2aaa600c036", "value": "12288:zMXMv3tAGb0yUdHTz9DfovzIkGe4/S03Yc7Bsmx4ds6E:z9/tInUskGeabrFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660457, "uuid": "cb3d2a30-2618-4b0c-9b24-c709ad57d652", "value": 531699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660457, "uuid": "c4eb8a78-7aab-4c55-9b53-d85d58d37cfa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660457, "uuid": "12eeb0e8-2fc9-44a3-9ea4-e2689e2f7acb", "value": "Document_Set_2023-11-02T1138.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27002c9b-8953-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700670072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670072, "uuid": "d327849e-fec7-4802-b33c-442afbc4549b", "comment": "Malware payload", "value": "91ebc657a525fe46ad02d742ff3ab926", "object_relation": "md5", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670072, "uuid": "4211be8e-642d-42b2-bcb8-266db0c613cc", "comment": "Malware payload", "value": "7a72648ee2377109b3fd81a9ac44715f0bcdcce87bc3d38a1dfab49cdf36c38c", "object_relation": "sha256", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670072, "uuid": "013ddf10-5e71-436f-80b1-ea6bdd0eaeb2", "comment": "Malware payload", "value": "81a829612f658a7f6e232b15c345ca1ef0f54e07", "object_relation": "sha1", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670072, "uuid": "f4d7e215-4a10-467c-ba3b-c8ac1065e0db", "comment": "Malware payload", "value": "a0946c2b6a46374bc4794bad53c45a07efef24c6a246fc7bfd711649bd8f133f9adf0cd08afa472a44875a5c47d7bfe8", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670072, "uuid": "a3eff543-613d-4dc0-b566-a580d625e00b", "value": "T1739423246A114ECEF5F7A0F4F0D3939A5C48E54FB8CA9662D9AFA4C13DB534AF21C601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670072, "uuid": "884eb32f-cc5b-4eee-9860-2b8a1af23295", "value": "12288:+uG0kIchg3yAybywnZII4HocEuT8oFjS3:+uGyniAkywhUZtFm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700670072, "uuid": "77942e36-4667-4e40-9757-c2f7bee6478c", "value": 417234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700670072, "uuid": "939b430f-dccc-4c34-baff-ec0e31711603", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670072, "uuid": "b8fa18cf-bbc5-494a-a0e8-4b8b4c660090", "value": "GPT5 Pro for PC Installation v1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df097ef0-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638598, "uuid": "8e5fe5d2-6b10-4152-b30e-160fd233f351", "comment": "Malware payload (Mirai)", "value": "aae6ec241a8c03f2f95dd8a3929b8ec2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638598, "uuid": "7729c9a6-b7e4-4019-8776-aa44f85f6364", "comment": "Malware payload (Mirai)", "value": "7c9f688ee675931880383478b669fc78ef6c9ae00c094e53eb8e333ce5fa4f0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638598, "uuid": "8fa41f28-b9c8-443c-b912-5895e720641b", "comment": "Malware payload (Mirai)", "value": "db59601a8aeef2b98edf0c2bad5ff07613e37476", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638598, "uuid": "f64654eb-62e7-448d-98bb-fe6b380ce212", "comment": "Malware payload (Mirai)", "value": "f92c396ff429918513a65237f6a29509fee36d9da682515446e892f9f06e4c22ddb8857a6a42bdc142ca055aae1c051f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638598, "uuid": "135a4aeb-541d-43fa-b73b-c99252666ec5", "value": "T1B8733936F9392A23C0D0A47E11F74B51B6F11BCE36A8C61E7D720E4EEF616506412EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638598, "uuid": "258d1339-c092-42f5-bada-e0e8855f98c7", "value": "1536:pMsk4f4UnhcUt+Hq/OyFU3+STWJHsujO9uIRcOO:CskY+K/mT+MuWRcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638598, "uuid": "aa6fee45-1612-4256-bcfb-8cfcf2ae365f", "value": 79792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638598, "uuid": "dbac217b-971e-451c-b25c-e744250a0ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638598, "uuid": "da9217a3-b7ae-41d9-bbd1-6289badfe18e", "value": "aae6ec241a8c03f2f95dd8a3929b8ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d33be9-8984-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700691297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691297, "uuid": "498ed50b-0850-45e9-9632-297a0bde527d", "comment": "Malware payload", "value": "e39c7680cb618b0e9b73de079355a60e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691297, "uuid": "4bbdb15f-f767-40cc-b7e6-c683cd1c326c", "comment": "Malware payload", "value": "7ee5c994ac006822269f3fe52d67cee97f5f80850451691a0bb721dc70169bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691297, "uuid": "edaba127-e4a7-43ea-9cf7-6703c8eaee37", "comment": "Malware payload", "value": "a7e610ba6102b77b0ec305919a1a7c98ae551937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691297, "uuid": "521eeeb0-1215-44ea-ab06-7282379bbe01", "comment": "Malware payload", "value": "fd5cea48a2e06319cdde1082eae175e07c5bc92667537e7a6204a7ca00e8d0ae9c93619a646e00bdf427c4f6a18f758f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691297, "uuid": "cfcdabef-6304-4ea3-a00b-43b1c94c6f4d", "value": "T119446A136DDCFC61C45607348E2D96EC3B6EB861BF7C874622582E2AE9323B1D667311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691297, "uuid": "6831c8a7-eaad-417a-809d-58ee8f179310", "value": "c368fa427f1f3f59d6f5623ae63cdace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691297, "uuid": "87c7ac14-5b08-401e-981c-ec27fea28284", "value": "3072:deZgkXH6uPzRSvwYcDx8AEKzFf635tqwzDuAep+72:SKuPzRShcKAxU5zDHeMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700691297, "uuid": "3d8a86b8-2e3b-4d35-b74e-3b65ba820682", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700691297, "uuid": "8c4f75c0-033a-40dc-8fec-75ab16a12b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691297, "uuid": "ab26a275-a5c5-4769-b898-9c2a9333b8ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37ae66b-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638605, "uuid": "0f75a902-cf2e-41ea-b424-65b28c8e1fd3", "comment": "Malware payload (Mirai)", "value": "03820eb28af050fd869894d3e25fd86e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638605, "uuid": "dc39931a-8241-4efa-a8ac-fe5c9223c7b3", "comment": "Malware payload (Mirai)", "value": "7f95c7bd093b832a54154c6333b82538bf0174086de578da385f4865b11846c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638605, "uuid": "8c229739-573f-447e-980c-debafcbf7f2f", "comment": "Malware payload (Mirai)", "value": "b73fe9595c638df69c246c46522c0bd2494ba5d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638605, "uuid": "615947d8-9390-4921-9c28-c382949a8723", "comment": "Malware payload (Mirai)", "value": "b48cd7a0bd92403cc2b944048b25beb0c02b15cd8f57ffad92cba8d5ec74cb114593c121c1b873497373ac8ee46b206b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638605, "uuid": "63624142-3110-4c20-9383-95b92c27de7f", "value": "T14B730751B8C19A23C6E4237BF96E518D372563E892DF3207AD212F6477C682F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638605, "uuid": "ea465814-2765-4fe4-9c83-3b39ac05db5f", "value": "1536:r0TYdvgcgQvt8ybKsyicfjfS3TLpKVIahWlJs7y055RZTq35Nyg:r0FfO3ZKVThKS583C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638605, "uuid": "89437f95-3479-4ff1-ac6b-8c755c4f7a8f", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638605, "uuid": "337b81fb-b0df-4605-8f4b-0f65078bfe01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638605, "uuid": "a324a021-14c0-47b8-a93b-c85f48b89f0e", "value": "03820eb28af050fd869894d3e25fd86e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11adcadd-88f6-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700630093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630093, "uuid": "3a7596a6-09c8-4ba4-ad01-56e93f9a01b4", "comment": "Malware payload (Formbook)", "value": "822449ac202c99dd0127517629a64236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630093, "uuid": "285ee8d3-26f6-4fcb-bec0-00089e72019b", "comment": "Malware payload (Formbook)", "value": "8195afbce4ef411cd0b1ac7cc27e3d66b575df16a5433b60aa0e7a3529f465ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630093, "uuid": "23da03f5-5809-428a-a5ef-b384e91a3e3a", "comment": "Malware payload (Formbook)", "value": "6ae1326fd98a678c27e02018c674343e28dd5202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630093, "uuid": "2f1e5a7e-97f2-4aef-81c6-a45d49d75cab", "comment": "Malware payload (Formbook)", "value": "7b478e18ec1325e20877b58ce32437300eb9f82b87b084a9171b378f2b1b125ce4d0643e7f9c7202ceb0e132adce9487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630093, "uuid": "805a8341-8fed-4ef1-9d63-45e5997f1ca1", "value": "T11BD4127576BB6BB2D9A623FA0432612407F571AC5365E23D1CC3F1DA9A41B004F21FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630093, "uuid": "a1894a2e-7f98-4f0c-8f07-af9373017136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630093, "uuid": "42eccfc1-5083-4592-891e-fd7c60b4d1c9", "value": "12288:HrY1EL/f+jDKsG6fyDUpNrP0rdivBKg5Jp+seV3+wYGkL4ULzl:01OH+fKszq4pirdOD5P+su3dU/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700630093, "uuid": "e77b8b40-3a5c-40ff-ba59-c5a9cef97544", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700630093, "uuid": "ccab1422-1e94-4e3d-abdc-b5b88487655e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630093, "uuid": "e97c2f4f-2a32-4d46-bade-6d9dbfa1cce9", "value": "SecuriteInfo.com.Trojan.Inject4.59820.27905.32584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c0dcc6-8964-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677605, "uuid": "77adfbdc-0d74-4230-b4a6-69e4891b1b45", "comment": "Malware payload", "value": "cbeaedfa84b02a2bd41a70fa92a46c36", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677605, "uuid": "62352b3a-448d-45e4-ac46-023245f70e06", "comment": "Malware payload", "value": "81f7360302e4dcc3e315ac51b0ab1945004809cad1e622ad7a7452889dad3bd7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677605, "uuid": "050c38bf-e434-4590-8e44-d377b31be872", "comment": "Malware payload", "value": "39c25d1dd04a5503fd8c4a8203d9221fca387124", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677605, "uuid": "af80e9ed-c263-4b47-bbc5-f1bb60c251de", "comment": "Malware payload", "value": "c9133ed56a71a9dd22d7c29c3ca49a98de929a1d1504ef113036097bed856c3e39b70c6b077c8f485afcc71dcdaa3b47", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677605, "uuid": "934c06c3-03ed-4034-ad75-aed95c34694e", "value": "T158A38C297AFF005AF4E3FE416EFC14699D5BB9259A3EB41D10C00B4BCBE1940DE92726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677605, "uuid": "cb69e8ea-b8fe-446e-9b18-b43b1226a5ca", "value": "1536:vCDcC+zyv7oj5JqhzZexrPRO4E8I7B76oA5WxLMo:i+z3mzZo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677605, "uuid": "c689a292-56f1-420b-98f5-d8ecb85eacdb", "value": 106728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677605, "uuid": "3ebf3a01-a419-4763-a099-82559f1a056b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677605, "uuid": "02b0e3b7-43ff-4add-a0ee-d8ba4278ae18", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1accafc-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662976, "uuid": "2df9becf-b119-4061-b6a0-0c3012e11808", "comment": "Malware payload", "value": "344430cd6b7f67dd33626f8a60b8ca7c", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662976, "uuid": "04ce7a20-c05b-474c-84f8-fbcbfa41c408", "comment": "Malware payload", "value": "8259fcd79e0678978da3d86344b173371e2b08783b539a15e5b60fe476f710c9", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662976, "uuid": "2a91f197-ef32-478a-a777-034486c48d97", "comment": "Malware payload", "value": "0ba2cfd5f7baf98e30543b401bb4de983e35b261", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662976, "uuid": "b5745443-e3a2-4efe-a7ef-a1de4c3ef4bd", "comment": "Malware payload", "value": "a95e421a30464115b47a02dad6b1e5525955a286b9fbd6df73c0761015204a913109fa2d7a4001495c5f1372cd5f9299", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662976, "uuid": "467b25ac-a643-45ad-a960-90214b83b0f4", "value": "T1C1F078121A8A7E5D1D5BE1C4B63886A05FE34491F11E3632E658084E4E36E6805EEC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662976, "uuid": "b57ef43e-502a-465d-a2f1-7acf4d71d94f", "value": "12:HHBhzd+mPfGS53JQ9lnx8Y8o8fDWQsWS/nmSus0ao6FKvN:nBhzEmPfM9lnx81VfDiW8Vm64V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662976, "uuid": "ea11c153-043b-4a56-b0f3-c7ec31ced0c7", "value": 615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662976, "uuid": "b9f8b9ae-b7cf-4dfb-add2-3c70c4084b18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662976, "uuid": "12365aab-a175-429d-94ee-bfedc2cb6f6f", "value": "client32u.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ab99a9-8930-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700655116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655116, "uuid": "d6c91135-9598-4de0-b076-c270ffc12ddb", "comment": "Malware payload (NetSupport)", "value": "efb01d1406dc29e25956c8c858599838", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655116, "uuid": "1bba9870-c027-44dc-8089-e70b88f726f7", "comment": "Malware payload (NetSupport)", "value": "8483a9621f3576c54c9b5684f7b1aa501e1a112d268918c0f4c6afe0d9400060", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655116, "uuid": "c7df048d-b954-46de-8ddd-d136524c644b", "comment": "Malware payload (NetSupport)", "value": "49f560aa752083edd69501c952847bcb317805f5", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655116, "uuid": "f21e4b20-c767-4db9-b5c6-787964255fa6", "comment": "Malware payload (NetSupport)", "value": "59001c1f81532864a25f6f266026f72e802c5b4bd55c31b9f0edf2bf1d832ae8659027aa2ecac36dda9125b13f9f3f85", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655116, "uuid": "40d52690-0af5-41d0-b7f2-e49339ca5d6a", "value": "T121F533163293FBB6C0A1F67BE0ACA8154A6D747CE4F7B476597FA152E93A431982F000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655116, "uuid": "2ef4dd68-d3fb-493d-a6eb-f8df1863a833", "value": "98304:y1OFXamhRFY89YYc9jh23redpmQRiXuYESBZFR02jZWl7C:COHxYoY59V0redpmQRiNfZs7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700655116, "uuid": "eb06fcd6-0ed7-4564-9cd8-88315a05f562", "value": 3441713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700655116, "uuid": "7890230d-f495-4ab3-93d3-26df1dea2ea6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655116, "uuid": "8c65d0fd-a033-485b-b8ad-53054d69d2d3", "value": "ccc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c05b9f-8933-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700656678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656678, "uuid": "1d759e3d-3312-4256-a379-792ce290d35f", "comment": "Malware payload", "value": "5ff26a7e6df31916923579c6bdfb6e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656678, "uuid": "4d843df2-1fb7-4926-80e0-8745130a9067", "comment": "Malware payload", "value": "84d75e3b46650e5a2af66a54fc09ed077b263940a863916598bd797318b8b3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656678, "uuid": "9bac1432-0332-4170-838d-6fbfc9061a3c", "comment": "Malware payload", "value": "47dacc5a47278ed6c7283e363f034eae56b2ce25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656678, "uuid": "a1a8b109-ea1e-4cb2-ad49-692349f42beb", "comment": "Malware payload", "value": "7500f2abe7745a9aeeae09070930e9c1d3d5c696d0e97bf15925a6f5ced969f553990656294acc31700e93246af02545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656678, "uuid": "f8697b68-0ac8-4fe3-8029-6b0766faaebf", "value": "T1CDE40210B5B57BE2E77E57F5854054240BF27AAE136AF3181DC6B0CB35B8B098E90B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656678, "uuid": "8100afeb-5853-40e4-a1d9-00c00cd7751b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656678, "uuid": "3be20a2f-152a-4dc7-b79e-6e36586e7c36", "value": "12288:xq8oT1+LHle3o4QlxPKtzrVRC9aE2jmGQwmvT25XHS:TK5QlQtzrVRKaMGmvTyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656678, "uuid": "a9a55b0f-5df9-4a01-8ec7-3fc08921dea8", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656678, "uuid": "247c29b6-8387-4caa-9037-7986ce493fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656678, "uuid": "4531370e-6b45-45b5-a77d-3d491f01b681", "value": "SecuriteInfo.com.Trojan.PackedNET.2542.19955.12126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6b81d3-894a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700666212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666212, "uuid": "f9a1a160-621c-49e6-b044-5e8d2040bcb7", "comment": "Malware payload (Formbook)", "value": "6d23b888aca37f70416c0c1ab0869196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666212, "uuid": "8d0129fe-40da-4b89-95d6-3d61117c513f", "comment": "Malware payload (Formbook)", "value": "86ccb3501f458d9be3d7e62627d533cb83d2786c8325b1e03ed74bec21eedfd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666212, "uuid": "b0fdd555-4134-4100-8010-88361d0e4992", "comment": "Malware payload (Formbook)", "value": "6658313ad265296019316e40fb9472b6e9ca0b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666212, "uuid": "08dc0cc6-2262-4c7d-b4d0-1407d4390071", "comment": "Malware payload (Formbook)", "value": "697efd84a9da837cc9cf50d070d7704d56f2e9626d426754e938f730dcf39f8ca6982d27a3611f812567fe87a822d3cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666212, "uuid": "18d40e5f-c146-4366-aef3-41c87b6d57a2", "value": "T187A4DFCEE71198E5EC635275657EDE33462B9C6E6858288A25D77E373C31093303A88F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666212, "uuid": "fa4fc665-7a5f-4ea8-b9e5-084c4093691f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666212, "uuid": "49015d2b-7be2-418e-91bd-6c2ae7f0b0cf", "value": "12288:iRrcoeMLX4sUK3k5uvuamco1+eoFeZ0uvAttS7on:9gX8gk5Wmco1+egAo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700666212, "uuid": "1167d1e7-52e9-49ac-bc21-a2791efb40d0", "value": 458948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700666212, "uuid": "33c02b2e-13fd-406a-bd63-f52b5e097911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666212, "uuid": "283439c0-226d-46aa-8b91-e58909045a32", "value": "Swift MT103_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249b011c-88fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700632702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632702, "uuid": "c3fc8fb3-0df8-4439-bd24-978ae5025d7e", "comment": "Malware payload", "value": "a19ca4c84df9e57d2c8f5543c4db9d52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632702, "uuid": "7e817ed2-d32a-4562-beb1-ad26aa2e872c", "comment": "Malware payload", "value": "86f8e546815bd0b77b0fcc906b700caa5baed1568197378a20fa6b581a2ab709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632702, "uuid": "79dafa7e-9529-4740-82d6-bf836fe88703", "comment": "Malware payload", "value": "e3566ba1659d1a7f554dd85de286ac0bdf71ae4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632702, "uuid": "a88408ea-09b4-4a51-82df-9022d432255e", "comment": "Malware payload", "value": "88f2570c7b312dfed77628c666c6b9a2560ff2b948cd0bedcd523983139a1aad68d7d582757abf2f049080150a1db0ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632702, "uuid": "74280048-4091-44df-9b76-1f36836fd8c7", "value": "T156643B077656CE23C2C81336D0DF4200A7E3AA863727E70E7685179A5E473FE994E987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632702, "uuid": "b627631e-b2c2-4829-9630-0a185ce00e6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632702, "uuid": "791acf31-7482-4167-8025-1c60d4c8e244", "value": "6144:21pgEgRUcmvB2ePvoAVvHoKjBZZd036CS3Q:2EWxgAVvLBfds6CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700632702, "uuid": "cb776e3a-2bde-49a6-98b5-18dca051496d", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700632702, "uuid": "96f82fe6-7fc1-4ebb-8e44-bc5992085e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632702, "uuid": "9eaa62dd-dd64-427b-8c65-fda3d18713a7", "value": "a19ca4c84df9e57d2c8f5543c4db9d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543ab06e-898b-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700694200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694200, "uuid": "878092a5-954e-4f01-bcdb-3c7349a771bd", "comment": "Malware payload (IRATA)", "value": "6ff8385509f1f180a1b60b49fcc33406", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694200, "uuid": "965d42ad-4adc-4dc8-9e9b-c38fe87b38eb", "comment": "Malware payload (IRATA)", "value": "87122e2d4341a44298b65c15f36571b1a9aba0b89717acd5cd3f8368cde034ab", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694200, "uuid": "c53823ac-f25c-4c4e-83fe-24e515d8bb51", "comment": "Malware payload (IRATA)", "value": "f36e823da5e4377b5b36f18fc3eb535d2ff3200a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694200, "uuid": "ef8991f0-4494-4fac-9cd1-6de2c3518414", "comment": "Malware payload (IRATA)", "value": "f4027a3cad0496b3bfb9f851bebfab86abd0a71fa256644f8de528e14de44710899816e46b8705d20a54bb7194623fa3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694200, "uuid": "288778c4-844f-4da7-9ab0-d757eb8dfa8c", "value": "T15E851247F326A96BC8F1C37221B4263566774E24CB83F749395437BA68BBDD84B812D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694200, "uuid": "eefc54f4-0389-4f58-8ee5-7d45cd51a4d3", "value": "24576:qsgI8L6pkU0XYeNM17AN7ZeGjzUqO3H+IoxkUIFFlKwHy9VkH5PNzB:qsgkkU0XYEfN7ZeGjzUR3H1nFlKMBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694200, "uuid": "19e7e494-fc32-4913-85d0-6cc7b8405c6f", "value": 1772563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694200, "uuid": "d004c276-2afe-4909-bdac-ad336855b0a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694200, "uuid": "d4cc8620-c71c-461d-9561-99befd16797d", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39d061c-88fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700632969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632969, "uuid": "239c02e2-d7b3-43d8-bd5d-25be67085f5a", "comment": "Malware payload", "value": "775e66ba64844e3bd2b45677a90498cf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632969, "uuid": "171d9f87-4bf6-4546-b549-4fa4dec5e1ac", "comment": "Malware payload", "value": "893c11889ab845e5ab82ff106d2f6fe25de01fd7e80bfaa05909d86a3b54738e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632969, "uuid": "9ddd7722-bfc8-4047-85c5-c5346c879abb", "comment": "Malware payload", "value": "232fcf40f3b5f96beb2716c9cad2663387743f6e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700632969, "uuid": "ae28d1bc-4812-41ed-bb47-80e0f47fd697", "comment": "Malware payload", "value": "9e9473b6393aa186d82674332314ab5c827bdd3cc80c179b900d0a36a5be88ea6bce6271e9bc2f33319ac6b44ea8059e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632969, "uuid": "2f02a71e-03e3-466f-b863-99f6cc341496", "value": "T19FB57D87B687CBA2C17B67B7C5974A1C8770D9816313EB0B398A236908C3FBA5D45D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632969, "uuid": "94dbc4a2-88c8-4591-b73c-8aa66b830f82", "value": "49152:2FfU+sE331D94i90Vu5TkLmaDorxjHOzNxYWRByfdPU6:2v0ATkLmaDetwx/RByfG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700632969, "uuid": "6d66c79d-7fc0-41d6-a5f1-55931ea8c2a5", "value": 2432512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700632969, "uuid": "06a77aa9-baa1-42f2-903c-d664ef2ed381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700632969, "uuid": "8a1f7f3b-cafd-4c3c-809f-fbefa3ff86bc", "value": "775e66ba64844e3bd2b45677a90498cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b1bf1c-8932-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700656210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656210, "uuid": "a61a6915-8d57-41cd-8be0-67a0be612ad0", "comment": "Malware payload (RedLineStealer)", "value": "a13a1f2fe5ee62cfd08004277f557664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656210, "uuid": "2b21bf31-b62e-489a-a438-5f2963511adc", "comment": "Malware payload (RedLineStealer)", "value": "8982eecbc6365b0320c57d0d186f0b0569a6cb619da669f5a87ad3ad7b09e698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656210, "uuid": "89db9716-5fdd-4c07-a820-b2f100734fa4", "comment": "Malware payload (RedLineStealer)", "value": "af8581903c06152c9650deba3abe92260fa891e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656210, "uuid": "f6daf4b1-9839-4f8b-bf40-07e58d55fcfd", "comment": "Malware payload (RedLineStealer)", "value": "f8e7e9e25874c54f669e29f0a790e91ff64bf134aa071092a761274ceed436b03cb74b35d88f66c19b5533510b98f888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656210, "uuid": "6fb1ae6d-2f28-4ea7-8414-0b6eff9c3f25", "value": "T16DD4124963E820A7D4B6937484F102975A71BC669B785BFF12C9C97E0E236D0E832F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656210, "uuid": "81e7d851-a743-4961-ba8c-78d6fc4fde51", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656210, "uuid": "576dbbbf-be47-4044-9789-d8bf12cd744f", "value": "12288:yivy90H6buQKNrjeqrvbg7tvXyfl7W1FgQNPuZtPF:yky5buQcmuWvXgW16ePu/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656210, "uuid": "6ef85f51-7e3b-4840-876a-d2694ce95a16", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656210, "uuid": "f73e74b4-ca3e-4927-b03b-c010a4b5464a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656210, "uuid": "5e1e1602-b655-4e48-9855-416cca077e1c", "value": "a13a1f2fe5ee62cfd08004277f557664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91918429-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662949, "uuid": "c4cf8b27-5c75-4392-b252-38c880405f00", "comment": "Malware payload", "value": "4d3f13d2d23a65a024f12403a9e0c76a", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662949, "uuid": "5fa9de05-5d82-4c2d-99d0-ad6f2d9fbcdc", "comment": "Malware payload", "value": "89cd15c976844dac243f19046b13238832a833f460fc7582185387d60a0848ad", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662949, "uuid": "eb775b6c-7276-4ae3-8306-5762a44b43bc", "comment": "Malware payload", "value": "00b03ebdc89c4710b74c822d6a48688f7b112570", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662949, "uuid": "2cf135fc-053c-4ea3-858d-dcf6b9a2b642", "comment": "Malware payload", "value": "0b3d3efbfa464751876f4589221b00d5d58a7b9f4c6b539d14963ab99432cff5bf146f3c27507304251963e589833224", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "glaciecrw-cfd", "colour": "#CF593E", "exportable": true, "hide_tag": false }, { "name": "huggertlow-top", "colour": "#56B5CD", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662949, "uuid": "c84fd903-4685-468c-b551-c23a7bf91cb1", "value": "T1FBF04C020B8B7E5D2E5FE2C4B67842915FD75045F11E3932E558094F4F35A5905EEC54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662949, "uuid": "97ec06c8-4207-4e14-92af-eb517ee9267d", "value": "12:TOBhzd+mPfGS5p+1lnxTPfY8o8fDWQknmSus0Fo6FKvN:TOBhzEmPfqlnx71VfDmVb64V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662949, "uuid": "87f8ccf1-961b-4260-be3d-f71b0fe125cc", "value": 601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662949, "uuid": "2e84c09b-d117-4115-b46f-5de8b31e0a76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662949, "uuid": "b12b873f-1aa7-4ad8-adae-2185b218e77c", "value": "client32_3.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7120794-8933-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700656677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656677, "uuid": "d936faae-2e63-40ea-a0aa-b5a6d7e3b8a6", "comment": "Malware payload (AgentTesla)", "value": "8454998d7b14e4f982e5c768e9230fc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656677, "uuid": "f17a3041-12a5-47f9-84dc-81bfe749b9cc", "comment": "Malware payload (AgentTesla)", "value": "8a2668c26c25219a4ae1646a53a3704113cff49697347e119e110b28ace9c49a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656677, "uuid": "7b3b7704-41b1-47ca-a4b8-6ea20943a291", "comment": "Malware payload (AgentTesla)", "value": "5607b35df72163790930e15eb3d7ad40c9726d2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656677, "uuid": "3137d44a-c804-44c7-89e5-a3da5b43d66c", "comment": "Malware payload (AgentTesla)", "value": "bdead29fb42f690486bc69bda83edbc4a7a25e9d415882b99e1af1ef3a81210256460f8bdec8ecc3b511cda6d5f9fbdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656677, "uuid": "aefb33e0-1335-49d7-8c3c-dc034353a336", "value": "T18DE40214B0746B66E77D9BF449A111388BF5BBEE13AAE31C0CD6F0DA1464B0989D1B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656677, "uuid": "935e99b4-9776-4728-bef5-1f63ba0734bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656677, "uuid": "10e68bd2-9b3a-4901-9b31-87423778b186", "value": "12288:+q8oRsS+/1MEAwyixGKqlS3vDTzFYO5+DsSxvzGAF6RUKCURUU:mksS+/mExzYKGQThYOFSbF6TfUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656677, "uuid": "59a081d4-873e-4040-9c23-9cfc0222bc4d", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656677, "uuid": "97aba541-1006-4e2b-a89c-8afc5ca5ecf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656677, "uuid": "e8e8b50b-8742-45ae-84d3-a7ac05264c6c", "value": "SecuriteInfo.com.Trojan.PackedNET.2542.29667.19774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7d3e01-8937-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700658349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658349, "uuid": "c2d91d6b-fcc8-489a-a977-fd49ad632071", "comment": "Malware payload (AgentTesla)", "value": "1a5dbb0f666574d3281257a3c7d0c0f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658349, "uuid": "da44e54b-52df-4103-b90f-b0593393beed", "comment": "Malware payload (AgentTesla)", "value": "8bfbbc69796c9d2c80bf23589bad8d15630fe55c6c630debd4f3b19958ea0af0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658349, "uuid": "fc861421-8bda-4b6b-8ba2-60c920e92c79", "comment": "Malware payload (AgentTesla)", "value": "730e40b3996070c388d459f5e36f505a9b7cf67b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658349, "uuid": "12524a11-46de-4337-91e1-9b2339d75d2c", "comment": "Malware payload (AgentTesla)", "value": "6a513491f3645b3860e01e2e887a19dbcb1caa9ffc7d457787db5c7e060f266876afee0c9d5fb6ae2ba626a8a0ac2ab0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658349, "uuid": "3a825966-82bd-4621-9e19-057a65e95672", "value": "T1F4D4232C272E0B9D7F365A5132F1D9C17A5A51283F5F0D91873EEA23C0A96BC0275DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658349, "uuid": "9a46c153-960a-40d9-a5b7-a2d59d18b2ad", "value": "12288:/oB+V5BwTg/OpC63RMXvKV5BTY+ZmIykqvN9Kh9WyrzmEB7:g++Dpb3RMXvKxYyyn1IXPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700658349, "uuid": "56a3e5a4-c768-456a-b9ce-8e41e16afc2a", "value": 620587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700658349, "uuid": "ff37e234-723c-45b6-ab41-43eea66053fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658349, "uuid": "eaef9545-36f9-430b-9bce-b079a41399e1", "value": "SHIPPING DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d20250f-892b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700652849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652849, "uuid": "a4adbb14-60e6-41ee-89ea-920666e2974e", "comment": "Malware payload", "value": "55c518c611f0db3817822960fb83be24", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652849, "uuid": "30eb3183-e2ac-4a89-9be2-80a3135e046a", "comment": "Malware payload", "value": "8c18c0514255595dda708a1fe487076ed15eac9237f39f965baee9f2924003ba", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652849, "uuid": "e77d367a-1b81-449f-adce-1d85fd026667", "comment": "Malware payload", "value": "a1e7a4496f0db72cc4d67fceef9bed01deff9bf0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652849, "uuid": "7325b27d-ec0d-4d64-82a6-e20a0d8d7865", "comment": "Malware payload", "value": "62ca4cfae0538bd5090318deb95bfe9d2043d234dd32389c311325a53fb36d4fcc988af163b36a657b97e76c6730e16e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652849, "uuid": "6437d5f0-6aa1-46cf-8d13-d94226c61d57", "value": "T1FFE3566DC34B0169CF66537A972B5E0542BCB62EF34052B2306C437533EAC3D96266BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652849, "uuid": "a62c04d4-6778-4102-8c9c-a279451dd483", "value": "768:dwAbZSibMX9gRWjwNWgH5ufgZ1qXPH/53wYUbX6vv6ea++A30PN:dwAlR9DXZgHBzUz6vv6ea+cPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700652849, "uuid": "87409062-8bd4-44e1-a272-1140c04c2d3c", "value": 152386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700652849, "uuid": "a77a8c9b-974e-411d-a1a7-d0b90c2276b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652849, "uuid": "e1e7c46d-f2c1-46c5-84b0-6ff1c5966834", "value": "Project.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595e43bf-891e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647393, "uuid": "2fbe724b-f5d3-414c-9088-1da4bc20744c", "comment": "Malware payload (Mirai)", "value": "ae122323cede31a6e01793cadbd57196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647393, "uuid": "9732997d-360a-4f61-85cf-c69683b9d8c1", "comment": "Malware payload (Mirai)", "value": "8c3520021b78ea4f5a32f395d95b23180d6cd08ebba308ed207bf06be66f7589", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647393, "uuid": "574cb092-2999-4423-a9e4-0bf9392e93f9", "comment": "Malware payload (Mirai)", "value": "439c3ae94c3011878d45049fa2e82c52ded8b951", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647393, "uuid": "cbd39c26-57e2-4767-8c81-ad7bcf0ae4ea", "comment": "Malware payload (Mirai)", "value": "f8c772af1a1a0eaf61e90ac65234ed68fb72f91f0e71c7e6d48290359a6752431c4540fbbadbf5bb73d7b0c2c2aa78a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647393, "uuid": "7395750d-9761-493f-83b9-0fe2e1b64255", "value": "T111C2C020D9488DF4EFFD9A788E65CAC57B953F5D5AA1CFA0D0CADF1008223262F5C598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647393, "uuid": "8b876135-9c60-4803-9ebc-756b2e70d01b", "value": "768:4KnqLiChP7gehg2alcZjn3LW6vq8/CxH/L4uVcqgw09D:4KqL1hq2alUjy6y8/CxH/L4u+qgw09D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647393, "uuid": "830dd644-2146-4b13-bf94-5473680bb218", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647393, "uuid": "d9574c68-dfc3-4eef-9038-58c0bff07af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647393, "uuid": "85dda860-5fa9-4624-ae41-452d9ecaa8be", "value": "ae122323cede31a6e01793cadbd57196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f7128c-8964-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677581, "uuid": "6d0b2e03-530c-4138-bf66-1afbf24e3fcd", "comment": "Malware payload", "value": "50490c0c3eb2a59b4383b257428e6cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677581, "uuid": "4d4606a0-b2ac-47a6-9203-5970940b6a0f", "comment": "Malware payload", "value": "8df9f0956f3a6cf5c75a90370089a2c54d862b52ffa1cb09058ca86f8f0a05eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677581, "uuid": "d7ca76b7-7baa-4bba-8e49-668fe0e021f6", "comment": "Malware payload", "value": "688e1166da34a927a3bff9e3365701951f43b147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677581, "uuid": "96ad4639-025e-42a0-af91-6bb0f2e80ef9", "comment": "Malware payload", "value": "2df713de07f284df32aa50dd67833a9ae538ba6d49052786ba1f49e58d11489c830006e3af1bfb5478cf487de42fb62b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677581, "uuid": "7126ab1d-032a-4f6b-99da-af403c2a7916", "value": "T1057633B032FDC434D616223167543EDB72B3C95E6A1194B763AA1F7D36B36C28A3B580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677581, "uuid": "de34f736-2a2f-4cee-970c-f511ccae51c6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677581, "uuid": "14a773ba-7b7b-4c3f-9c2a-b6515fa473a8", "value": "196608:91OW+3P4zN1NqljEPxF0Sb7AjP1wmitThe0k:3OW+/4/c6n7AjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677581, "uuid": "5966979f-3711-467f-b4b3-cc22751da3b9", "value": 7517116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677581, "uuid": "c381a04b-8f7c-409c-afd3-9f318ffd3fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677581, "uuid": "b7da9d1f-a83a-49a7-b083-addd9caf52a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09f7d6b-898d-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700695241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695241, "uuid": "4adc4dab-01db-48cb-bcf8-f135ab0bd2c9", "comment": "Malware payload (RemcosRAT)", "value": "dec4ccba06b7143d469d26429c594628", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695241, "uuid": "6989ba02-6b21-47e5-8796-b2a20038dd0a", "comment": "Malware payload (RemcosRAT)", "value": "8f3abc8783e372932f05def9c6d3270b5d72982115551806a5dac2d8aacc2458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695241, "uuid": "ff5f8a88-32eb-420f-8889-9a69d23bb8b5", "comment": "Malware payload (RemcosRAT)", "value": "07f913848dca98bf567454c6ffd1c2740f3b3e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700695241, "uuid": "2090649b-99de-4082-a2a0-9e9908b24e81", "comment": "Malware payload (RemcosRAT)", "value": "00ce6dd84ce7ef3a436d4c8512f85e8662ddb159af773061b0702471567ff18e773c967ce7cc8f20a4dc3510d681908e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695241, "uuid": "ceb4f6c3-0167-4110-a732-68cfecc6ac13", "value": "T17F95E171A6A0C5B1DDB32AFF6C278694D83E3F602D5924362FE530895F7A7823836147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695241, "uuid": "cbe61fa5-934b-4e21-a624-e1e4a11f1c57", "value": "5ad58dd99cd3bbf2c166bc1ba7c8b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695241, "uuid": "15d24cd4-6258-432e-8cb0-a9337a4ccb0c", "value": "49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4rMyqChsyfue9T:aDqRMXpcOXX8Za31CuCc/MXC+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700695241, "uuid": "63a1a3cc-b51e-47a4-988a-1101682b4883", "value": 1874944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700695241, "uuid": "bbea3fea-6230-403c-8d6d-3ed6eec93679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700695241, "uuid": "2a2b2eb6-3662-4782-8720-68f88700e749", "value": "Invfile2123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bd6035-895c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700674207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674207, "uuid": "7db0817f-1e0d-4e05-a7c4-fc4c97c97910", "comment": "Malware payload", "value": "a177f5a4992ac9aab718f15c71f2b0e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674207, "uuid": "bfecb574-c1f5-48c8-928c-147cedaf09cb", "comment": "Malware payload", "value": "91f7d692760bbadb48882e8a8d8abe9e6890bd4d5b735fad22b3247693da834e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674207, "uuid": "80005be9-fbf1-4cd5-8a36-e20ba1c8518b", "comment": "Malware payload", "value": "a4309c6c02bb320784c5952bf900eb2cd43b6ecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700674207, "uuid": "27deae4c-6643-4531-aaa6-98a940599907", "comment": "Malware payload", "value": "8f8699767698c3ad945df1bf81a55123a7248b9b46c4b04c9c1c32f8687355fcdf2a8ae7c67393555e208c84f25b3cd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674207, "uuid": "0f985bfc-b62f-49a9-a4f2-379300e42ea1", "value": "T15BB2CF2BC5640ABEC7394136F3D62A44D20C780BA157180CBA72E79D4D7938FCC3A9AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674207, "uuid": "52979d40-3b2d-400a-bd1f-ac21e4a19a86", "value": "384:3CUD3NG6f59UORfqNy4Y0Fivd7ZMM4EUS9rDhCl0mppOv+288m9zR8G/k9:3CYomfsRYKiAMx9Xg0mpyq/vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700674207, "uuid": "337158dd-c65e-4559-bfdd-c1efe56274bb", "value": 23412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700674207, "uuid": "4e85eef2-71ba-45f7-bfb9-3a80808b6461", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700674207, "uuid": "798f880c-918c-4556-bce5-58d620262e53", "value": "a177f5a4992ac9aab718f15c71f2b0e4_m_Updated Order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0671d672-8980-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700689345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689345, "uuid": "9231e6c8-a507-41a7-8cd5-298a434f4ba0", "comment": "Malware payload", "value": "f881c78b7dcb81d1831969340eddf22f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689345, "uuid": "bd546a24-698c-4017-aefc-963809ad6e3d", "comment": "Malware payload", "value": "9489423bf3d0e00d89f8b3fb3d66aa600fd3cf180668e5b90ebaeb4a469ac452", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689345, "uuid": "85f025d7-957c-4351-8f2e-e3a3c9e703bc", "comment": "Malware payload", "value": "8d6b9b511687d73cb891f72599b125db3e8dfafa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700689345, "uuid": "511ebd11-5c39-4473-8669-bf7a277854de", "comment": "Malware payload", "value": "eb828f0a36e11832c5bbd7735eccaa02b5383337b66556930da442fe58c2399a83a0d575340858c47157e4baf7de2ff6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689345, "uuid": "afc5a531-6da0-412e-84f5-bbbb46793295", "value": "T11975AD03F14AC466FDFA243F80FD4E2A557CA62007FE1DDB928499EA9EB57C3853150A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689345, "uuid": "eb02dbb1-c920-4862-aa45-84941d6f5db4", "value": "c5dd96127293d12d999b1709337dbf74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689345, "uuid": "8827e941-2d09-4457-ac7a-4f48e79fe0e3", "value": "24576:6CxFRtZOq/eqvhtlLn6wWM14ikSpnd7ODoIxEM35hUbbWc:/TZOq/eqlJJNn+dxEQ5YWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700689345, "uuid": "52b8566b-71e2-4423-8e77-fae286ed9833", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700689345, "uuid": "56e9998a-b698-4a92-9599-2f8806eaa2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700689345, "uuid": "8488be14-ef0d-4aa1-9637-37c3111feba5", "value": "CleanUp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390407c4-8904-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700636172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636172, "uuid": "3a399e9f-7373-4e24-9caa-890500d6ea12", "comment": "Malware payload", "value": "bb53a81c1291f2e139610c9e0fa4219f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636172, "uuid": "87ad650e-e4f5-48c3-af68-a5c514761efa", "comment": "Malware payload", "value": "95f945aff4ea20953b277cb46b59e1299e478da6c0312d7a48a13cf74a649822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636172, "uuid": "b45060f6-c0f2-44fe-8717-387f18abd3c3", "comment": "Malware payload", "value": "2bc4d0af077f9fdafb1c8832ee5e7ebecd4a22e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636172, "uuid": "efc6201e-79a1-4371-8724-7545e23be964", "comment": "Malware payload", "value": "505c67ddbea9411da2a691da21bf21813c524485bdffd7d90a16e2a24eb7b1cf57f17bbefb06d7967f8885df239d36bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636172, "uuid": "518ad7ab-261f-4f3a-98f6-cd3fb17eff91", "value": "T1D4D47BF0317D8383E1A59EB10FCA86B079F175ACE8C4560DA0F59B2EA3D2351149D9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636172, "uuid": "d6c481e9-f9c0-4cd6-a999-9c61b6acc410", "value": "6144:Kx+OMdQdPp93DQY1QZO6Hn2Y4KFzVXJv0B5P8emM++pzp79l/rP74DHs3V+ZstO8:0zQJcq4cBQYM+Qz3lbUHStOsGkseRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636172, "uuid": "0694685d-7a8d-4743-90f6-733874fe32fd", "value": 599952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636172, "uuid": "16ac453a-0b59-4e6e-bfe7-afbcf374c960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636172, "uuid": "93820053-ffcb-4567-b94f-0182bd795dc8", "value": "RFQ_22-11-23_GERMANY ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6532805-896c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700681023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681023, "uuid": "70797cbf-ef8c-4ae9-8b67-15442d3face6", "comment": "Malware payload", "value": "fc73652b00f704d4fdcc0a6b8d02578e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681023, "uuid": "f676cedb-4ef7-4779-838a-d58075357b17", "comment": "Malware payload", "value": "96086099b9aee3bac5e4d7fae63563e5ddeb3d47365e0e7cbe1b9d09c3c8cd7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681023, "uuid": "77b841c5-02b1-4563-aab2-43eec50e43ed", "comment": "Malware payload", "value": "dbeb9f3ff30cf6a39f31bd4724c256bf00e5986b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681023, "uuid": "08fb6e75-12b6-4891-8d3f-902c96ef8715", "comment": "Malware payload", "value": "60404bd8ed787cfcd7776350f21e6a13786e31b5a8f4b69215f3e08b9882a8408a11117a6e551b712bf78a3dbc9a4aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681023, "uuid": "1c793eae-37b3-45f7-9741-5e11a8e5868c", "value": "T1954633890EC3168EE55F95B8069FDF7CF7B22F64D3F4990490B823AEDA671242537902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681023, "uuid": "aae694a6-b00b-4631-9e5c-f94bb11e88c0", "value": "edac19bae7a55f5a30336032d0b4ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681023, "uuid": "5732d8a2-712f-4a4b-8177-4fb01d410172", "value": "98304:6bal7NOv6XIGE5T8gNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJjhTPG/wZhzp1Kc:647gT5wgNvpbXZ778hsIvY6j1jT+whzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700681023, "uuid": "fcaf672b-b125-4e5f-b9e7-c897caf1e657", "value": 5527704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700681023, "uuid": "d5abe6ba-8818-4241-bc43-102ec4cc754b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681023, "uuid": "6c8ddb42-5669-4ece-bd81-650ab6fb9223", "value": "SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.5246.23098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45d9fc6-892a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700652807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652807, "uuid": "02c79bc3-9279-4e85-a458-5e7bcdb2014b", "comment": "Malware payload", "value": "c3af684a4b580eb75575ad073bc36cd8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652807, "uuid": "08ce41f9-ddf6-4ccd-8ae3-5356eea38a52", "comment": "Malware payload", "value": "9baaf64a33ad4f90b707d78d95b1eaf77458be5c50897876bb0534a20001afb9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652807, "uuid": "8912b1de-3bb5-4881-b3e6-767d3c57350a", "comment": "Malware payload", "value": "fea180463b723a4bf36ab9f830a9eaab860e2c3a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652807, "uuid": "7fc072ed-78fa-461e-a960-8087d3bae1ac", "comment": "Malware payload", "value": "c2ec6b84abf79b0c1f8cb4f0114b178aec3e14a3a074bd778cd2f142317287681177e6713deb25ea755cfc3ac768c75c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652807, "uuid": "d0a2bc84-d7da-4764-ae7f-381409bf9f1d", "value": "T1D6D3782DC34B01A9CF524376AB275E4502BDBB2EF34462B1306C937533EAD39A5252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652807, "uuid": "0d71c5b6-6b87-4ab3-81cd-fa1d66e6097c", "value": "768:NwAbZSibMX9gRWjjEjOU1Bib3GclLUQwZ:NwAlRYU1BBMLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700652807, "uuid": "ab789220-2daa-4cbb-8226-d2cf76768826", "value": 130247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700652807, "uuid": "e75b2a87-1d75-4a6c-bf63-40e782e74543", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652807, "uuid": "b681ab77-4238-41c9-b7fd-460943b75506", "value": "Prd Raw Material Requisition.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87550867-891d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647041, "uuid": "40c0a5bd-947a-43e7-9549-33aff6aae6a1", "comment": "Malware payload (Mirai)", "value": "ca162fcb50d52d5052fd4581e1ae9dfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647041, "uuid": "e7a3f3c7-e7db-46e7-8642-818c16b21e90", "comment": "Malware payload (Mirai)", "value": "9ee3bdba384e0958657e0352f64e3d88b1d4e01492a0c7b85a25e99895b16fc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647041, "uuid": "e1be0928-8274-4594-ad17-0f3fd50ec503", "comment": "Malware payload (Mirai)", "value": "a407dccb95bc27f2b81083aff3771701b1a9d079", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647041, "uuid": "d77a6113-9efe-4101-9337-eb91eb4a914e", "comment": "Malware payload (Mirai)", "value": "1476f465c43a393070ce5752b0766cbdaa15ea8cb404569d230dfdda1bc4fbdc1cc940391dd759f7e723447d54f31acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647041, "uuid": "49c1feba-860a-494d-9fce-6c5e0fddd9e2", "value": "T1C2C2D06026273A30D3B9DA38D971804737C78AF2B5F562643D181E91F652952B3BC2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647041, "uuid": "7bdaaa64-5223-492e-8f5b-491267f6ae07", "value": "384:sXNSIfjdxuZ1DUofVOyPqM3lveVNDtrJFz9NlArg34lDMOwcstWvk4uhymdGUopl:ojKX934v5rDz9kaqM1csvRs3Uozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647041, "uuid": "a38a04bc-df66-4719-a1e9-17fa7c636c49", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647041, "uuid": "dcb08257-7692-4b35-b405-5be863a210d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647041, "uuid": "b22cc4c3-7769-4e45-972c-79f65d155f63", "value": "ca162fcb50d52d5052fd4581e1ae9dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2887a967-8941-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662344, "uuid": "fdcfc3fa-bdc6-48f0-81f4-6ff1c2956dfe", "comment": "Malware payload", "value": "6a6ee1e16a05699a932d388005a820be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662344, "uuid": "2237286c-191f-461e-bd06-7f5fed7731f8", "comment": "Malware payload", "value": "a1909ad50f89c221cc9709af3802fdf53a46be8d65f644d5e3968171e8666d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662344, "uuid": "f7dda547-4f6b-4006-b1e8-04a16025d236", "comment": "Malware payload", "value": "0c093f0c955450a1cc65ec14729529d0a5222b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662344, "uuid": "4209afd2-5d00-40b2-9da6-40f2b92fbc70", "comment": "Malware payload", "value": "34a3ecd1b427365eb3dbeb477acaa0e1d8ef77278d159b8e5ce78e74d96976d952136f04068262b544fb537685451528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662344, "uuid": "06d8e81d-3112-4d84-8906-4e512b9c2698", "value": "T16095E1F1ABA0C571DC732EBB2C278654C92E3F542D5928352BF6318D5E7AB817836243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662344, "uuid": "3ed8489a-c5b0-4088-9c37-2f8f9cbf5d01", "value": "5ad58dd99cd3bbf2c166bc1ba7c8b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662344, "uuid": "b89123db-ee4d-4e81-aae6-be2a4f973c50", "value": "49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4oMyqChsyfue9T:aDqRMXpcOXX8Za31CuCcMMXC+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662344, "uuid": "90704c87-2b52-4cd6-aa86-04686aa9fd22", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662344, "uuid": "d1202b6d-0c66-459f-8c69-acbd38b95ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662344, "uuid": "c2f7d83a-1ac9-4e57-92b3-d5a716a68ad5", "value": "z13000928388283838938293_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbde576-8942-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700662886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662886, "uuid": "dd7b758c-e7c2-4081-83fe-7018099209a5", "comment": "Malware payload (SnakeKeylogger)", "value": "d8b05157b3b2358b828ddf6a8c6ffb48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662886, "uuid": "242628f3-0f61-469e-a353-927e5dfee67a", "comment": "Malware payload (SnakeKeylogger)", "value": "a2a6c37a9c06dd99e8b897fa89981cdfc0517469fdc49d6f4be416669c4e6fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662886, "uuid": "7ebe1f76-57de-4f5a-b3c9-14853ac01ccd", "comment": "Malware payload (SnakeKeylogger)", "value": "719820b9e180b0424aed7c99539ddc1a6c06eedf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662886, "uuid": "0a8863a2-b7e0-496d-b160-615246a69200", "comment": "Malware payload (SnakeKeylogger)", "value": "1bbd1e2b17bb7c62290f730d402704004f3646297a7f2b2669c74bcfdcc880b629207a6079938dda2922e5ea55f41d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662886, "uuid": "83991770-6bb0-4b6d-bcfd-34f8fdf7d1d6", "value": "T1A9C40210B1B67B67E37D53F5495291280FF27AAF136AD3185CC6B0C66278B098A91F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662886, "uuid": "e5b56782-95ed-4c5a-b60d-3763adc2f9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662886, "uuid": "200ff2a1-b51d-4bed-874a-12722c1d9618", "value": "12288:/q8oUlQ9c6U0bR6zcVFnAr96sVrPn7zkt+rGEbma9B1S:FQfhRFGAslnPxXma9B1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662886, "uuid": "f4afa9c4-0ed4-49c3-8fe3-956cd543f841", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662886, "uuid": "9ebe2291-532f-43a1-aab5-9ae16234ef4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662886, "uuid": "ae354a35-731e-4e6d-a3ec-ee5cd9c93c21", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90975889-891d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647056, "uuid": "d0ca46ed-6850-4a49-8855-0f15f2c85543", "comment": "Malware payload (Mirai)", "value": "7ddb27110cc3a3fc4b68f8b99a226f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647056, "uuid": "6ff9bed8-14cc-4972-99f7-68ab8cd21869", "comment": "Malware payload (Mirai)", "value": "a3a01f0b7a44741fd6bc5c5d660d8fd61895821dc105eed580a8045fe1d934ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647056, "uuid": "991e8d34-9538-4a80-8e96-e013c6669acb", "comment": "Malware payload (Mirai)", "value": "1416da98ba7600f8b70c8e59909103db40d2efb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647056, "uuid": "65de8f49-3147-4b7b-aa1b-116c79ac4cfe", "comment": "Malware payload (Mirai)", "value": "83a183205e97013ed9d8d1f1245850fa5c1592a971391c96601d997e868795a47af2434cc747a8182e6cf1ed5e5eadfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647056, "uuid": "846bcc6e-9e74-4a96-818f-50fefd4d93f6", "value": "T1A2B2E1AD12C1E8B1CD70B53CE635C142E36A463DC0FD7772128796681A4A989787D3CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647056, "uuid": "72f8f953-0834-4d6d-85a9-1926191e0b00", "value": "384:oeoBE5aNSS75BOI+ypZ5vTlYIwcvsdwU2LdUfy1oH7M9pGBl2VOSs8zihymdGUoh:oaaNSq5sOHpTqncvsdwTR+XWEBItzisb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647056, "uuid": "a44f8671-efbb-496a-9e37-18bbbc8a16d4", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647056, "uuid": "b22e5c90-cb69-4830-9dd1-c72f0f0ff43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647056, "uuid": "b5b9cfc9-6b58-4237-8d9b-dcd38049881f", "value": "7ddb27110cc3a3fc4b68f8b99a226f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ae47ee-8920-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700648194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648194, "uuid": "be670f3e-c2be-492f-be0e-bedd321257fa", "comment": "Malware payload", "value": "20b3fe1ede37430710bfbb3cd01531b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648194, "uuid": "5bd94f18-8b43-48ba-8a74-bd8bd9a472e8", "comment": "Malware payload", "value": "a55225791ab8425cb297d664e171afe1f716561c4799bd2bb7854d074a580813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648194, "uuid": "ccd1b2d7-416b-41cf-bfcd-a0f26e77c0b0", "comment": "Malware payload", "value": "283431a3df3ad5065025d106d07808877c6d5aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648194, "uuid": "76d2b192-8f30-40f8-bea0-7878842296f5", "comment": "Malware payload", "value": "ff0f61386dae93e197dc9d1c57f4e9b33588f1f2a14145e1956a5cefeeaa071bc28fb9263926525d94e0fca2988374a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648194, "uuid": "de494e4d-be0f-4e17-8228-4c293da4836a", "value": "T11D559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648194, "uuid": "3d4f0528-6ebd-4ff6-89c9-55b7b1f1b2bb", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648194, "uuid": "e8d3a820-177d-4ec1-973b-bb31827d8912", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700648194, "uuid": "f6765e95-2c40-440e-bc5d-767354df9b03", "value": 1322070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700648194, "uuid": "8444a519-95e4-4751-ac53-b24f0f9a7f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648194, "uuid": "6afcdeac-efa9-443a-993c-1914815fed17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d876aa8-8958-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700672365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672365, "uuid": "c57e8d10-4687-4cd2-813f-4233949d786a", "comment": "Malware payload", "value": "09d03d221ca030708a898924c2bd0322", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672365, "uuid": "f88b7e04-f049-4a85-b039-420cd4a8ead5", "comment": "Malware payload", "value": "a8407bd083e065222443737a0197f070b8ba1d30a7ef25e99ae3e0ef4af351b3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672365, "uuid": "519b0c9b-8add-44fd-8fe6-fc0503c20689", "comment": "Malware payload", "value": "ce30f1acabb4d366622ce13c82ab216bc4073487", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672365, "uuid": "69745997-119b-420e-9088-801cfe4b0478", "comment": "Malware payload", "value": "cbfd771aaec475d75ed741e8c8dbbcaf014bc2c56dd373bd93919a96449618f4d002733341f31ba02636ebe8bd7a7065", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672365, "uuid": "79f5eb3c-5ce9-4c33-ba33-3764606a50cd", "value": "T19ED4339AA6DF7D9B832A39791A4439C53B81799FC08A04C75586EF4FC32FC2E5B03425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672365, "uuid": "9eead635-b93f-49f3-8b96-da41099eabb4", "value": "12288:kRbD9kgSn+5qgiDSrEWctKEpAWnRRJEYaKMgbxGZ7LwGtUsy5q0GDGO:kxigSn7gLWnjJELKPUhmsy5qfDGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700672365, "uuid": "76929122-f031-402f-9a9a-fb97e1a5f64f", "value": 604327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700672365, "uuid": "f929d310-f462-4256-892e-58a9a680b635", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672365, "uuid": "5bf7cf2f-aca6-49bc-8824-c64b80f3868e", "value": "Order_6255762726127.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943bf086-898b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700694307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694307, "uuid": "a1d3b43a-95d5-4e8f-88cb-46e03fda5643", "comment": "Malware payload (LummaStealer)", "value": "b091b9200d42f0bbf277e312e518748c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694307, "uuid": "80a2f494-0267-4f58-86e5-d6036ff16722", "comment": "Malware payload (LummaStealer)", "value": "a97f117dbfa645d655bc742959bf7522c3a98078bbbf9f5576986e885a41ff52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694307, "uuid": "afce763e-2ac6-41c9-8c06-7fbb527953e3", "comment": "Malware payload (LummaStealer)", "value": "0af451d78f4bdd99d795475bfff54320a51465df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694307, "uuid": "2135701a-d8ea-4c68-905b-93a861d4d136", "comment": "Malware payload (LummaStealer)", "value": "ba0955c179a24bd016b578464f20c3cbf554406578a0006b159311264da0a5509d093e5fe2dc2b4b98c80dab3a1743dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694307, "uuid": "a37dccc4-100f-407c-80ed-bfcb1a277860", "value": "T18806CF007B32EC3DE18E1631E1E2D02853F7F8E2AB91FB4B72D5521A5E917DD4C6291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694307, "uuid": "eaca25cc-0918-4ecc-b1ae-d1409732ffdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694307, "uuid": "cc1a671e-530e-4b11-98c3-53f6bf98dc2b", "value": "49152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYw:8AqA4bNMAeLVdWRC9bO2IyOnhJYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694307, "uuid": "1359e938-a0dc-447c-a4d3-db1d8aa94511", "value": 3846316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694307, "uuid": "6ad7450d-cd03-40e4-9012-4c68eb1fdd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694307, "uuid": "0539f917-5418-4cfb-8b84-7f111dd80ed7", "value": "b091b9200d42f0bbf277e312e518748c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f888ee45-8933-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700656680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656680, "uuid": "b87ed98e-b418-43ad-8d39-e03a0bc09227", "comment": "Malware payload", "value": "7bd35275a2b5cedcbbf4813da284ceb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656680, "uuid": "d7d5b686-c5c1-44fb-a343-f1fbfec32d0f", "comment": "Malware payload", "value": "abec20fbb427ace85e7ba8b8bc265fd00b8e2499b0667ba621ed1e8a98cc7c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656680, "uuid": "100cd10d-3967-4e84-96e5-f29cb3aceed4", "comment": "Malware payload", "value": "084dba259bec993fc2779145be604e301ced2c81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656680, "uuid": "5e001722-0853-4567-927c-9f754ac57a44", "comment": "Malware payload", "value": "2d511d0e6c75dab2da9cf3d840341f9d348c1bb4e50859aeecf929afb6953d5b764530df3e7bfa340b75037cf2d81f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656680, "uuid": "047590f7-3b90-475e-be9f-6112f020cf5f", "value": "T17995F172AA60C1B1DC771ABF5C374284D92E7F653E5838362BF531885E7A781383624B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656680, "uuid": "4eebac53-f0ed-43b9-b595-607bf6674f7a", "value": "5ad58dd99cd3bbf2c166bc1ba7c8b1b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656680, "uuid": "8a03c5cb-065a-4a81-9ce6-ba6430a17b1b", "value": "49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW44MyqChsyfue9T:aDqRMXpcOXX8Za31CuCckMXC+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656680, "uuid": "0095626f-157f-4d55-976e-ca11b5e62763", "value": 1874944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656680, "uuid": "fc2d2e77-abce-402b-a0ca-d2757dddd6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656680, "uuid": "e2bb3e2b-702f-4e22-95d7-ae96d5a3c962", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3937.5321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95511453-891d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647064, "uuid": "e5c78472-c900-4aa4-8a1e-3c9b042ed96b", "comment": "Malware payload (Mirai)", "value": "9e08a8769ba619fe1ea66327151fad6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647064, "uuid": "8561e900-9c51-457f-9211-009cd7ce38a5", "comment": "Malware payload (Mirai)", "value": "afbb53550b987ac5aa7174bea097aef31ce34abb1c50ce068db12c9e5bca27d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647064, "uuid": "71e9d852-25cb-428d-b32a-762690cf9f70", "comment": "Malware payload (Mirai)", "value": "4602e1fe9242aa6839a20f87e81682014f1bcb69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647064, "uuid": "f5424d0d-162d-4bcd-9cfa-dcc8c51791b6", "comment": "Malware payload (Mirai)", "value": "e5794acb482d7e946df1c8be138f9d9db3f63badb1ff4cc49c2546c513717262040b594cacda75c22b725a5c3d8a57a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647064, "uuid": "2efc0122-41a9-4267-b974-94103a9730dd", "value": "T1B2538D75D11DAEA8C0414A74A9198E704F13E4C046733EFBEA9487A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647064, "uuid": "10154563-528e-4a56-9a7c-ef9071f3b559", "value": "1536:ragXV1f1Fl/wtkLyPQauiufs3Ii7O/qyD6EZeCc:r57f1b/wQHf+Iiy6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647064, "uuid": "89ea145a-f2f7-41af-92da-3ba4a1967237", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647064, "uuid": "47d11d07-2db4-445f-9c3a-250d96a006e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647064, "uuid": "3a9a0a0f-8dd1-42b1-baae-8f0411d433ba", "value": "9e08a8769ba619fe1ea66327151fad6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662e1dfc-891e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647415, "uuid": "2c994937-84a3-46f6-896b-2336404c0b4a", "comment": "Malware payload (Mirai)", "value": "7a3a125f49f7100a6c62a01facf9b64d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647415, "uuid": "79bb1600-a6df-4e44-8d54-e16aeb138e01", "comment": "Malware payload (Mirai)", "value": "b1093623340139586a755f8fda24a418d6c06eb58c6194474a557f1825417cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647415, "uuid": "51951a5a-4c3b-48c8-a254-ed8679eb7ce4", "comment": "Malware payload (Mirai)", "value": "b1bc30b655687b44f0ec5953ade26cc04ac6ee47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647415, "uuid": "85933923-505f-400a-ab90-e6f542cb35d6", "comment": "Malware payload (Mirai)", "value": "10d33b4a5d84bfd1524f26828a53455fd1b6845400d0c015eba2958eaa6a37e76fc7ba1eb1d937a3c57a8486a5112b5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647415, "uuid": "eb3a145f-dfd3-4d72-9cd2-390e65850d9c", "value": "T173D2D06EE47442C9FD8E5C3E808C3FA10E19E581231BDB9567228C4D5B32C5BF16A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647415, "uuid": "b00fa271-daba-40e9-b65c-a5132fb467b9", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjhbbRWGVCz0NvW:8MYHb62x4ahQ3CfdwLj2pWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647415, "uuid": "9d9db85f-1a49-4d19-8d03-f59c45bb5cfe", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647415, "uuid": "d2fe6295-aa2d-4db0-9f59-2d739318ad53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647415, "uuid": "e78f8b26-eefd-4b7d-87f3-4c4fb16dec22", "value": "7a3a125f49f7100a6c62a01facf9b64d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89448278-88d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700614832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700614832, "uuid": "17aa3f57-9784-40b1-ab1d-46afb1deda5f", "comment": "Malware payload", "value": "ad4ce469a77b4fcb50a18a834b882357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700614832, "uuid": "545ef652-d26a-461d-a5f5-068c26094e26", "comment": "Malware payload", "value": "b3ea7e21985341e15287a93480d1e910bda459a8b8e1b55806cb70526d0d4638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700614832, "uuid": "f2d29bbb-1f03-412a-9750-ac93d4318d14", "comment": "Malware payload", "value": "187d854af0040eea1a5e405fe472621847253152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700614832, "uuid": "29c9eef3-0d43-4e08-b78c-48429d990da5", "comment": "Malware payload", "value": "080b9bee698e85b2ac48ecad30871c931b93e34052423c687713b83c82b2537e50eec1367d2712ac6d52635bb1f9d599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700614832, "uuid": "c03526e5-9ef2-4ccb-88c5-889e510a14c1", "value": "T1C8559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700614832, "uuid": "0a7a606b-c07c-4d81-a6cc-6dc97333883a", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700614832, "uuid": "43d583ed-92cf-47c1-992f-c21acd8a09df", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700614832, "uuid": "71e3f5d9-8005-48b6-81f2-2285d1032c30", "value": 1321987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700614832, "uuid": "cd85dc4a-db0f-4183-a786-d116fbfc30ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700614832, "uuid": "90675694-b86c-4e65-873c-2496cc334a21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767e9b63-890f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700641000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641000, "uuid": "37f59f10-8883-42f0-978f-cffa196290db", "comment": "Malware payload (Formbook)", "value": "002c5d2f53c99b7028209144bb5c0b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641000, "uuid": "19379b45-7512-4ce0-b093-5c6292639d5c", "comment": "Malware payload (Formbook)", "value": "b53da778b0496c07c9ce9532c3a127f8e9cf08fc5d4b7d81a5bff05823deb28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641000, "uuid": "d1ff5bf0-52a9-4682-bb9f-28fc81f02141", "comment": "Malware payload (Formbook)", "value": "ba3d2a41967c6d317cb8d24e0ab22d6bedc0dbf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641000, "uuid": "7acab8ae-b248-4164-8df0-f546201e2f0d", "comment": "Malware payload (Formbook)", "value": "0915e4f4cd5c5338298ebef14ce25a85891620f038a530b78bb2080e942d94660d5310a663dafe0133d5587b9a63985f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641000, "uuid": "41468c55-20d4-4302-9b1f-406dbbf603a2", "value": "T12DC412262394A74AEA7C1BF0D064569547F6263F69A1E79E0EC220DF1677F048B40FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641000, "uuid": "e137f22c-8bd8-4a60-948e-2745f3f114b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641000, "uuid": "edcc1584-df53-418c-8176-a55a67e9f3c0", "value": "12288:d8oUHnHwSkVS17ffisZZIjQdSOLm17bn+46h5BC4nS:elnHtkVU7PI0S2sTMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700641000, "uuid": "56bca4ae-2bd8-4675-b8d6-471ea0012f37", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700641000, "uuid": "09472460-6dfd-4133-ba2e-f53c7bc6f1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641000, "uuid": "c2c402e7-703c-4312-9aab-eb91edb8dc41", "value": "SecuriteInfo.com.Win32.PWSX-gen.29465.30884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3e72f8-894a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700666162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666162, "uuid": "ffb70aa9-11f1-4494-a9e6-f94332f10d0d", "comment": "Malware payload", "value": "227b7454939f2006ffea948170468fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666162, "uuid": "62e0976e-31e6-44d1-b0b7-f76db9b85e39", "comment": "Malware payload", "value": "b5d2b4871ea753fd802de56f46053954ecda1421af57528cdfc43d5b08a6d6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666162, "uuid": "5c430835-dc9b-47be-a944-35824f55bcd7", "comment": "Malware payload", "value": "9eeabc26d36069a308c160a84a2381b73e1cab1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666162, "uuid": "9acdbc95-1a64-483e-85e6-d33cbdfe865b", "comment": "Malware payload", "value": "689e6942118c3756974abee45131d21f477681b5775278d560e57954fcb7d44b88c17eda5c368954ec1974157e5522b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666162, "uuid": "90de7780-63ad-4903-b564-4332d9610959", "value": "T192D42312726D9FE3FA3807F248A1215E97B2722E5465FA8B5DC161DF49A0F800621F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666162, "uuid": "35514865-6820-4ba2-a3d5-9c450b002981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666162, "uuid": "d3fe07d4-ebbc-4992-8e77-7b4cf8d9f1c4", "value": "12288:Q8ok2j49dbA+CPpbQ3PJ++I+BAYylLRm64/QXHnEhTbT3E:PkjgbA+CBovoptgQ01H3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700666162, "uuid": "b38d4885-34c2-4133-b81e-6dfc6764f15f", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700666162, "uuid": "2e8141b9-3023-42b8-927e-a0d68f366172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666162, "uuid": "05e217ed-a654-4bb1-9a2b-6cbcd5b237cb", "value": "SecuriteInfo.com.Trojan.Inject4.59820.16624.18058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a537ff13-896c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700681021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681021, "uuid": "f3f21944-2535-46f4-b923-328933a73f17", "comment": "Malware payload", "value": "f9723929e9e1a73cc59dd90803244a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681021, "uuid": "c10b4728-30c7-43c3-ad63-6fa5f074479e", "comment": "Malware payload", "value": "b725a7ad686300e4768008fb77fe5cfd789c0bbaac14750cbcc3833ed53e7f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681021, "uuid": "fb3d49bb-8657-4930-be37-5498567fc3bc", "comment": "Malware payload", "value": "3aeaa5d6385eefdf7c8dcc2ddd744816bc83f738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700681021, "uuid": "1f0af82d-bb68-4c23-ac3a-7dcfa66f0644", "comment": "Malware payload", "value": "69d03a59dacc7eaec32782e56245527ae4bc3060278040ad44d43b142242f615e2c6ed655820cb96fd65c651e6748dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681021, "uuid": "4611814a-b3d8-485d-bf56-065aee902a42", "value": "T1453623071AC2904CDB48963825FAED1E76706A6316D04E559CAC2B9FF837F61CF361A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681021, "uuid": "b2a11bf6-3874-4599-8fc5-e93fe702cf54", "value": "2bdb246985c8a250c24a31e25f47c271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681021, "uuid": "9e5428a7-3d86-40c7-97b7-46b08e6f564d", "value": "98304:aBxe+pg11V36yHobIlo5dPYXbeVzjm50cTjFdebNCVx91kjZugRK7o:Oxe+pg14yH0xvArepm5/Tjr0NCVxLkt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700681021, "uuid": "d9841d9a-b621-486b-ac06-d11a2858f78e", "value": 5277192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700681021, "uuid": "9fef2d36-1fb9-4adf-9ee8-b41f2737c75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700681021, "uuid": "6d495541-b71c-4c7a-8673-3a4237628b18", "value": "SecuriteInfo.com.Trojan.Heur.@73@J8d10Sej.13943.19436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c57f082-892b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700652874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652874, "uuid": "9ff9292a-1a05-4c7a-b40b-ec0296e7d591", "comment": "Malware payload (AgentTesla)", "value": "43a6fbc81795d3764adfe6ae93b1b6b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652874, "uuid": "3acc89b6-bb2d-4262-ac6a-6b51979e7d8c", "comment": "Malware payload (AgentTesla)", "value": "b7c7c849a3caf9999aa15fbf355cf825c00709240fabcd390810847e1f06e719", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652874, "uuid": "8917181d-6593-4ae0-b04e-6c0de6403ffa", "comment": "Malware payload (AgentTesla)", "value": "3cca6cb011c7c6b4eab3941951248961b328f54b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652874, "uuid": "d3a670f9-0954-4e1c-a9ca-5cbe96ec0b63", "comment": "Malware payload (AgentTesla)", "value": "3d5a92c138fd1229d1e603ca0429b4b606bbf816eac0a2558b50885f04c9855595d6616eb707e29b42c95e1b9da4024f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652874, "uuid": "87218357-533c-499b-a420-18fe9e0584fc", "value": "T16474134DAA6D5F42CABE56BFE0E6A7014775D1FAC30ADB8274DC01257802BC28A12F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652874, "uuid": "d4b3825a-ae0b-4d2c-9b11-73c532820cf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652874, "uuid": "6fcca01b-67f1-4dc3-b08f-adba907e875b", "value": "6144:9T6jlGhWpyk0gZzUq26uY1MPp08dOmbe5WwcotKYCNnleMVBl93QlDFc:NIlGUpykm6HqBTdOmbewBkCzPl93QFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700652874, "uuid": "e993045d-d7d8-4544-be94-fd45f1b1075b", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700652874, "uuid": "7e98e982-d2d3-4d4a-996e-bebd560f1519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652874, "uuid": "df1a7c52-60a3-4142-afd1-c6eb9c4093bc", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236bec63-8941-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662335, "uuid": "404a80a9-b929-4f69-8447-f8afa5e16598", "comment": "Malware payload", "value": "7d9dc45ef99adca8912d83655c2c2a04", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662335, "uuid": "9105e214-6101-4dd6-8097-ce3c56d6e97c", "comment": "Malware payload", "value": "b94cd5c8ef0b8882293066928039009dc9c9ccdba2927fca3199ad3b39274292", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662335, "uuid": "bb3a055b-039b-40a9-b6e4-33ba60405cdf", "comment": "Malware payload", "value": "93cff648cc95dc6dfe9aa788ccb0e0d3ec354074", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662335, "uuid": "a14361a1-eec1-4765-9094-3afe69500991", "comment": "Malware payload", "value": "73c2f65aaa2eae65e23ade690d525b306f3a416ffb71fff9683227042f579f6a25c6f5d9feac8addbcd5c2ad61520b78", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662335, "uuid": "6ed903ca-d626-44ac-b242-490fa683069d", "value": "T1E2827C66A80EA1BC1E4B6E62F31DDABCC581CCB35B7617C2AA74834964B7D806C074D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662335, "uuid": "35509e10-bed7-4e0d-87bb-ebb5821cf33d", "value": "384:gF4UOWSQG4OSuAokFjnXTMI5c4prcO05Y:qvE0uArDNc4iOIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662335, "uuid": "a26c99b6-c20e-40b0-a34d-31800dee2237", "value": 18807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662335, "uuid": "da596308-7d0e-4d80-a03b-32e498d6e291", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662335, "uuid": "5daa7ec3-8313-4fd6-b3b4-c8d7026a4374", "value": "radhfisfhxtr.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f96f53a-8920-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700648128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648128, "uuid": "02e84c21-5e8b-4864-b5cb-b4fab4b6c055", "comment": "Malware payload (AgentTesla)", "value": "522917f45118d43ff5d0dc2495296c06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648128, "uuid": "ba629bb9-a482-4bc3-bf33-5f534d8dea6b", "comment": "Malware payload (AgentTesla)", "value": "ba86afe0e1d9370b6368a075fb3ca6ef61221ca45badee72c8a8c9421310985b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648128, "uuid": "3320bd3a-0437-4796-9b67-73ac66b97e19", "comment": "Malware payload (AgentTesla)", "value": "eaf81df02ee9d0e301e2036a5671fa04ab3ed0c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648128, "uuid": "6c1835a3-a0b8-4542-b3cd-249f9fafa89e", "comment": "Malware payload (AgentTesla)", "value": "58c47dc1c24c5b0f33bf4620cd4b080a7b32884e87a6cabce6b9b3d2a730ffc465bebb06170fe107c7346ece556f9b52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648128, "uuid": "0c212ad7-8ccd-4eb4-ad73-ac1a02be3c39", "value": "T1E6D42331B7A8D7A2DA7BD3F19020159183FAB62B39F5E289DDC430DA58567C90242F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648128, "uuid": "4d71a9a2-f467-4c06-a5fa-372930712e75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648128, "uuid": "cd674b19-f5cd-493a-951e-1d5c35ad5dd2", "value": "12288:G8o8YsNNvk43wfhWXjJ/E0gkAQ7PbIXiS14Zsy+PML9:xGwCMRJ/E0gkAQLbIL1bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700648128, "uuid": "cf221ad4-06ea-4ca4-a368-92630d1961e6", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700648128, "uuid": "81e34060-1f2a-44f0-b0b5-e4dad40575ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648128, "uuid": "73cadd99-652d-45b8-b5c2-2d6752bb0a8a", "value": "SecuriteInfo.com.Trojan.Inject4.59820.19040.27798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f0bfdc-8986-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700692082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692082, "uuid": "01615212-ba44-4ef5-a2f3-d7018414e39b", "comment": "Malware payload", "value": "f9f7bb52b613651f29852fb0295dfd53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692082, "uuid": "9aa56af8-dc58-46a9-9e4a-f46c98389a9b", "comment": "Malware payload", "value": "ba95615266b53f8585757d49d85d7756c2166118b99071b55eef611be9fda5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692082, "uuid": "036f0747-0bfb-451e-bdea-8db9af9ffa45", "comment": "Malware payload", "value": "9b79c532072d44c84eeb438b3563c04cb38201a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692082, "uuid": "eef7ead4-75d4-419d-aff5-b18b301ffcbd", "comment": "Malware payload", "value": "5164892c2df34b54522c8b6edf0690cb390abebda32c60d1ef4fdb2d92d75898eb5799da3ed12fbc18b77592e92a0006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692082, "uuid": "b5638294-0823-44bf-84bd-5ef538372b97", "value": "T11C0301D12361178C8366DBB93DBE7019843C111B32E51E042ED3A54EE64B7249877EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692082, "uuid": "d78cad69-9e87-4b73-a0c8-c9e8800dba2a", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23Mm:87vbq1lGAXSEYQjbChaAU2yU23Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700692082, "uuid": "c090cbbc-da5d-4737-a0c4-b85225419c30", "value": 38728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700692082, "uuid": "86f9f84f-e1ed-4ceb-9981-449b83da5748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692082, "uuid": "e4288459-4148-4ad8-854c-c2fc407be8ce", "value": "SecuriteInfo.com.Linux.Mirai.4338.3921.15730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19885c03-8966-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700678210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678210, "uuid": "fb07b8db-b81b-4281-b3b5-63d22eb1215f", "comment": "Malware payload", "value": "b8516f15dc4bbc3bc6ecaea73db3ce6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678210, "uuid": "e06cae8b-fdb7-42aa-81ac-9c9bfe59eae9", "comment": "Malware payload", "value": "ba9b6e4e3c24b040f6a0cb4b6e6e37e0f0529c75bcc357f6abaca8561a67434f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678210, "uuid": "39bfb5c3-0117-401e-902b-710728ac36be", "comment": "Malware payload", "value": "6ac066c55d7b0b827b615ce5f7bb3123873f9a0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678210, "uuid": "f9a31e10-f682-4b20-bfec-20d4f36de4c5", "comment": "Malware payload", "value": "bfe6ddd248dfa7d11aed549a798ff2cc7702d213f99e1c981e89d1d833ab59e3c79ab0ec53efafd6a8811fd536a28715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678210, "uuid": "2852daae-9ddb-4e12-ae19-5c394fe24142", "value": "T125E3DF218B488BD4F03EA73548A5502EBBBAB4C53602C759B3C5F1864A67F476D70B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678210, "uuid": "e1759fbe-0a41-43e3-aa4a-a34d2e0727e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678210, "uuid": "932303ce-da95-4437-8fa2-47076ece58df", "value": "3072:Dg3z1gmoYu6MhCcXOp5JRH8j/MxyIT+SSw:DgD1gmXu6oCSOpp+kL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700678210, "uuid": "c12c0078-9ac8-4ed4-a4bd-77c9cdfa0e72", "value": 153464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700678210, "uuid": "bf0713be-970e-4145-89f6-4d3a323cb0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678210, "uuid": "948ce6e2-8a46-455f-bbec-862812cc7653", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9586d3-8907-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700637383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637383, "uuid": "b0d7c5bb-5694-496b-a38b-379210d6bbad", "comment": "Malware payload (Formbook)", "value": "c1f49ab7f8c4cb4a997faebd51d2a604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637383, "uuid": "bf3362c4-d232-4d47-873a-51d2d397d072", "comment": "Malware payload (Formbook)", "value": "baa2e4bc9527c3b121f69e7d581344f27b3b8cfbb867857e5d2c8e7b6e6d03af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637383, "uuid": "347a304b-6adb-4c38-b078-b1bbd781daa6", "comment": "Malware payload (Formbook)", "value": "5b7f4db4a7b68cdd800ec278552c6b3db8f2dd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637383, "uuid": "83e5cd74-0372-4798-bd68-eb428280b83c", "comment": "Malware payload (Formbook)", "value": "f3a5f33cc85b9f106e6adc05eff8f9118bf8dee6e70a7f8748ca03b798384a360cbf5ab4101852729edadcabce5acad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637383, "uuid": "bfdd34ce-3eac-4ebc-bf29-520ce83475cf", "value": "T176C4230119E4B363C1AD93B24D9904A547A6F52F6D90F75E4AC9E1BD9C32F20CC293BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637383, "uuid": "f33c49e4-920c-4ec7-a258-bef5ed24d01a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637383, "uuid": "a1f87410-4cab-4283-9cf0-a99aa5ff0c94", "value": "12288:by8oOJi05VRbJadqOCljbsofE4SuDhodDYGWrvmS5uD1we2n7q:bFpJJVbJi2jrfFScqD8mSXDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700637383, "uuid": "8a535294-234b-4dcc-a893-3af2aaf5e808", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700637383, "uuid": "fbadd85d-e951-4c97-86f2-9c0ed1b7dc76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637383, "uuid": "288d631a-d5f8-4e56-b140-af532ff0d5fa", "value": "SecuriteInfo.com.Win32.PWSX-gen.14716.17790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accf21cc-88e7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700623911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700623911, "uuid": "48d22860-f350-4c9c-81f5-5e0cd4717198", "comment": "Malware payload", "value": "d182c5cc932fdf30690e58b1c7e297de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700623911, "uuid": "bdf73b58-d627-4004-ab2d-0a950456a85c", "comment": "Malware payload", "value": "bb150377b93d4df2a877a68e700490644290a0ea59001c189e55bbf62bad1e68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700623911, "uuid": "88262f7d-b198-404f-8134-14cbc09336df", "comment": "Malware payload", "value": "249540ccad900d3cc6c5b2ccc9447d5ca895879d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700623911, "uuid": "eba71103-fbeb-4313-8346-6743c08961c8", "comment": "Malware payload", "value": "288e4e77db9fe443fe8732f7a2c3a90a78bfd11eecadac700bbd9c4fa596bb94cc3377c35dca7f9be013fb2275096668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700623911, "uuid": "fa94e740-ed73-4c93-9229-49a954117b90", "value": "T1FD05BF6523D71A6DF1FF1B3799F166126774F8E5E62EC30E14830A9C0C26BA649C0B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700623911, "uuid": "16aeba77-ca7e-4252-b653-69e86f9803f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700623911, "uuid": "a67deee9-f40f-4281-b644-8113de946c8b", "value": "12288:6bgEa19Hi8mgRp0rAj67YdHZhvWvMS8jTRaFxnn4wGTl:zPmy0rm1XvWvt8jTw/0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700623911, "uuid": "a75c2d8b-f506-4b43-8a24-7b1e9cb05a78", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700623911, "uuid": "e7cab6d5-ec95-43ae-b14e-6d5d428c8168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700623911, "uuid": "c6e7810a-d043-4915-9052-6c406448a98d", "value": "d182c5cc932fdf30690e58b1c7e297de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b81a0c1-88f6-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700630271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630271, "uuid": "03a28d89-4e68-4bf7-ad41-0e3f8525eca1", "comment": "Malware payload (Formbook)", "value": "d94b223af3fd6bedbc1552ffc63b85cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630271, "uuid": "030a0f60-8ed3-4b1a-a48d-7d89e54f204a", "comment": "Malware payload (Formbook)", "value": "bca02faf8b705cffad72deb87ef895ce6626636d498e05b274b079c9ace3dc5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630271, "uuid": "bf800d8c-a189-459e-bc99-ad92803ad6b8", "comment": "Malware payload (Formbook)", "value": "d7524fd3525faa6af6d4c329167c322062fb77b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700630271, "uuid": "d10625e1-3d35-424f-90dd-ea6c5b034c7e", "comment": "Malware payload (Formbook)", "value": "46da2b7625077e3be229ae0401295c8672f8d72bc132f0135af9ab6cb19ab39bc63968764e5df559ff6dc88f2b818c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630271, "uuid": "c306a672-4b72-45e2-b6e8-6c1d56418625", "value": "T181841291B5F59D7BC006A5B1A877DB505279EE3B1010D387131CFE67A9B22C70A8B32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630271, "uuid": "25ad8681-546b-4087-9254-4715b3c8498d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630271, "uuid": "3717b9a2-5bd7-4c3b-ad55-22d7a8f72a79", "value": "12288:RKt9zvWPOpk/oxQD9inI3PnmLws4475zzgBQvamwvq:oLzpxQD9iIPn38zzwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700630271, "uuid": "6cc37c70-69ee-44f7-a607-f2f4b6dd3b1d", "value": 393528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700630271, "uuid": "701b1419-3690-4b59-b74a-de94721c96ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700630271, "uuid": "eb628fe6-7b7c-4683-ad9a-d60ff4474eb8", "value": "NEW INQ vGT410267234500633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cd5d8a-8986-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700692085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692085, "uuid": "8e83f954-c0a0-4782-b36f-45aaf803c0e6", "comment": "Malware payload", "value": "bc03a49b998eba1a4da82cd3785376e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692085, "uuid": "3ed98e91-e922-492f-8776-4a84dbdb2613", "comment": "Malware payload", "value": "bccddbc2947cf297abd7f6d7d8414130b127aae72fb141f3090a4948878d2cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692085, "uuid": "bc700f33-349b-45a3-aad7-5bfe45a3f447", "comment": "Malware payload", "value": "bc6d1c226c5e46b84a9255510ea6492934cecdc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700692085, "uuid": "cb3ee8ab-234d-410b-a179-510e4ac1a7d3", "comment": "Malware payload", "value": "89f6cc489502557995b672379d9bad9c7c9a7b6e3ce9e998da657e70315a5cfe19def823da1bd30bfb36f1687cf89e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692085, "uuid": "3a808f6b-a172-4a7f-87db-b21e7c24eabf", "value": "T1BDD6126679378453CAE2085B5B0863F3B27B7771F30B29B624656488BBA23F07154F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692085, "uuid": "8a279c34-cbd4-4cfc-9429-40e85d0254e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692085, "uuid": "eb3bf799-ff08-4386-9cf6-350f951c7da3", "value": "393216:Csssss8ssssssssssssssssasssssss5ssssssssVsssssssss2sssssssss0ssM:Csssss8ssssssssssssssssasssssssN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700692085, "uuid": "d6b06f85-63c6-4a72-8c7d-655b2d231780", "value": 12878336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700692085, "uuid": "861ebfd4-2aff-4d41-84d6-5f926246df17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700692085, "uuid": "4e151eb1-dd20-4fa5-a539-cdeee12dfb49", "value": "SecuriteInfo.com.Trojan.MulDropNET.43.27711.8559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d8ad09-8965-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677905, "uuid": "64a10646-02fa-4b1c-aa58-5960e5a698e2", "comment": "Malware payload", "value": "5cadcbcab133a20cc0a3777afd59102a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677905, "uuid": "8c27b67c-77dd-4ab8-b71d-ad17c67bd6a7", "comment": "Malware payload", "value": "bd3c9be0544276fffc4b23029f7073661e859bbb41047292c4c0555ede12b1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677905, "uuid": "cdcdc262-1233-4cdf-ae14-56f6372fbc85", "comment": "Malware payload", "value": "187df6ebb5c87cfc132936d1c5f7c443c9968c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677905, "uuid": "46791252-acf0-4012-b474-219d7fff21df", "comment": "Malware payload", "value": "7636758f9fdd748fc5cb7435046e49aa0b7a28d422b1c79f5fa391ad8ecf1fa0b1e820d984e6113408493bcc96fb6552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677905, "uuid": "9d5df1ae-4a85-4d62-9286-f22a8ef93c32", "value": "T1F9446B1365D0FC21C4660770CE6ED6EC7B6EB8E39E19874737142E2A6AF12B1E663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677905, "uuid": "d3a50214-0624-4633-9310-cfea793d0c4e", "value": "c368fa427f1f3f59d6f5623ae63cdace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677905, "uuid": "deebdd31-7494-4246-8fa3-75e4b870c85d", "value": "3072:3E+9+PkkHsAlt5k9U6YIzaeGE83gTZVq8cFfr3ZyPH35t6eZep+72:U1swM9U5QPcfjgvDZeMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677905, "uuid": "f3b32bd2-0e91-4a49-b0a6-d7a6bb7ef3c2", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677905, "uuid": "bc21e895-ff8e-49ef-a0bc-2e178c64cf02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677905, "uuid": "607d6ece-3dd9-4de1-a4ca-622c540b66d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39a34f1-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638632, "uuid": "6a665fe2-7ed0-4058-8f54-c1c0e18a001d", "comment": "Malware payload (Mirai)", "value": "636c577c9d2fcda75dc1cccc0db35d8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638632, "uuid": "23cdda62-f2f1-4ced-b4e6-4a2e20082171", "comment": "Malware payload (Mirai)", "value": "bde225242ec84dd31dc44aee390b31d83890ddc3566ac4e5301e3e1d2a9f5a7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638632, "uuid": "aad424ce-dad7-4ef2-abf2-9e0a6f75e733", "comment": "Malware payload (Mirai)", "value": "7aa01a54870ad05dc0e34e4200eb4af0044e48b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638632, "uuid": "d51bd429-903e-47d1-af30-638e03694f29", "comment": "Malware payload (Mirai)", "value": "67eb54753daf9e5b6f403a3886c3717c7b3b37c63f8413f0bd3f9bf41645e8d45ff4bbe7017c22795356e76d34b8823c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638632, "uuid": "b5894994-128f-46d0-8776-736c183b3d3e", "value": "T1B4734B0271280B47E5930AB42D2F1BE05BFEEDD035E4B688695FDB664A35E375086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638632, "uuid": "544d3f30-70b5-4f8c-af74-b8daf40b3ecb", "value": "768:n5DtKwQ/uUHRAlfu4cC1iJUqv2LHH9Jnc1aGQyiWX7INHoOTrIC5RmnZ5UI7Et5b:uHOPcC1iJUM+Hnc1b7QPmvUIK5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638632, "uuid": "8b8382dd-1aab-45c1-bab0-538f356d63a2", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638632, "uuid": "81e6f022-3ae7-452a-bc81-4dc412296a0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638632, "uuid": "f90b09ae-6d5f-405e-a241-6007fa996440", "value": "636c577c9d2fcda75dc1cccc0db35d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cf1a58-893f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700661618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661618, "uuid": "15c6bc2d-8efc-4241-8b2f-1871c6aad633", "comment": "Malware payload (AgentTesla)", "value": "8f1451919fb5f5da4ae9fb9e8422dfcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661618, "uuid": "6d954092-e10c-4a55-83b3-37cd50ddb5d5", "comment": "Malware payload (AgentTesla)", "value": "bfcf7363ce0cf820c23913eacab873e1f9bc51b14611e2cac22f7a78529b18ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661618, "uuid": "5354b4f7-543c-4768-bf62-af2d5bdcc486", "comment": "Malware payload (AgentTesla)", "value": "1d7f3ae4c3a73a801fd1f74387248f5c63d9582c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661618, "uuid": "d8505c46-c255-4695-b8b3-2b17f395e044", "comment": "Malware payload (AgentTesla)", "value": "1f2d14de2816fcdee8196a310cc54d12987713a95726f442b67a66102f60a4f911b8a6eab542e858e4c0248268ee7c92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661618, "uuid": "49a9633d-02b0-496d-a0ae-9bb7aaf212b0", "value": "T1153363D7DE0442B1EC290BB061734D37193FBEBEDCB0A64D655CB0B51BB30A2042652B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661618, "uuid": "15d95a93-462b-4508-91ab-3aabaf9f7a32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661618, "uuid": "12eacb76-ea98-451d-94d7-54cd31eef867", "value": "384:lebUqIH2VIGJfZf0iTbZ0yITJOHOfHgNN0G+37Zvj66QnzVcTaOidKjWPe9qbvW:w/p0IETJOHOfHgNNU766QYaOiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700661618, "uuid": "0981a19b-f747-4a89-aa7b-949489c6010a", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700661618, "uuid": "f077aa7e-5612-4ec4-8484-b2b42a844ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661618, "uuid": "1132ae22-c06c-4e34-9a60-607919e51d42", "value": "orden de compra 211123_Arvilab srl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874d85f9-8940-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662073, "uuid": "ea80559f-db88-48da-af24-db567a57bdfe", "comment": "Malware payload", "value": "2cde57f770588a27e6e2e6c6b001b3cc", "object_relation": "md5", "Tag": [ { "name": "5-181-156-60", "colour": "#21D5E3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662073, "uuid": "6dc4056e-aac3-43bf-bc93-bf527e93b11d", "comment": "Malware payload", "value": "c002d14ff77d06dc6c3fcbd38be8cf055b7bc3d073cfb945ae9a97c47ca486bb", "object_relation": "sha256", "Tag": [ { "name": "5-181-156-60", "colour": "#21D5E3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662073, "uuid": "302ab4a6-62c1-4b15-8b4f-bf37fd6df8a5", "comment": "Malware payload", "value": "57a8d7ec895573a5fff806615ab86a78b6313bab", "object_relation": "sha1", "Tag": [ { "name": "5-181-156-60", "colour": "#21D5E3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662073, "uuid": "c48e3e4a-cf38-4a5b-ac64-3fe03ed22e4b", "comment": "Malware payload", "value": "d0b8004ff46229dedebf2bbf7d6ab06b8bfa1b034d7ac2b9e26d875dcc51a684bc12c5fe4f9ab10b3df850ae73d30976", "object_relation": "sha3-384", "Tag": [ { "name": "5-181-156-60", "colour": "#21D5E3", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662073, "uuid": "8b06e950-1084-4995-8b05-9d02e5bf9fef", "value": "T19C0199456B4EBC7F5547F2E2BAB882802BC35041F4493530A7808C0F6EB6DB584CEAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662073, "uuid": "aa7dcf5c-3867-4ff0-b2cd-2543b69926e8", "value": "12:tSxS2hz7YU+Sj8ZGShR8kkivlnxOZ7+DP981E7GXXfDWQCYnmSuUrRqDAhRqWpR5:sI2hzEPI8ZNR8pivlnxOoG1fXXfD/dQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662073, "uuid": "1188577a-9e9b-401f-8a17-acdee8630283", "value": 699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662073, "uuid": "073c3cf3-f2c9-4665-b0e4-96a990323213", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662073, "uuid": "cab91c3e-fdc0-4708-a146-80d90bcdab06", "value": "client32_2.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85acae5b-898a-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700693853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693853, "uuid": "c7dc7c89-9d02-4aad-b822-feaa53bd7428", "comment": "Malware payload (IRATA)", "value": "ba11b7d9ed4df2a23358ea5c82b1307a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693853, "uuid": "c82e8a9a-45d0-4990-b3c3-a7739302db62", "comment": "Malware payload (IRATA)", "value": "c08d0cdf50b9b6819354622c5f4d6f02e84eb921213c677e067e8005e5b5d3f3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693853, "uuid": "f32cc927-0c03-463d-b6f4-b4a048a2267b", "comment": "Malware payload (IRATA)", "value": "88bfd15dde3deb745c7de4d33738197c26476030", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693853, "uuid": "46f4eecb-5e11-45d4-aa66-7c420895339a", "comment": "Malware payload (IRATA)", "value": "407e6fc0f3487584a8edb77387b1da3695984dd7a02a860e7f79eb250997dd241c0570182c182fc42ddb4fb12fca53a9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693853, "uuid": "763d43f1-a0c0-46f3-9932-b8ddde7838b4", "value": "T1B41648EEDB117D2EC9640E3140BB01F62E090744464EEA3D19B89FA93CA7DE87741DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693853, "uuid": "e102e737-54de-4f6b-bded-16c4e0508be2", "value": "98304:mrqd8BI/qBo2zE+i/Zf3fDr/dXYkkzAfNCFFQ9:m28BIr2zE+sd3fH/do4C/Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700693853, "uuid": "e51b9932-a917-4bbc-9e51-2f425f98c9f4", "value": 4245590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700693853, "uuid": "e81c3d43-2d55-42fc-a99e-89a913b15f9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693853, "uuid": "0d297547-032c-4f9c-9998-54ce2318440d", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8366f8-88d5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700616317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700616317, "uuid": "7e657a0f-2888-41da-8276-41abceaf3898", "comment": "Malware payload", "value": "8c0504d9438ef62d57300201152e5f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700616317, "uuid": "6e54c631-c98d-45df-a1bb-53945d66b83a", "comment": "Malware payload", "value": "c1ab6704756c653111385c7fe15582d4d729d56ef05b5d02499674e597c469dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700616317, "uuid": "42b4d9c8-2a2a-4a5e-8ed2-43eb5c7230d3", "comment": "Malware payload", "value": "a2d456b6b5b0a2b5683f0755b3950fb723efb912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700616317, "uuid": "df015045-03bb-4979-9740-e74164c9c02e", "comment": "Malware payload", "value": "90fa1ef619da66526f56145ebddf617006441b31232911bd51bb2982ceac521965413ad8a9c729c4a8c670aa69f131ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700616317, "uuid": "e7024983-d2e5-4b67-b147-a7baa6ba7f73", "value": "T155559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700616317, "uuid": "615d698c-b61c-4cda-98bc-e572ec0dfe54", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700616317, "uuid": "11741e7f-700d-42a3-9a06-b8ba85a0cfff", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700616317, "uuid": "2e7e5f3b-9a07-403d-942b-6d255437de14", "value": 1321990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700616317, "uuid": "8ac25007-284d-432e-a4f2-b86b199e4b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700616317, "uuid": "61d317d3-f2cd-4a12-a22f-066a59c4cf8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a6400c-8906-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700637180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637180, "uuid": "6073bde0-f63a-48c7-ac3a-0eae4164463f", "comment": "Malware payload", "value": "ee45685665db65b24866dbc1e2271ec0", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637180, "uuid": "96fda83a-94ce-4e6c-a274-9e3f34261c4d", "comment": "Malware payload", "value": "c1e9cda9e7d3619c869b91ca584bcb29181ac7498e8931d502b6cea8654fbfd4", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637180, "uuid": "19e18882-725d-4411-b7bf-b04295982f71", "comment": "Malware payload", "value": "bb5830a415aa55b68e66bb8c9ecb58f7fb65ba92", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637180, "uuid": "ade90901-ffcd-42ea-843f-d7603cb200b2", "comment": "Malware payload", "value": "a43ce2ed748c7f5e9405c28e437ed371938788363a2a108128275a9044cf9e87bb469dfc0eccfbb07f1423e7e5959ea1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637180, "uuid": "a9d327b0-65d2-40bb-81d8-7652f679ee24", "value": "T10C457CF0317D8383E1A59DB10FCA86B079F175ACA8C4560DB0F99B2EA3D2351149D9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637180, "uuid": "4cbc5af4-befc-4c5a-a641-be9758532188", "value": "6144:bx+OMdQdPp93DQY1QZO6Hn2Y4KFzVXJv0B5P8emM++pzp79l/rP74DHs3V+ZstO8:hzQJcq4cBQYM+Qz3lbUHStOsGkseRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700637180, "uuid": "17a78707-6e29-4225-89c8-d0a6fc9b51e4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700637180, "uuid": "b2c76c9a-1743-4b76-b411-212dd65fa1df", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637180, "uuid": "20eaf391-9440-468f-aad6-94d2addc44d9", "value": "RFQ_22-11-23_GERMANY ORDER.xlxs(80KB).img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a565136-88ee-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700626806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626806, "uuid": "39cedf49-0443-4087-97eb-43e790b109d1", "comment": "Malware payload (LummaStealer)", "value": "702b4f0937ae70efe576e2d158b3d867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626806, "uuid": "d49148e3-32d4-414f-9b20-e2cc97320add", "comment": "Malware payload (LummaStealer)", "value": "c1fd59cca3ea32217d09fe9d73e362398d05ad3a6f83ac0d96798f3902f8837b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626806, "uuid": "ee9f45fb-b8d6-422e-b8d9-30a4faa6be7a", "comment": "Malware payload (LummaStealer)", "value": "558b83382544ee518aadb6fad37de332f536cbe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626806, "uuid": "acb22c27-d1d4-4704-9cef-ae0be2fa0d55", "comment": "Malware payload (LummaStealer)", "value": "0e9ee28b0f0d0170045b27bea495ad55c8a13577f64e673680c1b4e6164ad8ba3c4e05776171296f5971cd28233802a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626806, "uuid": "aeb51f5b-05aa-40ea-bd2b-3ceac07dd07e", "value": "T12256F1596AA841A4C4B6C238C5FA8193F7723C449FB5EBEF1961711E2E37AD04E38731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626806, "uuid": "502ccfb5-af43-4904-a105-2a1bfbafad51", "value": "2d4bd1d42dc2e2cb7b6088231df7f2c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626806, "uuid": "4c19b91a-aeff-43ab-b26b-bd30f0731d1d", "value": "98304:KVLGjfABjp08CsRflEaSf9AT4NG8+Ewz/x/1rexe3P6/W:KVLGfsRflEa8A8NG8+EkKeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700626806, "uuid": "3d302a63-d9ce-4faf-8bc4-b18e89c57fb6", "value": 6117232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700626806, "uuid": "f6891812-2fb4-4dfe-9bd3-ac203b8a7231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626806, "uuid": "4fa8e8db-f4cd-47c6-aa34-b2b7b1ac1832", "value": "C1FD59CCA3EA32217D09FE9D73E362398D05AD3A6F83A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93b98de-8906-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700637353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637353, "uuid": "b2d5f71c-3f2a-4e8a-b812-1e556682197d", "comment": "Malware payload (Formbook)", "value": "f9fd38f9ee9d4cdb870343b9c06495ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637353, "uuid": "1b29bac4-4138-4b3f-9fc3-2f4180146aec", "comment": "Malware payload (Formbook)", "value": "c5444c85b810f99e008f31b9ea1b1a128df74044cacf326c27fe1937f5b45fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637353, "uuid": "3ae2385d-8f9b-4503-897e-987a4cd1893b", "comment": "Malware payload (Formbook)", "value": "c1516308209905c154e08045694681c1717d736c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700637353, "uuid": "3dcf71fd-f552-4251-bbd6-3855a3d44180", "comment": "Malware payload (Formbook)", "value": "2d20e58e126680c73c2303221fa657774168d80b6320aca3b8b5e9af5873b64ee7859f94223ee49e14e22c668ccbe6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637353, "uuid": "929be0c5-3989-4582-b355-531dcbd26cda", "value": "T181D423133D59ABA3E63B8BF58064018847F7A93F56E5E59A8EC231EB54D9B044A30F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637353, "uuid": "d8705c0a-7164-412a-bcbb-d29b9d44497b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637353, "uuid": "7fb53c8d-17cf-4895-87dc-c5582c91ade5", "value": "12288:h8oyB6vv3UxVPe5SWz1czGoIqUyceHMDwNg+tOakFUnBTS4GUd8ORRK:aXqvmVPelcqNh1DwWs1dBerUOORR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700637353, "uuid": "4ee68059-99f6-4acc-8dc5-f7cae76dfcac", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700637353, "uuid": "3dd26f7a-66a0-4559-8c3a-68308d689676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700637353, "uuid": "85830974-72fd-4cc3-993b-a9810d003ebd", "value": "HSBC Payment Adice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989ebbab-8902-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700635473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635473, "uuid": "357f7dbe-0fda-4622-a971-876f9decf7d0", "comment": "Malware payload", "value": "7b67bb6478038b503b5cbb12dc562274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635473, "uuid": "3fb473fe-80c8-4dac-b5e3-094b21a47f67", "comment": "Malware payload", "value": "c6177b1127e8691dfea8db44d783eb734f0abd86f093ee97c641f337d59481fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635473, "uuid": "1ef5dbb0-6733-4c24-8c38-e2a1452034d9", "comment": "Malware payload", "value": "caece00e5849c0db8c1cdb72d20fdf789f6d824f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700635473, "uuid": "65c5691a-7da1-45bc-96c9-2d01e1e07834", "comment": "Malware payload", "value": "e728e57b1146603129533cbeb514859abdfbc2282fc57759191f443e327cdaf34e7b9a319ea5c488530f88ce09b9ad3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635473, "uuid": "6b0bafcb-30b3-4bb4-a46d-d4a03d298277", "value": "T157559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635473, "uuid": "682ec190-67de-44dc-92d2-44d642fb836c", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635473, "uuid": "6c84d65a-81c5-4601-8893-ba0642bfa40e", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700635473, "uuid": "d4ec9e59-8282-4d99-b007-6e4d7b60fd78", "value": 1322038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700635473, "uuid": "3de84f3a-0ea1-4200-bcfc-7e4892774514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700635473, "uuid": "537c30f8-c8e2-413d-91d3-45b59aae7caf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e5733c-88ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700613076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700613076, "uuid": "9ba0a2aa-41d4-448a-90de-e9c8543331e3", "comment": "Malware payload", "value": "acab4ab5098132c2d31cb690112f748f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700613076, "uuid": "900296fa-7e0c-424e-ae24-3b7a85bded63", "comment": "Malware payload", "value": "c91dd4cad60c852d9a4eac95b00a9d1c8ca08dda868471744f49822672bec0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700613076, "uuid": "99ff4c63-cdbb-4d46-917a-6fd84e089fce", "comment": "Malware payload", "value": "bcabd7120d980280d7e4367950fea81fadd95d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700613076, "uuid": "79e85049-f229-4fe5-994c-4962da6f9d0a", "comment": "Malware payload", "value": "6d0c0bc9a0b8cd3848d28f3042576d3e7b97b1e665f1e270187a955db06dd55c5978f4c46c82946090977a8dadbdc683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700613076, "uuid": "b0f2b55b-a37e-494d-9708-dd51d72f5512", "value": "T17D559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700613076, "uuid": "dbb9d086-d98e-47c3-877f-8c35a19eca63", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700613076, "uuid": "443b979a-82a1-4cb2-8b23-b540ff6d5225", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700613076, "uuid": "93e2ed42-1fc3-4f42-90b0-c87ef89e5f96", "value": 1322752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700613076, "uuid": "45639e04-c189-4366-81c3-ed953c1f0135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700613076, "uuid": "c2ef349a-ca13-4fa8-ab9f-60a15417fa24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5164e062-898a-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700693765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693765, "uuid": "9a9ccbc5-0f70-4fc8-b41e-58dfb566dabf", "comment": "Malware payload (IRATA)", "value": "28a9fb7993181a0f59befaa669054301", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693765, "uuid": "81e1eb56-680d-4f01-925d-a2e6406c12cb", "comment": "Malware payload (IRATA)", "value": "c99b939853d2113c4c5bef3a57bbe461bce322209273fc4de794a6ff3ffd7042", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693765, "uuid": "bada115e-5d3a-47c8-91a7-6db40ccf8942", "comment": "Malware payload (IRATA)", "value": "82f7f0ade19ef8153d07c11c38350cf7aa315716", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700693765, "uuid": "aad846c7-ce60-4c10-aa55-c9be301e7791", "comment": "Malware payload (IRATA)", "value": "822a5076ec91cd04bff10a1de3b519b650f071c11a0517595416638b8146be59798b95a1638e937a8b042b860e3d9cde", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693765, "uuid": "5221de42-27b6-40c6-b676-c1fc74f38911", "value": "T18436D0C7F7D4A85BC4F35372817653A6514B4C268B83DBC36904367C28BBAC42F5AAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693765, "uuid": "daab5c9f-b3f9-4f79-b012-53e815411686", "value": "98304:CyDpMtmyeB5v6gLCr8JxvcftoIwWWt0z3bdtwW/tpor5W:pDq7u1xv2toJcbzwQor5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700693765, "uuid": "d1df8004-738c-4b16-a728-e736bd4dd410", "value": 4965421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700693765, "uuid": "4f0989a3-4296-4ad0-bfb2-68cc8dcd1226", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700693765, "uuid": "21455fc6-4d87-4f3a-a94e-5d9adab0e9ab", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2201138a-8990-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700696263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700696263, "uuid": "cacd30fd-ad48-443e-969b-75550b7e4f67", "comment": "Malware payload", "value": "8e05b3e6abde2813733d54f480c7a866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700696263, "uuid": "797e2b2d-8a65-4970-9cce-59a6abd48a1a", "comment": "Malware payload", "value": "c9ab27133f4ebc51a0fbae315e4e906ccc2579b9fe8d0294b4c5a7ed3de4b2ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700696263, "uuid": "a01100fe-999d-49ba-8c37-0298d312ac2b", "comment": "Malware payload", "value": "e4b66aab5e1ecf22f11b93e93acd4c5b9513a2bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700696263, "uuid": "b49d0a20-ea74-478f-bb75-d48a5abefc00", "comment": "Malware payload", "value": "0c30501adbfe2d28a51014b4cd255ff59ecf3739db86a1d04358fba11e96b4d2803f08cb0739e390a019e1433350e4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700696263, "uuid": "df0e9dbd-b2c9-4a9b-933a-8381d338fdaf", "value": "T1E785E1B1ABA1C572DCA73ABF7C1B8185C81A3D606E5938762FEC35894F757803835287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700696263, "uuid": "12f2f435-1645-4249-bc42-f2be7f483792", "value": "64246ffa312721d4dcd10d9cecd821df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700696263, "uuid": "e57878bc-f2f6-47d2-a332-d32d326e3e91", "value": "49152:bZAtX8IxTqh0eJa3DZEe9sRuCVCW41MyqChsQ:bZmXX8Za31CuCchMXC+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700696263, "uuid": "4a8e8df9-a712-4205-b946-debb1ff691c0", "value": 1740288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700696263, "uuid": "282522ec-2f68-46c8-8d47-d35a18fdb5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700696263, "uuid": "02388ebf-82de-453b-9574-61f5986b80b3", "value": "21.11.2023_Is_Bankasi_4405-577407_Odeme_Plani_889302956-755049330.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93975576-88d4-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700615708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700615708, "uuid": "a8e8ff00-8ad0-4e10-bf6f-715eb5650d6a", "comment": "Malware payload (Stealc)", "value": "3cb444a5664e3dc859d473c67aa4640f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700615708, "uuid": "a70d68cd-30e5-47f0-8f06-fe5f37790bc2", "comment": "Malware payload (Stealc)", "value": "cb5becaa930e9c5a29146defd54293cb1266fbaa65c06ab0d8b68c150bab27c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700615708, "uuid": "a05ee1aa-8313-4e14-a1c2-bd3bbe412943", "comment": "Malware payload (Stealc)", "value": "7320c5d7fcaac8e4df521a2cad6dceefef5ef949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700615708, "uuid": "9325fcb9-fe77-4f61-8b99-7f887d0a27a7", "comment": "Malware payload (Stealc)", "value": "c1203bd6b2c63f087cd5fdd6ed87d15affb6bce2afca56c3ba8b477d47cac80a46e640b726fce0f2bbff56fe923132e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700615708, "uuid": "283bc805-2251-4223-b8df-8eafc37b1f55", "value": "T18846CF2B7E64613EC86A47F25572422079FF6A1864DF8C1E63F0478ECB2E5E01E2B517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700615708, "uuid": "8218fa42-f89b-4ce2-8d3c-3cc411d0fe2d", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700615708, "uuid": "25785ea8-820d-4b49-a77c-f2b1d53ba8ac", "value": "98304:BdL2991YnvbfnLTccGEE7kc7EFnGQYy+9E:f2991OvDtQIc7EFGQYNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700615708, "uuid": "6dec6f5f-fb30-42f9-9103-27c0eb7084ca", "value": 5541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700615708, "uuid": "322e9a4a-3bbe-4e19-aa64-2768fc024d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700615708, "uuid": "4f0c6fe6-2aa8-41bd-b46e-e049c4528ba0", "value": "3cb444a5664e3dc859d473c67aa4640f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b509cdd2-897a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700687061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687061, "uuid": "b341dfec-f0d5-45f6-b7fa-3162a5c5e9d3", "comment": "Malware payload (Formbook)", "value": "ecbcbe7b7fc38a9199ed2adc93543cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687061, "uuid": "fa76df1a-f8eb-4d10-bc57-81c729b38237", "comment": "Malware payload (Formbook)", "value": "cbf93b2bacf9e0aa11ff45a7b39541bf47da07574c778fee8a0a9e2ce21c5993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687061, "uuid": "032fe367-3503-4ae1-b904-dc2d46d2c7d9", "comment": "Malware payload (Formbook)", "value": "78783cdc74693e381e4829b586347dc42faa6fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700687061, "uuid": "daaa16fa-e1bd-4638-bc28-6160a5f8c399", "comment": "Malware payload (Formbook)", "value": "490fbd7fdcf6d3e5147c7e7c829cb2913b124b9e646bf3bff8381fe85e8155e7364c0149a1b885881b5edf634f241da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687061, "uuid": "67498831-a492-4656-9f6d-40e999b1cd4e", "value": "T166C42308916DC3E0C91894F75CF681F7877EB90002DBF59A1D9921BCA1B3B6E4F18E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687061, "uuid": "cb15cc4c-fe8c-4ced-b3a8-1a0a110a2875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687061, "uuid": "ae228bee-f298-47ca-a0b9-868a246892c4", "value": "12288:hy8oEDUranTiF0Ovtpi+N8AuMDHZYnu2o/cTy7UTa:hFFeanW/T/u5nu7RwTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700687061, "uuid": "bec97241-5c50-493d-bff6-01e7e4499f5f", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700687061, "uuid": "9133347a-50af-4db1-9e1e-a3dae8ea91be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700687061, "uuid": "364e0752-9ab9-41bf-b798-fef439959b99", "value": "EFT-17363849 numarali 10000.00 tutarli surecin dekontu,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9c781a-894a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700666213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666213, "uuid": "66150463-2743-49a6-b5e5-50021d3f3860", "comment": "Malware payload", "value": "e77dc3733f8f4f5f8d479a3f9d5ae5fe", "object_relation": "md5", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666213, "uuid": "a2cae285-944d-48c0-ad17-c0de6a33b13a", "comment": "Malware payload", "value": "ce13888cf93b1879ccc02c3c76d8d357ab864f981fe28325894bb0e972fd662b", "object_relation": "sha256", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666213, "uuid": "6ebd698b-e849-4b89-a796-ade682e2c398", "comment": "Malware payload", "value": "2d7ca9bf286defbe7de08a303e47e0adc289b45b", "object_relation": "sha1", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666213, "uuid": "c3fd1381-8f1a-4432-ae09-a59117b4b069", "comment": "Malware payload", "value": "4fd4ed37e991b94d3f6852ca28bdb628c160c82cc89361224aa1ed8eeed139f7ca32a223894d1229898e613d784341c6", "object_relation": "sha3-384", "Tag": [ { "name": "pw-7979", "colour": "#DEF479", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666213, "uuid": "6796ebe1-fa64-4a71-b5c8-01ef202eff34", "value": "T1279423A9112C0BD1AF46F5FFF054F3A8B341AC9C6D7863630F6963BA451A0B44293BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666213, "uuid": "b4bad254-f777-4ed2-a3de-c1a40bd62e0d", "value": "12288:mvp9aKIzagehZxNkDs2uAvK9ts8+RoHkZ:wIOgeL26LtWRoEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700666213, "uuid": "c12b664e-5795-4bf2-a7c0-79783fe8c8ff", "value": 417228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700666213, "uuid": "00e694dc-2e73-4487-8dbf-262ba0f85e23", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666213, "uuid": "238405fe-ed8b-4c4a-9fee-7197b451627a", "value": "GoogleAI Pro for PC Installation v1.0.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66d3706-8966-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700678554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678554, "uuid": "92ca64ab-47a3-43c0-9499-9492477881ae", "comment": "Malware payload", "value": "be9bfb247d398e5b26ecf5902e3d7cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678554, "uuid": "16034782-5ecb-4ab0-88a5-289cdbc2c964", "comment": "Malware payload", "value": "ceebca425cadd0d8c37cd65a6d60f18189a168eda54c8d3ec4008e6a06d7e4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678554, "uuid": "1d582176-06a9-4c83-bbe8-37ceee33df2f", "comment": "Malware payload", "value": "e63fd0950d3f7e48daa7aa1a32599416cf129cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700678554, "uuid": "d46f505a-ef02-43c6-a6ca-dd63d176964c", "comment": "Malware payload", "value": "a3f36d6428fa4f92bf6c437e745fc446a9ed3e74de8a6ec233763977d3102347895ec92ce3245b140e3845e2383abffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678554, "uuid": "76c75496-eaed-4802-a17c-2b2eb2d7ee49", "value": "T1D224D42BE308555DE83A473DB41C39709E70BC52E16ED32F45BA3AED293BB498B144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678554, "uuid": "d5214cea-70a6-4b76-9bab-f9d8a1f2e86c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678554, "uuid": "cc39aa4f-94a5-4e50-923f-a25082dad075", "value": "3072:C/fwUo7gNgcRN6ePrlG/qVQTvOE9RSdPUT8Scwexwqa1KSF:C/fjo7gNgcDNrlG/j/90eT8SlUwqaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700678554, "uuid": "f5cacdc2-fa35-4c93-abe4-98746b680c32", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700678554, "uuid": "d53bc005-b445-48e7-b389-33446cf5ffe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700678554, "uuid": "95186602-f64a-44ba-9790-30a3e30f1e4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18847022-893d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700660599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660599, "uuid": "57e85cdc-dae1-4214-a9fb-f030fe63759d", "comment": "Malware payload", "value": "cc5571cbdec0f9e83a5cb352f4a25deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660599, "uuid": "418d3fce-2c3c-4341-b359-805be7f51c6b", "comment": "Malware payload", "value": "cf26893a8bd70ef1981e3cad7cf075dee61e8841709af573178f3ace3f5bd022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660599, "uuid": "858d4ea2-d0f4-4a6c-b354-6fd3078ec980", "comment": "Malware payload", "value": "a086d4c15db25bccccdc36e903f7fc9cedd2f3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660599, "uuid": "fde32bd3-ba17-433f-97c0-545430c9c7c5", "comment": "Malware payload", "value": "7ae1c5adb8158ac6b86d3d239508fd7c3def5326ffc2ee9ab5be64ec0e273e934066aec49d8e5d3d06e1713efde97640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660599, "uuid": "a761448b-d09b-4980-a51a-4690efe9ad0a", "value": "T1EAE43203BA968DB5D3CA2F36C6AB04045B78E9E16A23D71F794A237D28437776CC0617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660599, "uuid": "9fab1bbc-9f8e-4b8a-a4e6-c2a8e97e67e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660599, "uuid": "e21f1918-3867-4920-bc09-9d00988a1eab", "value": "12288:+PFalGESRmKajKM44pBIipmcnRJuwBxYShEGQ7:+PCKM44/IipTnREtShEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660599, "uuid": "d92e9436-b124-427d-8896-608e45876ad1", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660599, "uuid": "8272946f-abc0-4d7f-bfd2-89dd332aba3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660599, "uuid": "54ac6e00-4c5c-4c3f-b058-3a07456581ab", "value": "z38DHLs_Express.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f5991e-8977-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700685861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685861, "uuid": "fb5a609d-e73b-426a-9f6c-32d87a931d8d", "comment": "Malware payload", "value": "464675d12fa9aa934a266b44c216256b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685861, "uuid": "6bf599f7-ac11-4aee-8231-e15411361d6b", "comment": "Malware payload", "value": "cfb48f25b823d619b2ad69d9d7d41c66633db70168bf268dade911ba9c35736c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685861, "uuid": "867ea68c-2914-4067-acba-a4a0cb38d16f", "comment": "Malware payload", "value": "a0a4189923a09d1d4291a2c3aca3f3ee90d36fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700685861, "uuid": "1f82d25b-2956-4c6f-9904-912aad92860b", "comment": "Malware payload", "value": "69711bd2934c45aed215c666abd60c1b219d34b147f8ea3cbf1820d1ed4abacea262ae577d3f97c8b622ebf2878fc1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685861, "uuid": "af40eb1d-a56e-49aa-b553-8d9ac88e2870", "value": "T1DED423592EBD8378C286CFF5503961785770EB03E892E3AD8FD978AE222671C0E15735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685861, "uuid": "f32b5af9-565d-426a-9c25-965ffdadbb2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685861, "uuid": "b43145e1-115a-487c-9c71-c06ee767f7d9", "value": "12288:5y8oXw+8gnv3Lxw6Y0uWR89WqUi7Ww2MK5WgFqLl0+jV:5FO8gnTxXuGZR83jlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700685861, "uuid": "45049a79-406e-409e-974c-5f41ea366af8", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700685861, "uuid": "534a09fa-a802-4d20-a921-35d5402878ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700685861, "uuid": "1d18b319-87aa-48d8-8fc4-782d90174acd", "value": "AWB_DHL_shipping_documents_receipt_22_11_2023_0000000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff23a187-898a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700694057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694057, "uuid": "fbe1378f-d5d9-4d35-b690-81098df1dce8", "comment": "Malware payload", "value": "34616406502b45a692414d61720e8a4d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694057, "uuid": "e96d842d-d644-470f-8f3a-60d7f1dbcac8", "comment": "Malware payload", "value": "d0e7c3acb616259df7c6677c955d1d5cc55d24a22a0475993298991711ea177f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694057, "uuid": "99a6ed8c-cf98-4255-ba09-de6973fce291", "comment": "Malware payload", "value": "283a6b4b4f1ae38f8e0271b5f866c7dbda650ca3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694057, "uuid": "396aca91-fa15-4f14-b4ec-8151d82e55ea", "comment": "Malware payload", "value": "b14fa022c45b155cc8ab504aea3b527f70a17883954d45f71c1e038b6c458d56fb0408fbb7aca34eeca5ba0914543e19", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694057, "uuid": "e819ef18-5db7-413c-97d9-24a1399b4393", "value": "T17F26ADC6F7C99C2BC8F36375C67652A1522B4C268743CBC32A24763C29B76D44F5AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694057, "uuid": "87b5fc97-3c1e-4c64-9890-e4b8758c7f18", "value": "98304:o8xxJoTYr7xR1zm/0OztCdM98xTDD5zuPV+:Nx7R1zy0OztCXhHcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694057, "uuid": "927698b8-8346-4c7b-b446-17230bac6643", "value": 4483582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694057, "uuid": "607e7d0e-f319-4fd6-8ad0-0f7bac3246e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694057, "uuid": "4c2acb58-bb98-44d0-a210-e09a9978375e", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68094ee3-88de-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700619930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619930, "uuid": "dc598b6d-5e4a-4e30-b6f7-62f1e73d2e2b", "comment": "Malware payload", "value": "80323522c34abf41690a34cb798c0775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619930, "uuid": "7a041323-19fc-491d-9581-f8f928974a1b", "comment": "Malware payload", "value": "d0fd3e0e753a4c2de80b7997d7ebc6f48aec45acf3f1519dbb1b7c6c96835352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619930, "uuid": "00e76c11-0855-40b6-b57b-bf72f0b373dd", "comment": "Malware payload", "value": "ad44df07d038204268ce0690d563d5697f0ba8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619930, "uuid": "3a760e0f-a674-4628-b343-d8307763969c", "comment": "Malware payload", "value": "2f0b2696e7107d959f2baae27e4871e7b86818a3f30d9b8823d4d2540e8eb382907f5d8f281f26142fc3ed9b52146724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619930, "uuid": "440321ee-4a4f-46b0-81cc-e8c46bd84a0c", "value": "T1DE559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619930, "uuid": "3b7dca15-b5a6-46c1-9823-f213b18b53e7", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619930, "uuid": "a8cb9a1f-da37-46e2-a908-b430e5be147a", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700619930, "uuid": "eef1c59f-ccc8-43ac-bdc6-b76b4f769eae", "value": 1321999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700619930, "uuid": "b2e195ca-da60-4ef5-b8c9-de5751c674f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619930, "uuid": "546f1948-4355-4156-bc1c-ce0c00987939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c36a66-8921-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700648869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648869, "uuid": "5da66425-b169-4a9b-b1c3-6e79e3323810", "comment": "Malware payload", "value": "a72d2a029c5d24ac251e83902f4d9fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648869, "uuid": "d298c966-7b1d-4328-9027-a75ffc165f4d", "comment": "Malware payload", "value": "d12643c5d9744ed5cce5536629e0361d862a9c888e2ded07c5593c7867d9697b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648869, "uuid": "03be858b-331f-4953-8d55-f784b88d9e06", "comment": "Malware payload", "value": "0b4b30d33263c4aeeb4813755d86b9bce1d8f9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648869, "uuid": "e9a52249-77a6-4e1f-9269-bd7ce204d800", "comment": "Malware payload", "value": "344603502d20e10026f261797d2e8231fef6e8411379bd58605cfcf96f575ea5c78b84cfccf8ff67cd75b53f70b8fd3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648869, "uuid": "a66e03bf-02e6-4880-8a70-cba771417a82", "value": "T15D559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648869, "uuid": "a77acacc-4817-4d97-aa3e-c1a84f0e7a27", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648869, "uuid": "9db7a373-d4e8-4760-9760-2932545c97ec", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700648869, "uuid": "53a50c8d-85d0-4b36-a6f1-4410c51f49b7", "value": 1322071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700648869, "uuid": "ba7b8783-f701-423c-83ef-6294ef35d5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648869, "uuid": "57638e79-7b37-461a-8ab0-66123051bfe0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a32ced-8926-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700650962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650962, "uuid": "63434011-989c-4834-8dac-c4d531908d74", "comment": "Malware payload", "value": "92ef75a3ee0a68490eff334e4dcd7627", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650962, "uuid": "bed0ff87-645e-4394-831c-cbb468a0457a", "comment": "Malware payload", "value": "d16b6458ecfca8bfe19aff18071efcf91d1d5b11c056f1a764044e1242e8f15e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650962, "uuid": "751c118e-d58f-46d6-8d59-13180b097644", "comment": "Malware payload", "value": "a45dc186286d95acf747f9aa521fb3b39a229b07", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650962, "uuid": "f4579593-d2e6-40e0-85d2-20288d7386ba", "comment": "Malware payload", "value": "b9f46a9b92bf7ff977c7624151a61b4ff8a0b8f5ab9ff2be79a015bb731a7ebda863b198351d69308c404c91793f4a60", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650962, "uuid": "8d132a8b-b82f-4076-8484-c64ea1ce6d64", "value": "T1C3B2CFB3C670187ECF354136B2E93602C21C684B911B2E0CBB72E71D5D7908E5D7A9AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650962, "uuid": "e3088bb8-3199-4a12-83d4-47e932a333ef", "value": "384:LrR+wlG6f59UORfqNy4Y0Fivd7ZMM4EUS9rDhCl0mppO7+S88m91v8tIQ:LrpomfsRYKiAMx9Xg0mpa6Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700650962, "uuid": "b72f21a4-44a1-404a-8f8f-29795375f229", "value": 23412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700650962, "uuid": "3038b21b-37ea-43df-9c86-95e77ea41f60", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650962, "uuid": "f37f4c75-4e4d-4853-8206-c921c4fa4920", "value": "BEM00263.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f939dcfc-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700663123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663123, "uuid": "a56eb2da-6420-493e-80f2-94a0f497ec34", "comment": "Malware payload", "value": "545562d7448036ef612fe05665943642", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663123, "uuid": "db07d510-0e85-4e5a-8e40-6900e42bc163", "comment": "Malware payload", "value": "d2c458cb23677152bc11beb1ab6ab0de14f86698cf279095008e074249daeae8", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663123, "uuid": "3c61d847-fa31-4d31-ab87-8fc08b1ba0f5", "comment": "Malware payload", "value": "7d7882b25b92c376de9736a8c0f4f3677b007cc5", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663123, "uuid": "256078fe-f044-4f38-bfc8-2c59ed8c6d64", "comment": "Malware payload", "value": "f53f20df21b00858ac2a4935a9d8b05f30bd01cb6e3c30ee5e5a2d72bf9d837f0e91e57c94074265063ce025c9f4a9ad", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663123, "uuid": "c6dd906f-e1f4-4f5a-937f-a9055ad82348", "value": "T1CB1633B5875565E84D328326E2DCB92FD1CDE80CB5981DD12B8E44B3F92D0F82B4CAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663123, "uuid": "83c44f2d-10f6-431f-80ed-74143a8d228b", "value": "98304:L9oFZ6vh1jhCPI4bOG2vVOOWQ9kLNriTl9zQ5Ii6KlMvOy4s:LCjkjhCg4bKvgO4NGJ9zm0oMvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663123, "uuid": "2e29c6aa-b69d-4528-a4c4-aecd191da898", "value": 4283266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663123, "uuid": "d3a3b5c4-c15a-4055-8959-98bad53fc7ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663123, "uuid": "1a8ce8ba-7d9c-4cd6-8708-9db2b51a5717", "value": "TempData71862490209.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568a44a0-8940-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700661991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661991, "uuid": "8740ddfd-82fe-461f-b598-7b1d4f33e2ac", "comment": "Malware payload", "value": "7ddb3ee12b0894e3365e5c08e7a85cc4", "object_relation": "md5", "Tag": [ { "name": "185-163-47-137", "colour": "#177E1B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661991, "uuid": "3dfb3a72-4b1d-4a2e-983f-eea704f10d3d", "comment": "Malware payload", "value": "d2dcb5d96cca70433b40875368f35350b6f971cd4f01c5a9937b14f8faa316c8", "object_relation": "sha256", "Tag": [ { "name": "185-163-47-137", "colour": "#177E1B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661991, "uuid": "56b4a035-6d8d-4ee4-8036-7872ca4c688c", "comment": "Malware payload", "value": "aa6d8045a02dd0e33a33623deab2ae9f1c289862", "object_relation": "sha1", "Tag": [ { "name": "185-163-47-137", "colour": "#177E1B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700661991, "uuid": "c21f814a-b7c1-4fdc-96ee-6c4b4a679444", "comment": "Malware payload", "value": "951e81705f350f7688b1cbe7a0f1b5edf3e6b1102aa9cdf9aedf3ddbebbff95d5a1209e1f6546e240ccf76a506935bb3", "object_relation": "sha3-384", "Tag": [ { "name": "185-163-47-137", "colour": "#177E1B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661991, "uuid": "0f2a920e-1d1f-4e9c-ad7e-7a36ac4a9c8c", "value": "T1D701AF1125CAFDAC1157F2D173B485902BD74441D4583C2297581E4E9FB2D7A44DF9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661991, "uuid": "9e08cf58-d855-4787-bbed-ee5475bc4df8", "value": "24:1I2hFhNR8piBlLoG1fXtIDvsPuqHeA3N4t:1I2nhNypGlUG1f9I+ZN4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700661991, "uuid": "8d1e5283-5b29-42ae-8bf6-9080c7a77e8a", "value": 850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700661991, "uuid": "ba4b0519-3dd2-4583-8d28-65cbcba0ca4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700661991, "uuid": "66046887-3320-46b6-a6d8-d5b1ffb859cc", "value": "client32_14.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d17339-8949-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700665874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700665874, "uuid": "d1c58e7c-79f7-4052-a8f1-e4df19353cb8", "comment": "Malware payload", "value": "422c42c5de0302f8297b4fb15e33f00d", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700665874, "uuid": "8184074a-a2a8-413b-9077-cce1e32c55ed", "comment": "Malware payload", "value": "d303a6fa94d9e755b2724e61940c9855550767fe2cbce850be0af9fb2745f59d", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700665874, "uuid": "4ac3fdf6-e2fe-4a7f-955e-5c0606114e1f", "comment": "Malware payload", "value": "3e58421fef036bc38e6354b16db1616278a79cf9", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700665874, "uuid": "397cb6e5-7aed-416b-a838-b6eba8c7d821", "comment": "Malware payload", "value": "f843357095651ed1dd94fa94ac1d1f4b7f09db16acd4b3216f9f675bdc7b29d0a1b28d2944342b22ed47e7c03d7bb655", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700665874, "uuid": "f17afb53-ffcc-4333-a5c4-b67478d74110", "value": "T15612F0EAF11E21CC1E5294802570D24AFF5DE25464E9CAEFFF0BD74B225433A625DCA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700665874, "uuid": "4c9662c8-45ba-41fa-9a73-347e05cf4493", "value": "96:fFmCWEI5f7mxRgHw9Aqd8p8wrwzWk1fjnCafs:fFJWf9tHw9jW8wrXk1fjjfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700665874, "uuid": "c73fc11b-4246-4191-8fd8-0871ba97d7d8", "value": 9225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700665874, "uuid": "986e7186-d518-4efe-b491-3ed74beab445", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700665874, "uuid": "2d1687fc-e67c-44a7-bd25-bed6d1c1db74", "value": "asd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f662a5-8986-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700691926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "6837a512-bdc8-48ef-a9a1-eaf864678e5c", "comment": "Malware payload", "value": "b7c3db7deb8ce24c51400e599a1f11ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "ed36a65e-57d0-400d-8d7c-ec4b854d5bfa", "comment": "Malware payload", "value": "d6b350e01a852f96cf8aaaf7d0111ded5b6204160c47be581c48d26a4f4bb516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "69a67cb0-dbe5-4949-b7fc-92ae1ecd3f92", "comment": "Malware payload", "value": "5abafb604ed47003e0e69d548385e8d48f8b872f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691926, "uuid": "26cf0ed9-7329-472c-8aa6-97930cdd2a9a", "comment": "Malware payload", "value": "43fba4621ab76567df0cc8c22a96701578bb93ea9942df9563f0ec9dff7729a36dc7707b852a964b991d67077e45de4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "4b8d9e88-05f1-4c6c-959c-504dfda9b791", "value": "T1AD559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "78a217db-37f4-4b8e-b804-72d062b9bdb2", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "995bff27-8e3e-4b14-9f86-96924ab4c7b4", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700691926, "uuid": "68bf6a14-35da-46f9-b03f-4969dd58c739", "value": 1322190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700691926, "uuid": "0436384d-09f3-45b9-a7c5-2aaa62957c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691926, "uuid": "f8f5ca6a-b186-4d6b-a5dc-0b61c1e3a09e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63596d8d-8928-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700651705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651705, "uuid": "95d7f3a2-0616-415d-b286-abaf9feba4d8", "comment": "Malware payload", "value": "432656b072ec77ed3edebe5ebe2b5110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651705, "uuid": "6f6a0547-e7a4-42db-b04c-ca3f6dafb2a4", "comment": "Malware payload", "value": "d6f7569d9874600484ac1aa884aae6cd3687a833fddc8203f74e4c619a3a3be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651705, "uuid": "f21515cb-3654-4b82-be5d-1a8eb89799bb", "comment": "Malware payload", "value": "bc6d175cd01bddaf7ccf6a2bdd481dd5be269201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651705, "uuid": "32f6d95e-647f-46e4-8944-c78720ac35ea", "comment": "Malware payload", "value": "68ab5b6941d7430d401cc285faeb7adcc55344b0d33a7bcb52942b9a34fde2c5383f4aab2d921c07b08cd1943131dcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651705, "uuid": "2e2f1e4a-57e2-4d0f-b12d-97770efd415b", "value": "T1F2D4223219085776CE3E67F694A526819B77B80B7996E74E0CC230DE6572F028631FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651705, "uuid": "723252f8-6cbb-42b6-9459-3210710ec3e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651705, "uuid": "952e3be4-9a05-4cc0-bb6b-461ce8f40c70", "value": "6144:uvpgNeoY+ZM2c1nr9Ch33XJFrR/HZmOzLyJ7D1w72LnludHPavS0bCSOr2R8Ruyf:Z8oY+Ar98XJJFZmO/ypJeHP21E9+YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700651705, "uuid": "8d49d9fd-329b-44f1-9dee-79b4390aa116", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700651705, "uuid": "1c08211e-1081-4d66-ab90-e4181516fcf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651705, "uuid": "28221984-b563-4fdc-822f-7bbb392590fa", "value": "SecuriteInfo.com.Trojan.Inject4.59820.593.18302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2652ed29-898b-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700694123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694123, "uuid": "de9177cf-167d-40db-b9d5-5beba2781bcd", "comment": "Malware payload (IRATA)", "value": "1ba77216c0aeb486f180953d4caca0c2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694123, "uuid": "5dea71f2-8216-48ce-a317-253d84166d9f", "comment": "Malware payload (IRATA)", "value": "d95ee4cd163f7091b8e987904a9ff72c457546d12385c24116a7bfb7bb0f892f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694123, "uuid": "b70dfff6-ef9a-417b-913a-99d67ad08b5a", "comment": "Malware payload (IRATA)", "value": "8b24cc88cd42bbcfb3df85c477f0e13dd5909b3f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694123, "uuid": "f4ed03c6-8168-4f92-969f-3fed4ad1402b", "comment": "Malware payload (IRATA)", "value": "10d5f33903ec41e18cfcd1740369c6914b8e28d77ea7c48a6ab48d6a91223de255179034f9d84bd7b41ac0eaa4d97d4a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694123, "uuid": "18fb3ed3-d39e-487d-91ca-2d0743d66c5b", "value": "T117D52393F365A45BC8F6C37226A51A3711771E258B43B78E791877FE68B7CE80B80184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694123, "uuid": "5a105dc9-98cb-4570-aa46-f0cec23fdfba", "value": "49152:nCkkEeXJp88iRA/l3wBWPBFQiBv7RJl/d3T3btqa3PuU8NdGSR5wrF3sl4EUe:CkkFXnSRGIG4i7Tl/5LtSU8rR5wrk4he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694123, "uuid": "304b105e-467b-4801-8017-c907d2c8e153", "value": 2896481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694123, "uuid": "5bafd154-d7e6-4681-a91a-561406a4839d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694123, "uuid": "0df6fbc1-c876-4cd7-a264-1d4a889c3ce3", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9abb4c6-8937-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700658292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658292, "uuid": "92193ab7-87d2-47ef-8a5f-3755579dce38", "comment": "Malware payload", "value": "607e6e48bb7398dd40783cdf86ee4670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658292, "uuid": "552cb294-caa0-4f9d-9766-0639435de415", "comment": "Malware payload", "value": "db76e48e13420cdf37910e1a89c2e346ee73d6d3999cbccfd552d7e22eb9123c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658292, "uuid": "1c63c2a7-0e0f-46ea-a9f8-3c505f9f3077", "comment": "Malware payload", "value": "ab8c150817f8d04e59e5b8de83c934d1ef97f83f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700658292, "uuid": "8de8ed9d-5913-48e4-a480-6cc36013ddda", "comment": "Malware payload", "value": "d26b1a37044f35e192a762afe816d55fd7e967dedc4181a085b1bf94877fcec8f165ceec7d5dcb5d080959541ce774d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658292, "uuid": "38bf4f33-757a-4a2a-afaf-c5e4637bdf52", "value": "T1A035CFE62395FA52D03FBF707511B43183F69CDAD752D32A2CC974C677B2A486A81232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658292, "uuid": "a3ea3aad-f0cc-4804-bcd4-78ac9b1f7bfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658292, "uuid": "c5b7850d-cb46-4e3f-a351-dc86ce272c3a", "value": "12288:xw/H9W7SDR7uVA0P0YLdpTIEXQMRp6UiZy+08Be8Yj6D5ogFCVco0Xa:y/ESDm7YEvuXZZOVj0ogUV4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700658292, "uuid": "f034b7ef-df58-4575-8194-d06deff69581", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700658292, "uuid": "d74f349b-51ca-4483-89b9-b6d55919afe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700658292, "uuid": "016e8041-3b54-4e8d-92f1-14b470b83ce6", "value": "607e6e48bb7398dd40783cdf86ee4670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997f8dd3-891d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647071, "uuid": "f1792bf4-354f-42fe-a83c-9362a00351e0", "comment": "Malware payload (Mirai)", "value": "d9e77d0fd9278be34d16d66949697281", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647071, "uuid": "edd77874-50aa-4e2c-b516-26895217c8df", "comment": "Malware payload (Mirai)", "value": "db957c7a6737f6c817585e3474a0ec3e6aa86791882df8cabaefd75a50781f29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647071, "uuid": "b902c6fa-4a96-4a2f-b714-e4c264976d2f", "comment": "Malware payload (Mirai)", "value": "a3d183ff6b1a86847632e57ad9dc4daecd364724", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647071, "uuid": "64e2f72a-2b73-40b2-a0f4-5dbac0e8d5d1", "comment": "Malware payload (Mirai)", "value": "34e797f468b825ca4d57bda5ee171770677cec11b16bb6b8c729ca280bfca67023237b032336497d478d8770745e17c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647071, "uuid": "25f16582-ea79-4507-a836-aeac552bc2f9", "value": "T1E1732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647071, "uuid": "11f75882-5fb7-4258-b060-d1dbafe04eb0", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WE:927jqCt8v3GI/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647071, "uuid": "3ac57b49-a5de-4e59-ab41-2abe0b3c64f5", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647071, "uuid": "2240139b-b010-4949-8fb8-5d654a5b0b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647071, "uuid": "27f36a72-1b27-4055-b8a8-1a3314b2ef48", "value": "d9e77d0fd9278be34d16d66949697281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9bcada-8920-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1700648127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648127, "uuid": "bcba0d22-50d7-43bb-a97d-d5bf0c296b9f", "comment": "Malware payload (Arechclient2)", "value": "07513e388a3c97fa87c50685692e00e4", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648127, "uuid": "b6009f13-65d5-438e-bc20-07608a625d9b", "comment": "Malware payload (Arechclient2)", "value": "dba6b7bc0b4e3d5fc344e1ddc9835bff1a1979b2f3206de5a57034317bfa6635", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648127, "uuid": "8edc73b5-d735-47b3-9c5c-bf6bea70d667", "comment": "Malware payload (Arechclient2)", "value": "fe5973e43f7893728851510e528e45b2b41d6a8e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700648127, "uuid": "17b246b6-e545-4e8e-a260-1fb633821f9d", "comment": "Malware payload (Arechclient2)", "value": "72d960948b710a325c69d94ee5cbd72b714f9720e41335ff318bb2ab8c5125a432e591824780b67e8d2356269438da41", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648127, "uuid": "241afab7-de61-43a4-8db4-d88c520a9171", "value": "T16A26BE0237E3E829E15D0A31C3F1815893BB9EB18B54EB8B32E47A1E3DB17D90D71659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648127, "uuid": "f572d5a0-2ead-4ee6-b6a0-e0442c24b281", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648127, "uuid": "dcf13bb9-2a14-433c-a6c8-7368aa0fd819", "value": "49152:UwgRVqZ2IcULFVAtK7jI8ELv1hdyOSQ14lh5jM9d+d2s9PPfTc+RJywV1Hfx8p5s:qRUih4OSQ+5g9dc19PnTc+XywCBYM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700648127, "uuid": "39bbb25d-6c87-457a-8e41-c7461e3489ce", "value": 4434072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700648127, "uuid": "98f75e38-3924-4340-96f9-0b94ab2d00ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700648127, "uuid": "0eef156b-91dc-47f7-b088-a1a598aa658a", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.JCM.gen.Eldorado.6151.23926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036153e2-8954-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700670442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670442, "uuid": "6653bb1d-8821-46aa-8530-92f51f67f5fc", "comment": "Malware payload", "value": "5458b5c4ffecceca72c5d3df2b6bdb79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670442, "uuid": "24fa220f-0674-46ce-8187-7c8a749a2a97", "comment": "Malware payload", "value": "dbd0fe1deef547130e5acbbc2fd0df92185fe5667177a446c0d2caf25ac7d66f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670442, "uuid": "5995614c-e777-40ff-af02-1881478ba1a6", "comment": "Malware payload", "value": "c4187f6dffda7f3e8bcab0079deb7d4cb924b0ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700670442, "uuid": "952016e3-0587-486c-8130-535b63a21758", "comment": "Malware payload", "value": "e1be8877819844240f7e85b6094df2363b393961459b4523f7c6f9809489a0bbcdfe2adbbc92f07a1ab37ea54b5cd730", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670442, "uuid": "c87c029a-0617-403a-8fe0-566b2420cc81", "value": "T16AB4E0143B65CC508B6C16E868EB53079B2356A7DEEFFF070AA291741A2B96343113CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670442, "uuid": "c5ddea3c-53c8-43d8-aa3a-b594c583677f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670442, "uuid": "e9a3697a-35ba-4f16-a299-53ff9157c02c", "value": "6144:y2WASJCzXCrUfN3ZFiJoftOnI2mt0MCdqN1pGA7pkDvuv9VTnn+:ykzXBfNHimtOIhVCdwrLdkDvoV7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700670442, "uuid": "543f1373-8ab6-45d5-a22d-b78f4e89e557", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700670442, "uuid": "be1ccaf5-a44b-4932-9391-635414cb5b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700670442, "uuid": "7c7f789e-5d9e-49c8-807d-3eaef7e8face", "value": "KABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZFFTYRS9DKMTDEvbxUOK2pRhINstVRcfALMRRK2KfAIY6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae17e35d-8942-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662997, "uuid": "4887da7f-64cf-4ced-84d6-882c3e26b808", "comment": "Malware payload", "value": "e9609072de9c29dc1963be208948ba44", "object_relation": "md5", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662997, "uuid": "de4d711c-1e4a-4d77-a5a2-d9cf4f68c59f", "comment": "Malware payload", "value": "dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747", "object_relation": "sha256", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662997, "uuid": "585c1572-73ac-48e8-b591-0179825daeb8", "comment": "Malware payload", "value": "03bbe27d0d1ba651ff43363587d3d6d2e170060f", "object_relation": "sha1", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662997, "uuid": "daa487b9-b5c4-459e-be8b-22057774a11b", "comment": "Malware payload", "value": "6a0e17bf76bc0c41b0e678409e25d032f13d432ed5d5ab3d745756ea0127fe29e538b9d62b0096b3693becc6acdde861", "object_relation": "sha3-384", "Tag": [ { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662997, "uuid": "699803db-9e23-4df3-b878-45bee481fe91", "value": "T1C9D0228A4667102B67C392542FB190EF62CAC2530168BD84BAEA303A6DC61142E8A1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662997, "uuid": "65ae814d-d25c-4986-a806-92849f5ab04c", "value": "6:O/oPITDKHMoEEjLgpVUK+Odfu2M0M+ZYpPM/iotqO2La8l6i7s:XAyJjjqVUKHdW2MdRPM/iotq08l6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662997, "uuid": "6adb1215-2ce9-4aca-9f73-587f14fba1ec", "value": 195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662997, "uuid": "a6f23fee-c512-4ed8-8ddc-f55536358911", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662997, "uuid": "a3d36530-214b-4a8e-87eb-d4539aa75035", "value": "NSM_1.LIC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f922eea-8973-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700683938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683938, "uuid": "da927b96-9007-4fc6-ac3e-daac897978f4", "comment": "Malware payload", "value": "49d1f9ce1d0f6dfa94ad9b0548384b3a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683938, "uuid": "2dd4465c-1380-4db3-9e52-0c523cd10eae", "comment": "Malware payload", "value": "dcfa6e2ee9d3abad0db0e3091e547e3e6f14392878ab743f1710fa880ea23385", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683938, "uuid": "a782ecff-56ea-49df-9c5d-bd438eb878e7", "comment": "Malware payload", "value": "07280b08c53885cd33b4f0bdf6784242babe64fe", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683938, "uuid": "e93e074e-4000-4d6b-831a-b00a3dc395d2", "comment": "Malware payload", "value": "92cf3d42086ce57f09d4ae6715b564beaa38607f2df209cc57ac8556fed4c24c68a19612cb236f1508794914a8c5e9c5", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683938, "uuid": "5ecfd377-c67d-4020-b85a-2789fbf5c8b7", "value": "T10EA31C613AD9510CF1F3FE816EECA4B6D95FF6261A3E547E10410B0F8B62A80DD5273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683938, "uuid": "1fe80670-1834-461f-b206-5ff2fa8952db", "value": "768:Jc5LSXQNAy3yv57QheG3fSH2xajrI9hFGG4SfNmEf9MlOo0AkfoUtMtpAuutLque:3v18eG3fSHrjr7RiV9McAuMtpUqmNo2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700683938, "uuid": "37ed1560-1155-4fdf-bc24-c333eafaa076", "value": 102144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700683938, "uuid": "945a2db1-b62a-44de-8ee0-763e8ce93c4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683938, "uuid": "8804fb21-d850-4578-9f77-87635da07ec0", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890c94f0-898b-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700694288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694288, "uuid": "e0278639-33f8-4eb8-a30d-352f1c10ba62", "comment": "Malware payload (IRATA)", "value": "c116c28af53dda283bbefba4dbdbcc3b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694288, "uuid": "ef32071c-f7f0-4069-b1e9-285b26ae76f1", "comment": "Malware payload (IRATA)", "value": "dda68688834dee89c8c0200981276be30fdd5ec3071b55331b7049f2ea03363e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694288, "uuid": "0f86709b-b3c9-4f03-90f1-c572b3fde5f8", "comment": "Malware payload (IRATA)", "value": "d3cfd7977c57fb34c381001a41b9fc1c4a3cc376", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700694288, "uuid": "5db03671-9055-41e8-9f01-e4470c85f4d5", "comment": "Malware payload (IRATA)", "value": "70c695c5c16a8c70c353a55002e3798387b4fe3ed3ad7830ab7ac9c996dbfa01dc0f2b20a86476bbf818e8dd3c45c046", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694288, "uuid": "64ede700-f8d8-41ad-9888-4a74bff7b158", "value": "T16A36D0D7F395686BC4F75372817623A5424B4C228F83EBC76914B67C28BB5C42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694288, "uuid": "1cf164e8-6a82-4be4-a722-0e718f772a97", "value": "98304:RCU1nGU+oNm/n8e8wMjkgLCr8tZyDpMtmyeB5IeS:RCanGVoSgwMj/0Dq7uIeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700694288, "uuid": "4c4f3a15-c785-4025-a95e-d3f6bb57e46d", "value": 4954131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700694288, "uuid": "f5ccccdc-6fa1-4fac-861f-e1573a38c28d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700694288, "uuid": "a64836a6-7926-490e-bfcd-7c8ab11908ec", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d5ce31-894b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700666844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666844, "uuid": "67a47809-492a-4988-85bb-e5846c94fd38", "comment": "Malware payload", "value": "c76fbce58966192e4edb413842e092c8", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666844, "uuid": "bc623fbb-874b-499b-a90d-9c5275fe60f8", "comment": "Malware payload", "value": "ddd613f518dc15b2dd9dbcfe76f8f8248aca1b08dba7543b25800b9abddd0eff", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666844, "uuid": "1a06d0cd-492d-4a5e-9495-a56866d0a6a1", "comment": "Malware payload", "value": "907e80613f61bdf9b8ba744714aa893c827d53e5", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700666844, "uuid": "d478ef21-24e4-4b74-831f-b8ce905f25fe", "comment": "Malware payload", "value": "80e7e3cd0dc26dec12c200c62026db1ba8ad342b942028bacf8d089678ca033f69c335436d437c180ec7221cffbefa15", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666844, "uuid": "ea02573e-bbbd-4074-8f06-00d349888aa5", "value": "T190F623D27EE5D3A4C4865E2466CB17DE21E2B389D1F95A1D3ACF1C032A30E43CE59972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666844, "uuid": "bf1878cb-26d8-42e7-94c3-cd57250e1fc3", "value": "471bac843c91a9a3ab7ad3e9a3e34c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666844, "uuid": "b960eb96-af6b-4dc7-ac7a-8e7173f16197", "value": "393216:ssHY7bLinAF2iVfTqwMJ7g+6NIeltiF9c:ss473gA0eO+NI0yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700666844, "uuid": "9b336636-d170-4bc5-99ce-103e9f5f579f", "value": 16535368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700666844, "uuid": "e4a82194-85cf-4d24-beac-cd8aa4ba1239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700666844, "uuid": "74ab91e3-79e0-4043-aa56-e41b7b0978e5", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d85a22-8959-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700672920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672920, "uuid": "bc1ee0c8-ee1a-4fbd-a3fe-f4ac05dfe1a4", "comment": "Malware payload", "value": "abfd13615e3f6ae41abf592863a10464", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672920, "uuid": "bd945e13-7551-4aa2-9b7e-f60688b2359f", "comment": "Malware payload", "value": "df6f30d1f50ef7c387700d1d8dd368c242634aca9a8beda2c0e95f5e7c2f9f37", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672920, "uuid": "696d16d1-0917-49d4-8318-0965bb835d2d", "comment": "Malware payload", "value": "65196244a80705c04d7dbafb16b747e36bb77fed", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672920, "uuid": "8470d19f-0ae5-47ad-881b-d20a401887da", "comment": "Malware payload", "value": "6d2d207c2d84ce90d6cea63cf113ac04b51ddde7e0327b4d4ce9cfb515b6c8bb4d6dd8d7482d690e50afac1f12bf5bb7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672920, "uuid": "f0f01e63-d07c-496f-b57c-390d6b2ab2e6", "value": "T169E423B8F9DD9643119707BB275492DB0A06B822B136C27E5C35E4430BAB77D6F2C782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672920, "uuid": "8adf9481-8fe7-4761-9386-ade3b65d0a1d", "value": "12288:OproX4roODbu75NzccaCfgpRbuLWNbzs6QCIsLJmFamS9wnR2HW:Ho8oylNocacgphuLWNKkIgtz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700672920, "uuid": "c02d448d-b4a3-44fe-ba1f-ed1ae3225672", "value": 695020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700672920, "uuid": "cfc526fd-acf3-47fa-a4ed-a30a552b0486", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672920, "uuid": "f184da37-8f9a-4e53-8983-4882eb20776b", "value": "NEW ORDER 45471.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f25a1ae-8913-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700642571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642571, "uuid": "a8f31a47-4e74-4e62-9e82-03581843756e", "comment": "Malware payload (Formbook)", "value": "64a8d31b44281164100e440b409ead16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642571, "uuid": "679e800a-af80-4b95-a226-926eb08be6df", "comment": "Malware payload (Formbook)", "value": "e13da050f3c10b808d02c71af6fa2514184faa236eb00c77a51b8d2d4879e3ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642571, "uuid": "3bf5ca21-878a-49c2-8966-65c8fb863f80", "comment": "Malware payload (Formbook)", "value": "bd421e74afe2608854ccd2b1eafe07b1751bb50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642571, "uuid": "c8ee5caf-211c-43cc-b273-b648a33119c4", "comment": "Malware payload (Formbook)", "value": "10eb2bfde977114423f1a266ed779ac015da8c111ca4ad8813a1576a9d330122a182be68c5d7e6485ced3fafb95e6485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642571, "uuid": "d46e1792-cec7-4272-95fa-8451a4a8dcf0", "value": "T1AE54094523EA275AF2FE1F72E4F4562587B8F952AE6FF30D18441CD81CA2752C822763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642571, "uuid": "25ab3b01-e97c-4ddc-8736-e6492dbc9ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642571, "uuid": "fba92bca-805e-4c20-8cdd-7ede71501f5d", "value": "3072:BJcASV6d3HGUJOo1NlNSsiKg8xXC7FNCicwfYX2sqZdtM9T9V1zn49X1oEs5Uutu:BD46d3HGxo1VsZgAntEbGXie7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700642571, "uuid": "d2171a68-4d56-42cc-854f-277ae9184d6e", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700642571, "uuid": "c6b07c16-b6c7-43d1-816d-1e68e46f998e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642571, "uuid": "0441a32e-8138-4859-80bf-300318b8fa17", "value": "Payment Advice - Advice Ref = GLV407423235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e038952f-892a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700652773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652773, "uuid": "1b3b719b-d57d-4fd5-96e1-1395d3c47d0e", "comment": "Malware payload", "value": "12f41d1e7b24fdd31b483b4640c7ad5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652773, "uuid": "892cb450-e133-4dd2-8f2c-6a7ef7208674", "comment": "Malware payload", "value": "e15644a809333b1e0cce7bab9f423af06b2362c501d3d8aac394ff2b367a0ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652773, "uuid": "564d10f2-d6d1-4c1a-b737-787b34e8d850", "comment": "Malware payload", "value": "bb8f0104107ab36e1e0ec7bf091d8d1691462c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700652773, "uuid": "c66d2e61-e7d4-4eb8-9d77-6c344bf37d32", "comment": "Malware payload", "value": "aabf1ea4b00a12574e5fda6b596fbdca10063c09d5d1873d9d41f1e176b8ec851422c718ee5673d058a9162e1794426e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652773, "uuid": "33328264-2502-4f8f-aee9-f48e85f422c4", "value": "T19874234DFBCCC663D46A4BFFE0E0B4822775C9B6A687E34F6154021006077E68B927A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652773, "uuid": "7f6e41a7-86e9-4cb4-b3b6-19660637dd2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652773, "uuid": "5c6efc59-e87e-4e15-a7bb-2c0ea377d707", "value": "6144:mRofhvPVwrM/0ehA8bTf+bwkXnZURdNAJPTqZ+hq5Yh863i+oAiAOCK65vie9My:mRMduM/2efelZURdN6m8a+pioPKnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700652773, "uuid": "42d3ca58-735c-4e52-90fb-0b9316a307fd", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700652773, "uuid": "97772453-d76f-4bdf-8767-cda45bf6abb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700652773, "uuid": "dc2de920-3fd3-4863-9160-e96f6c4caa84", "value": "isuu_22.1123re.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bb9903-88f5-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1700629825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629825, "uuid": "93cd381a-baff-418b-9b40-d42984a220c1", "comment": "Malware payload (Glupteba)", "value": "6d1d2cacb7b8b7a196b845284de702d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629825, "uuid": "c46a00f0-f370-4eb3-a9e1-811407374713", "comment": "Malware payload (Glupteba)", "value": "e340efd16c8fc3ed295ec674e97bed2ec4bc1e2a14a8089537b03da23f0f47ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629825, "uuid": "3170a5a3-0b35-4103-b2c7-5af9e58c90fb", "comment": "Malware payload (Glupteba)", "value": "3757861a3fba904be7f2f45a31a8b27ab4e04d72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700629825, "uuid": "2da6fdf9-b162-498b-a94f-637882daf7e4", "comment": "Malware payload (Glupteba)", "value": "d0848c6c6f0fd25a0096c92d53c2ba43846edf817c33d26c59c92d76fcf317534c25db1cacb2482fb4ecda594fd84c5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629825, "uuid": "d5308534-6136-4975-aaed-3b1ac865283e", "value": "T1F6D6F1E17341463B72B48AE75A5408818F80B8106F65B2F9337A507DDA71F7CDCBA6AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629825, "uuid": "14107178-c967-4c83-9704-4bfd464a3e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629825, "uuid": "ef7c0818-a6bc-46bc-ae94-23376a34e4dd", "value": "196608:53+ONF3D9d/t5q7cvJa21FlU028hS2fV13mz9vElUaaLSBwo8Mc5h9Bf/Yti2SAH:XT9d/tovUFNhDfVRmz+MEEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700629825, "uuid": "c8364b35-8861-44c0-bf3a-afb7b21691c3", "value": 13079552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700629825, "uuid": "4a600093-89cc-4c94-b382-4d311cb3859e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700629825, "uuid": "39b6baa9-41cb-4fcd-ba83-35eb7934f504", "value": "6d1d2cacb7b8b7a196b845284de702d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6830f5-8934-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700657085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657085, "uuid": "81db8440-6aeb-4cfc-befa-72a591e4d56b", "comment": "Malware payload (AgentTesla)", "value": "961aeab48d0c27a8624a8a6311bd9188", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657085, "uuid": "c498da26-cb08-41cb-9678-45bbc84d8f0e", "comment": "Malware payload (AgentTesla)", "value": "e4319322a73a875512b80a2cc5bebf8c963f3e657258a6e7afd90919c8553fdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657085, "uuid": "a79712fa-0014-4cab-8a63-da741aeb3b2d", "comment": "Malware payload (AgentTesla)", "value": "e831abf639e91427114906e91b9e25e1fa264a33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657085, "uuid": "550c0b88-db04-4e1b-bbad-fd84bb12b28e", "comment": "Malware payload (AgentTesla)", "value": "e2161db7a1749414302f8961e415f7f9f69d64c77c47062fbae7f75ba412a9f9edd2aba071f73faf7fcd0a1f4e0cf4a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657085, "uuid": "75162f83-4e14-4ab3-b7d8-dbffe8893679", "value": "T163C4020231BD9B2ADAB847F61007465017F6B5EF72B2E7184DCAB1DA6766F100AC1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657085, "uuid": "3a72622b-ff76-4c73-8f59-c09af21f96e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657085, "uuid": "d7c7e7e9-caec-4399-a379-90796a245d6d", "value": "12288:e0WBsHLYZTDrS3xPlsp9Kl72Dk7jRT7R+ZdD:HWBsN3xPlsp9yAk7B7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700657085, "uuid": "1183e6de-4cc3-4161-8f7d-4da914e3caae", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700657085, "uuid": "47f43151-8d7d-4eb9-a128-bfbf707e0a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657085, "uuid": "4832ea5b-49ed-4af7-9000-c16b5c59f0ad", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b306560-88de-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700619908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619908, "uuid": "963398de-4b70-4e03-977e-66febdb5926a", "comment": "Malware payload (DCRat)", "value": "5568aaefd654d72c32f052799324d7b6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619908, "uuid": "f3ed02d2-c652-4d6c-b6b3-2dd82ec26ba9", "comment": "Malware payload (DCRat)", "value": "e48ff6bb261fe68dceea2f13fe9cf2de12dbe0e5cd4e9c0db3f4c12107f483b6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619908, "uuid": "85a13029-05b3-48fa-8a2e-ed4ea915e20a", "comment": "Malware payload (DCRat)", "value": "108bd8bfaee0a1c57b8cc9860a20a6e6b5733b6e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700619908, "uuid": "34f36c57-773a-470f-918f-a600b342249e", "comment": "Malware payload (DCRat)", "value": "6007c01dcbde739604f629bd6cb96ce8aa560b3b39e7c33aafebd5782eae5eb24aa414ac4e82a970ebc3e916ac6d55e7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619908, "uuid": "c52e235a-b798-4b1c-b4e6-b5fb6a8b4749", "value": "T155C5C02A65924E72C3645732D167023E43D0D76A3512EF0B361F2082B957BF29EB67B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619908, "uuid": "ae069bbd-5683-4682-b241-683c258e9cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619908, "uuid": "a6f1752b-d10e-4d72-b52f-0a400818cad7", "value": "49152:lAr4YCy3CAbIl6Qd6RnxTeUJfYhf9knd8UE4/tCM3Hnm/m:lAdyALxTeSYhFknKUd/93mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700619908, "uuid": "051d4b1c-bbc2-48b1-aff8-29f8cb19cedc", "value": 2629120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700619908, "uuid": "cfe8287d-b66b-4a97-97ec-1d8a70012ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700619908, "uuid": "09a8d865-f59a-4638-86b2-629b91224371", "value": "5568AAEFD654D72C32F052799324D7B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc696138-8941-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662592, "uuid": "1e9f99f2-4dc7-40a7-9f49-a5763a8c633a", "comment": "Malware payload", "value": "71fd33b199315633dc232fa06c7e94a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662592, "uuid": "7ca2116a-0c02-4ed7-a39a-a1dcd9447a9f", "comment": "Malware payload", "value": "e49ad42b1f8c0cdfe8843ba366ff3edbf42c3e11bfb747a847e78230dfe8e202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662592, "uuid": "ae5bfc73-1dee-4c69-ae45-181be168e826", "comment": "Malware payload", "value": "cdef7d1016f8a058430d5f778a9e4de8760acc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662592, "uuid": "3e95d630-af56-4fdf-acf2-d6ff0282c7f1", "comment": "Malware payload", "value": "d024ca57aa88e3be97f328018af15efec33491466a2b9b3207f90b759cc06d14fc695f3218598e6b7b9b5014e7fcd8b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662592, "uuid": "16f12b8b-aa84-4b7f-bc8f-d3400481a354", "value": "T1FD145C117440C032D96320B325DB96BA5A3ABB604BA39DCF57480FBD9F352D2E631B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662592, "uuid": "6aa829b1-cfd1-474c-a877-b8e02d18c4ef", "value": "350b35fb26559a0cefa076761d2d1387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662592, "uuid": "abcb110e-1904-4d52-bb8f-bed313ea56b8", "value": "3072:fnCjOfbQ1rAQlOXObKqN42vMgc3vEdtFJo0VmDiCW3Jxr+avL0UA4jnibu/GiM1g:fnCGQV/OXOWxfpDiFPjy4jiu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662592, "uuid": "7836482e-8724-4880-8ebf-18473cd7655b", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662592, "uuid": "b959c331-9797-4e20-a402-944cfa6c7f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662592, "uuid": "f087b370-e28f-4eee-b20c-0f82e0b355b4", "value": "SecuriteInfo.com.Win32.PWSX-gen.32534.30778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216d20d2-8941-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700662332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662332, "uuid": "b32d121c-410b-4566-b309-d35aebf847a8", "comment": "Malware payload", "value": "624b5acb7edbe033ab0c0b4b56edcd35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662332, "uuid": "87766455-15c8-4258-b57c-84d6ba84991a", "comment": "Malware payload", "value": "e519e4b8c2bfb845e7c8bfe9fe4f96371c1f652d51f48f5919deb4b04a0113f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662332, "uuid": "62f788b2-71ef-40e5-835b-c9f8e90356a3", "comment": "Malware payload", "value": "b90deead6b7545dee5236bdf88ff250a18080c38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700662332, "uuid": "4d1640ac-592b-4692-8556-c87d68c975fe", "comment": "Malware payload", "value": "f204cd1be9179339f9e8ab47010132e3f54cb5b1e1b3b9b62e8c96af1c426d05aadfc6e3179bdf12657d5104bf833e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662332, "uuid": "2101d3e5-0e91-47ab-a679-cb6d807f9def", "value": "T1CFD4F102FAD684B2E5731D364929B720A97DB9301F24CA6FB7D44D6DCB31190A235BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662332, "uuid": "7b5044a6-443c-439a-a21c-256ac328ad16", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662332, "uuid": "93956f45-948f-4c6b-a6c8-9fdf3f05daae", "value": "12288:WcrNS33L10QdrXL1Tn3as9ebWOqGdEQGWLpH3qJ4Y:FNA3R5drXRT3a62HNGWl6J4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700662332, "uuid": "350f7231-8243-4af9-9a47-48303dc14455", "value": 627470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700662332, "uuid": "d68e71b8-49bc-4afa-81bb-15463e69a9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700662332, "uuid": "73bd62c1-f460-45e5-b555-575ac87b0d40", "value": "radhfifozdf_sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a7e0b9-8928-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700651704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651704, "uuid": "7ace97f1-c527-4887-812e-ad141edf1678", "comment": "Malware payload", "value": "47bed2dfeda62731541fbb1368e3390c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651704, "uuid": "20bec362-a67f-46fc-bf4e-8253da9627ae", "comment": "Malware payload", "value": "e59982d604d5291f603029cba5d5e18b95ee831e29f5dfe49950738b07d78652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651704, "uuid": "b28e2b69-f17d-4b62-8398-447c5a7c47e0", "comment": "Malware payload", "value": "190abdd2bd037bd57d90494fb113e621d2603724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700651704, "uuid": "b5c267a5-8b88-4aaa-9290-48a9840c7dd5", "comment": "Malware payload", "value": "2210d8421dba1b2d79a2655ea42d41071d453d085cdeb3a7fd6b4fee37584c431ca45904ad9fd9b980afe77f7bc7528c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651704, "uuid": "e18f1ef6-d364-460e-b870-b9eb28f44a5e", "value": "T17FD4231375195BE2D6B98BF3135662A693F8E61F4123EA064DC820FB397AB044B11F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651704, "uuid": "e5f71379-7e38-4957-b5f5-d0d57bc5cac6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651704, "uuid": "56bd3af0-c528-44c5-8837-67b03ba31986", "value": "12288:68oireksbPuHOYj4G+y5Bzc0ArLiCKMtfB2F35XGBHT7:tpoCHOB7yDWntfIF3xGBT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700651704, "uuid": "0254a789-577e-40c1-a897-4c9028204158", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700651704, "uuid": "23c9896d-4750-4f8d-ae07-4c914a3ad7b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700651704, "uuid": "4fb63d32-28ec-45ea-8b7c-80683c590d3a", "value": "SecuriteInfo.com.Win32.PWSX-gen.24053.23890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c87ddec-8913-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700642593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642593, "uuid": "46d65d1a-a6e5-4975-9f03-fb951326be05", "comment": "Malware payload", "value": "531284048b96eb3252faa9790471d5cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642593, "uuid": "89882573-fc7d-48ac-8d32-022a924acd14", "comment": "Malware payload", "value": "e615b9f34ec393fae457e9f65266bf3ccc63fb10bc7d80b6f9b07373a7ea3d20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642593, "uuid": "fd6dff35-53ab-418f-b1d3-4f331efd225d", "comment": "Malware payload", "value": "30f4627ae22acffcad0e4a47c7bc88411ad37846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700642593, "uuid": "95c1d428-ce15-4da6-bf9e-d5577f339370", "comment": "Malware payload", "value": "584e810f2bc5280cd01b65d5c11632f57d96c0dae475aafffbce8b9bca68e37f71ac4ccb497f5b8a248d508b5a8063f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642593, "uuid": "0fe77016-aee1-4d6c-8b7c-d02460348a82", "value": "T176D4122972FCAB26D9A217F61021215113F7B2BA7670F6370CC5B0EADE55B012E91F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642593, "uuid": "b8c109e1-87ff-453f-8779-650b96ba4453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642593, "uuid": "fe44cd6f-62b3-488f-b43d-ec3fb9ac25ce", "value": "12288:9jM1ELCkgjSCXqu+alDH5i6TbdofQ21WpSxn1hVkWKSdMM8:S1OCjOmquhj5i6TBoI2E01AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700642593, "uuid": "e8f097fe-ab1a-4b0c-8bcf-5317102e2897", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700642593, "uuid": "c42599c5-0fe0-4b5a-93c6-05189f7a3544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700642593, "uuid": "940ae13e-212b-4004-8d7e-2d1822c3f615", "value": "Al Adrak-RFQ-NOV-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e67a8dc-8922-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700649012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649012, "uuid": "4735fd9f-3d65-4bbb-9877-9024b9cc854a", "comment": "Malware payload (DCRat)", "value": "87a3818f4245b6f302305a2247fdbe05", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649012, "uuid": "7dbf5031-cef5-4fc8-9e40-75223b3bd4ef", "comment": "Malware payload (DCRat)", "value": "e6a9ba6b32b8bffc3b5b8107003960ecf142c380ec02c27b6e38a75f8e1b4ea9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649012, "uuid": "09040a8c-c0fe-4ef4-847c-5d355afc8720", "comment": "Malware payload (DCRat)", "value": "2bdbb2584614fcd6ee538fba5705d9627fc75065", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700649012, "uuid": "c2a78294-3fc2-4b71-bfae-b6f40c5d9f1b", "comment": "Malware payload (DCRat)", "value": "4826193fef42a71440ecdd77a2add961ee57a8b8fb94a3c541ca3cd33415ea3c3f802ede82abd49a5b584b1f28479876", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649012, "uuid": "b71eebd1-34ef-43f9-a0fb-7dc594a0f1b6", "value": "T16655333BBF32DA62D0C330BE52C40AE4C66DAB5A744E017D1C61949CB58A77C53CAED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649012, "uuid": "5a914d43-1a8b-4bd9-93d0-d14c5be5b185", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649012, "uuid": "24780c83-ba35-4d6f-a429-4bbe4a52c709", "value": "24576:7pwzYaxXltrMIeX3Sk8fwRxhn277R/V7r6GjciJRd+Kmsa3A0Nmo5lf9xQaARf/u:7pwzL1pMIeX3SkKwbIXnGGTHdWBA4f1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700649012, "uuid": "3639a902-b274-4e66-a909-52528336cb2b", "value": 1355072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700649012, "uuid": "0e2344d3-1c5d-4a1f-8511-273dd9a99a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700649012, "uuid": "9ed91bd1-8a9d-4fc7-b2f1-881a11845ca1", "value": "87A3818F4245B6F302305A2247FDBE05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347d9b77-890f-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700640889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640889, "uuid": "fa647c34-4919-4493-b806-6f0f03b005a3", "comment": "Malware payload (RiseProStealer)", "value": "ea9731885deeb2bc66fca0bde0e083ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640889, "uuid": "3a18f467-a777-4926-b6a0-a1539402205d", "comment": "Malware payload (RiseProStealer)", "value": "e7eaf2ac994cdaf678322b4cf43eb208864bffad189f4458e95ff05e842cd7f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640889, "uuid": "c106b26e-5001-4d6c-97a8-aa5486cee4de", "comment": "Malware payload (RiseProStealer)", "value": "862a6a64154dd92f7087298411647fe79a1b25f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700640889, "uuid": "45a2f180-3238-4c30-a0fe-83209d4133ad", "comment": "Malware payload (RiseProStealer)", "value": "5e9cd78128536ed827e271167ac61edeb644f524a870f751cb2395f857ae6d120128fbc732b49336d8b1e82f31eae4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640889, "uuid": "4e6e6d8c-a3ec-4644-9f1d-b1f7dfc9b7e8", "value": "T14A559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640889, "uuid": "b3b72f69-07e3-4966-ba74-7bb6214269ae", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640889, "uuid": "aab36e66-802e-44df-bec3-304edbc99739", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700640889, "uuid": "8453f94d-ebc3-4a4a-a87b-d6eec4725019", "value": 1322052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700640889, "uuid": "294b7e78-9538-4196-9569-8a8d37741cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700640889, "uuid": "a55ef02b-1cfd-4bd4-a409-5ccb0691c450", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c81782-8932-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700656029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656029, "uuid": "ea5f8e71-7dec-4db8-aa6c-8f7f8b2f2b0b", "comment": "Malware payload (AgentTesla)", "value": "56b4cb66ed9665c090be767ebc57501f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656029, "uuid": "27f292e2-9ae0-48c2-bdd9-7285562c5752", "comment": "Malware payload (AgentTesla)", "value": "e9f6338c12758d2ea59a1e8254756685736e7169cd4d92f6723783cc8e4ce1c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656029, "uuid": "8de65a05-0ef3-499a-971e-a8c9953e13b8", "comment": "Malware payload (AgentTesla)", "value": "b2eb09a26566b7f6d8145473a412a84e07d77ee7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656029, "uuid": "4ada46aa-18ef-401e-986d-bc452c33d9fb", "comment": "Malware payload (AgentTesla)", "value": "840eca0cbf78812fb7f9606f52ee2b153644da6a80019d55c4760dce65fccd8a84db26c839a835b36089887d649335ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656029, "uuid": "e02ea897-4701-40d1-ba68-37f934845343", "value": "T17AD4236EC3350C0309D647D93C8B4625D9D7E1A379AA68A63EF7C1F0EBB90153C943A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656029, "uuid": "92fa3ee0-e745-4593-84e1-77c4b10205a8", "value": "12288:uAvESsS5960iMGp4QJ+yIymTOnSQ+syCHRBKweLZeRFrf/Xm:PvESskTjyHm9SXKweVejf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656029, "uuid": "179d9895-7e4c-4273-aa20-8a5e0e594e57", "value": 623787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656029, "uuid": "83b86f95-3fc0-4917-bf2b-5548a6cb91f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656029, "uuid": "2c8e9daf-69d7-4568-8463-d86ca95987f6", "value": "swift copy pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ca67e5-8958-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700672400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672400, "uuid": "e84827d0-9f62-447e-8c34-19908622ff57", "comment": "Malware payload", "value": "e4f889daccfbfcbc94fdfc81f7d33ef0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672400, "uuid": "e23f9a6d-54e1-4541-b13d-b5cfe7a11311", "comment": "Malware payload", "value": "eb1a1ad8ff38faf9feca1895262405fbd5f3fea3cb4a38a2c0a6d4e1291d6354", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672400, "uuid": "6d98bff6-5212-4c0e-a646-1f5136dd1fb4", "comment": "Malware payload", "value": "f1e8f87ed18bcf5dc75fd926b9beef0dff8525d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700672400, "uuid": "0e3c6a53-cac0-4fb9-a979-0ffa7e9d3eac", "comment": "Malware payload", "value": "f3ebf6e11f1cd1c2a0d650028677a39588947196edbc07fd87eca3d62a63180c20c6450f10b4ed10d7bbd3230f314d96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672400, "uuid": "e3058423-ae99-47b8-b837-b442af89ee8d", "value": "T16CD31E08B46E922C82E9B3A6D77B4486D31AC9B6901CFD7173CECEAD675416C4B244F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672400, "uuid": "fb6d1693-a06b-4e6b-86a2-bce77019653a", "value": "768:JOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOSOS4:PrRXluqMqB7fZD6OTbKXHwiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700672400, "uuid": "e02c303e-e9db-4fa3-a16d-0d27cfa1f07c", "value": 139669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700672400, "uuid": "1a037108-0821-44fa-8799-18492ea5d15b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700672400, "uuid": "3e2680bf-34df-4487-8745-456899143eae", "value": "PURCHASE ORDER #4500082142.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8205d166-8904-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700636294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636294, "uuid": "1b1601f3-3ee0-4672-8584-7d82ff791122", "comment": "Malware payload (Formbook)", "value": "41216f4f728c1d95b35f7f7c24cec5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636294, "uuid": "d17ed662-fb79-4321-a081-4a7953ade254", "comment": "Malware payload (Formbook)", "value": "ecc081d22527f522ace5ca77d6991d355985b268f718e3ec60826d94dd8081d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636294, "uuid": "c80c1c37-bad4-49f3-bfb6-5caf413a9f6d", "comment": "Malware payload (Formbook)", "value": "f409658fb238aa2d08727a0479c7af6b3e4fd553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636294, "uuid": "17cdffc2-fcd7-4e0a-87d6-fe11568615c9", "comment": "Malware payload (Formbook)", "value": "9020545b8981e1e7909c3ce034e5fda38082132e81f9a975fb75c6ff46625c79e7051fe4cf851bd6387c902f802a13af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636294, "uuid": "46279058-a677-49b0-955b-0340de0be3c6", "value": "T1188412867DD21CD3CADA07710A61BE28D77E4D244031F60727A0ED5FCA72AD79F8A066", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636294, "uuid": "883ceb3b-b379-4520-894b-36de62d2dc2f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636294, "uuid": "26b8c6a6-e03b-4cbf-ad66-818466e83d26", "value": "6144:XBlL/H1PQmoMcWIeR/ERl6X3JB1iJLb/rVWGyu/QGgb9uZcNM:RF9QzlWdsr6X3JHALjpyu/hK9fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636294, "uuid": "36fb18d0-116a-4fa4-8531-fa7b99c7de49", "value": 371786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636294, "uuid": "197f2398-b323-4893-90a1-3fb843b8c748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636294, "uuid": "c312b667-1d5d-4a24-824d-8c780ec2fb68", "value": "PJS-4021339 IND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac3f579-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700638510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638510, "uuid": "507b2c0e-8bb0-45db-afaf-3c8e2f4fe860", "comment": "Malware payload (RedLineStealer)", "value": "01fd30c8e0f23a5bde5bf5a1a604a13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638510, "uuid": "0048a0a3-abd1-428c-af33-7efd5eaed5af", "comment": "Malware payload (RedLineStealer)", "value": "ece8239384da339ffd1ff0b8e9e0d2d875fffd9f62ce68d92c5c1f85740c960d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638510, "uuid": "15bd8663-d294-4e6f-974d-a02943249d63", "comment": "Malware payload (RedLineStealer)", "value": "96f2f671c41846fc0eed6818fea8a5a75b60a9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638510, "uuid": "868582d7-c745-4645-911a-7ff902486063", "comment": "Malware payload (RedLineStealer)", "value": "e7c7f87bf3d79a875202c22ebfc1e08b0f0e9487b5d661b62cd94bdef3f61f253f6cc65cb3d06a7e5ae2d011946da91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638510, "uuid": "934a5eb1-5fcd-4099-bc43-b117e31883bd", "value": "T16FC633CC6F9CE824DCFB57361DE695A11B687ED1136D8AB70AE4ED78B870B40442078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638510, "uuid": "aa79e85e-59a7-41ab-a101-902bf1951857", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638510, "uuid": "0784f55e-06e3-4915-bc6e-7e65fa46d1bb", "value": "196608:0WjyHgCDctSR60LEUPWamATzFleRnNqQhVeTWdM7X3HDa6nFfT:HrC445oU+rKFARnPIV7W6lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638510, "uuid": "893521c5-32c2-457b-bd06-2c4cb2db1309", "value": 11962368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638510, "uuid": "e12f6042-2428-4923-94b3-f60e7a0499d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638510, "uuid": "e7f65373-1ef3-4dd4-a880-ce01ef76c281", "value": "01fd30c8e0f23a5bde5bf5a1a604a13a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d27061a-88cc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700612181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612181, "uuid": "38380187-0691-4754-a069-de0355abb134", "comment": "Malware payload", "value": "047ffba81cfbde1ff8ef49a77c7699eb", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612181, "uuid": "7cff2ce7-7c08-44f7-af48-e6c167bbb1c6", "comment": "Malware payload", "value": "ed5d694d561c97b4d70efe934936286fe562addf7d6836f795b336d9791a5c44", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612181, "uuid": "7b0ff961-d901-4cb0-99dc-e47e0743d14b", "comment": "Malware payload", "value": "be9ecfa72e173799f350f5936b6b33bfcbf2f80b", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612181, "uuid": "832dcd92-c871-43c1-ade8-81bf52fa43c8", "comment": "Malware payload", "value": "61a3fca3c935f8b2202aa6667d3554114b71f4a06536c085efdc0d904ece1b221916932c63365f8a09abdf94b8823292", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612181, "uuid": "31d5f684-6e93-41fd-847a-b48103a89f44", "value": "T1AFC45B761AA7BCFD386C3D8094122E4D0E5C2F4B1264920AEFCC61FB736D9A48D1D976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612181, "uuid": "ff301186-41b7-413d-8d3d-0405bc68c349", "value": "6144:lnGNAxoPwXOQOMkX6Ui5EdNVglpclaaLzH3TGQDabcrCiRYpROpBanMJ8PdPukVI:1jfwNTgljWT5/pyI8PdtOXTlCqfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700612181, "uuid": "1fda9a23-33b3-4964-a9ec-73d8a391c2ea", "value": 571049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700612181, "uuid": "b9b557f1-ad27-4036-8ae2-2cd18b88d075", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612181, "uuid": "e340a09e-2006-4e5e-a115-4293f668b986", "value": "123.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8587564-896a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700680194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680194, "uuid": "20b15c87-b2d7-4137-9ff9-c33051f26821", "comment": "Malware payload", "value": "fb3e0284d5aaec5d3f28be1ae5fe3db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680194, "uuid": "64717d69-3649-438d-bc56-45ac2d082ac8", "comment": "Malware payload", "value": "eda1b61399b5eb51c1d39c093cc39f4587c59751ac8eab6fc8d57d2f58d7229f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680194, "uuid": "4195822f-5755-4539-b9c9-798fff648ce9", "comment": "Malware payload", "value": "d66734d139ee3ced3d20089a564027182815d4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700680194, "uuid": "5510bf43-767a-4c80-a7e2-445bb71fa085", "comment": "Malware payload", "value": "e4bfbdf4400054a586f339a9017639a21e724af99aba663fda786ae5a4d7d92e6caddaa1f7f1a08ad71d1f3827cbff16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680194, "uuid": "5d0cbff3-04a3-43bc-b88a-a79d0156de3e", "value": "T1D3447B1375D0FC62C75607708E2D96ECBBEEB8609E6887872714BF2B29302B1D667315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680194, "uuid": "3a3f1771-0c2b-4e54-8cab-e81a73d858b6", "value": "c368fa427f1f3f59d6f5623ae63cdace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680194, "uuid": "ea67a185-bb8b-41a9-b51c-5fe6d8c81c1f", "value": "3072:TRdpzcZiOfNfRiHmoDKW4S10OkK1MAMUR35taf7sep+72:V10NfWTKWj1emrR64eMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700680194, "uuid": "e1487f52-07ff-4fb4-b6b6-e187265ec9d1", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700680194, "uuid": "34ea0fa5-5b32-4183-8d64-e5e3dd202e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700680194, "uuid": "c81bc5b4-6a2d-4136-b231-fa28bbc354ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4963e6f3-8985-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700691605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691605, "uuid": "f2d5b11a-f6cb-4621-89a1-4817cbc4d1a9", "comment": "Malware payload", "value": "0d546c070d24fc673e397df12f20d221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691605, "uuid": "3ab84bf8-99d7-40a0-bce7-a4769b4c20b0", "comment": "Malware payload", "value": "ef74c4c21db18cfae6ef7ec3761c074d433f81945835613f0772c87c077cb137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691605, "uuid": "454f6323-7671-4583-8b8e-869d4382e6ce", "comment": "Malware payload", "value": "afd76c7cd0d61176faef5bec7e2c9b0fccd68b4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700691605, "uuid": "75149e23-ae35-4ca1-b8e7-fb20fdf0c1ef", "comment": "Malware payload", "value": "0d4c49d595fbeb8f389f507825988f724bae2de69a77ec7a90a6664aff3e31a63fc005f4c969d22778708753e0db7683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691605, "uuid": "514c1c8b-0d90-4b9f-aebd-d3f3ef2f34d3", "value": "T1B2446A0375D0FC21E45647784F2C86EC7B6EBCA2DE55CB4A27183E1AE9312B2DA67311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691605, "uuid": "2663a78e-755b-4691-b3a9-7e00d724e313", "value": "b1987f19009bd4af7032badc4f248687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691605, "uuid": "1dd56603-c88c-42ba-9fcc-01e6a607374e", "value": "3072:vwdS7GTWpu5cc2ScxIt/Q70p3vYr4yUkF5Nf/PEIPT:xzpuh2TItIQryUCf/Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700691605, "uuid": "d3f46060-c85e-4f5b-884d-2cfeb0cd5aa6", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700691605, "uuid": "c2bc3184-34a5-401f-8eca-c22754bf17a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700691605, "uuid": "aa70bbb8-a96d-4cca-ae23-9f3e45819f03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cad482-8904-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700636081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636081, "uuid": "62ef72ee-b3de-4c4f-bd7e-0f28e5ead2a3", "comment": "Malware payload", "value": "d5849fffa3151695103735145ab67cad", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636081, "uuid": "6eefb4af-f9f8-4d7d-8a2d-b176f2ea0fd2", "comment": "Malware payload", "value": "effe89cdc6bcb719693dbc64030c9c662c1fd7a08f399bf10794fa76a2f83584", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636081, "uuid": "70dd02e1-bca2-4e96-96de-6d91b426a534", "comment": "Malware payload", "value": "f7f168ecdc062ff457316863c5c71a3995ecb8a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700636081, "uuid": "88409bb1-81dd-488b-9a48-ee1977fd2550", "comment": "Malware payload", "value": "102f58251eb6a9f68405ccc1083ddcdcae725001b9b3993feb0a3f22c326aa22bd737f73180ef57b93c9a8a99d9dbd49", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636081, "uuid": "5655dfbc-1f7c-40df-971f-b5e7e43a91e6", "value": "T17A13D85884A467046CB807D86B7BF112BD2C1D670606D41074CFE386BFFA2B5699E8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636081, "uuid": "903ff5da-3791-4dbb-a5bc-3d5eca3b0ea8", "value": "768:v06Nn5YvD15b3mjNtUiDrtBbOrxox4Go0J:8gn5YDLDmbPDBBqlqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700636081, "uuid": "bdf07185-27a3-4ab5-9259-c8f4f8998332", "value": 42159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700636081, "uuid": "f334c797-80fb-42f3-a36c-e010873cf7c9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700636081, "uuid": "ae2543bc-d888-41d1-9cf0-2fd1ceda78d0", "value": "DHL AWB733988905AA.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee30e89c-88ed-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700626597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626597, "uuid": "f3143c10-db19-4ad9-a0cc-6cc35fc404b2", "comment": "Malware payload", "value": "f47f0b19aa1b7da2c0aada9c1ef4aafd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626597, "uuid": "aa9946cc-1212-428c-8d02-f471d3047c50", "comment": "Malware payload", "value": "f2de84e7165d6d0e8111cb65b54684944f6d822fcd2f6e3c362a7846b852e8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626597, "uuid": "e3bda779-ad7c-4e9c-bfb6-13524f974e11", "comment": "Malware payload", "value": "6bdb08f4a10500b5f40b5fe9593b9e2e85ce07d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700626597, "uuid": "6bc8b989-59c1-47fb-bb5f-9e2edf19c8b5", "comment": "Malware payload", "value": "43e0e4390b4fb0a761ec17cc8e48a28243970adf22912c43f7c4b8af30a2f047ab7076263a9fc68a6ca90d3707ab6992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626597, "uuid": "95de03eb-a502-4756-92b5-9bfd7c8a993f", "value": "T1BAD4235226984FE7C524DBFBD4AE46363BBD617A621087E16FD0215E047874CCE282EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626597, "uuid": "99e4cb83-a9f6-4720-be8e-10cdecbc131f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626597, "uuid": "ac67ed06-3f7e-48d8-bd8b-05eb8cd88a31", "value": "12288:nXVy8opV12SLsIHbflPFZ1dW6j3yxv9BLtIJ3rJIiBg6qTA+9+l:XVF2VUSwelPFH03Ltk3rKiKGo+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700626597, "uuid": "1196f000-f724-4ce8-8636-61c0df1466b6", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700626597, "uuid": "89d4db5d-04bb-44e4-bab9-00d8ee96d763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700626597, "uuid": "0069f48f-8239-4ceb-ae3e-297105fef957", "value": "SecuriteInfo.com.Win32.PWSX-gen.19646.4001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96a6264-8935-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700657460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657460, "uuid": "ded64cd3-6a02-4104-9c53-d1ed2e1d5a05", "comment": "Malware payload", "value": "4cc3010f2f28e24563bd74259edc7832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657460, "uuid": "e62020fc-9d8e-4f9b-97f4-720c1aba11b4", "comment": "Malware payload", "value": "f45c16ee78e67ad65da55328a02c7f51d82dbb8fb5acf3b01beb2518888f3e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657460, "uuid": "fceaf53e-bebb-4078-b264-d209c939cd7a", "comment": "Malware payload", "value": "72631b1d5c604765040370c515f8a3632b645852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700657460, "uuid": "eea214e0-c675-4df9-96a6-611b9f3a028e", "comment": "Malware payload", "value": "c245bcd85595ae9e77cf5e5ca8b1f55a96d767e33302ff005032c14a9e2936949ddf5290da851827800cf19cb0bd6be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657460, "uuid": "f55bc5b2-4a79-49d2-9b1e-507ac2429e31", "value": "T1BAD4123875BEAB31D5925BF98022240043F7722F2475E71F0DC6A0EA7A61F216E52F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657460, "uuid": "5cc365dc-b74f-4a90-b0f1-062e681010e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657460, "uuid": "7a2a43b7-efcf-4066-a468-a11ae4e35cff", "value": "12288:Dd1ELxFkPcRGqPfh/5GVOs06dQUywUJ9xQIUKFy2/RA7iVKYSb:R1OXkPcRG2/5GG6d4wUJPrFySR2EKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700657460, "uuid": "7163e451-c65b-44d5-aba7-7931a0ff9af3", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700657460, "uuid": "14a45c59-dde1-49f2-96e1-ede398bd76e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700657460, "uuid": "92fe8ab2-5dbf-44f9-a27a-06bc13c37405", "value": "INVOICE #901825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b8db42-8933-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700656682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656682, "uuid": "f8203050-ba89-450b-a859-2bfba89b232f", "comment": "Malware payload", "value": "3552f8d14cec9745f4771211e31fd7d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656682, "uuid": "b880d777-7c79-4e06-9547-b8a4c3ecc483", "comment": "Malware payload", "value": "f48d4751c1d4854d413853433eee7fc8eee1b93b26142ee5b1058b6f9de380c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656682, "uuid": "8dee91ee-f529-437a-9cdc-28298e312b20", "comment": "Malware payload", "value": "48d7c5d993b5275252963991605b0ca97f7510a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700656682, "uuid": "5a7155a2-cf23-40b0-bf06-4670dc2767b6", "comment": "Malware payload", "value": "0e05cf8225887a0783018f177fc977d0fe8a29ac1f29a06b512d3549e4d63ca5d0eee4091fee3de99ef9865dffeabf49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656682, "uuid": "b67f2c11-04f6-4ad6-9355-4b05463e4f20", "value": "T1587633099CC258A9D1C5B17D4ABA3EDD76BC1F15AD204ECEA824E7EBECB24FC0531911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656682, "uuid": "333b2bc0-49f3-4658-b5cd-1d27222d32c7", "value": "fc6c7ba36379ab21341ae85bc719b32f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656682, "uuid": "16cdbd66-f0f5-42e8-b39c-f841225dbf6a", "value": "196608:35++jbTSvuJ+MrT0rpPYOpN/Jyc7liXqoRzzvo:J++jbTrJ+M/wpNpNv74lzvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700656682, "uuid": "ee769a22-4ada-4aa0-a88a-a760d8a532e4", "value": 7285248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700656682, "uuid": "bf61afc2-116a-4303-a5ce-0c3c08ca5d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700656682, "uuid": "52b1ec33-2b23-4f1b-b5fb-64fac82dcc36", "value": "SecuriteInfo.com.Win32.DropperX-gen.15123.20851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed56d1d-8965-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700677950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677950, "uuid": "884a91c8-309f-473b-a633-7a4462f0cdf1", "comment": "Malware payload", "value": "42bc36d5debc21dff3559870ff300c4e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677950, "uuid": "2fbe1771-e079-4005-bd53-f5c06ef92923", "comment": "Malware payload", "value": "f4a7d9cdff19143a60cf4799d1b606b0d9ce64baacbd67fb1822e407bd1ea4d4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677950, "uuid": "9d4d9f41-5e30-4379-8a56-4e396a12c7fb", "comment": "Malware payload", "value": "0464c64f0665542b0c6a5684701da8a8e5c97603", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700677950, "uuid": "b6a41397-cc41-49f6-9c45-aa8ebfb6a4fa", "comment": "Malware payload", "value": "5d0d0d4ccee989f864e6e7a8bcd28aab712056f4f2c1755547c0d929f4745c53d6e3630735d3078ad916a2d5a18d5397", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "LitterDrifter", "colour": "#09C16A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677950, "uuid": "b1a4a668-a59c-405f-9a8e-e286e0d2d0bf", "value": "T1E9E37021B5D9015CF5B77E61BEE52469CE9BFA36361A582A40400F1F7B92E80CE8173F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677950, "uuid": "ccfba84b-724c-4331-a22c-106730d58399", "value": "1536:APhoxjUMqHgvEaVXiRLFlGfhXbrtjIY1C1GrdvOQ:Uolh92Grdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700677950, "uuid": "186bdde0-713d-4c65-af01-1bd466fcdad1", "value": 146030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700677950, "uuid": "918434fe-b66e-4cc9-8d93-f36a6b03a5af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700677950, "uuid": "c8e25b6f-eac2-4b1f-aef7-e3d2c676e3b7", "value": "trash.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d59c01-8930-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700655190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655190, "uuid": "2fa36f5b-9754-4287-b0bb-4615567df1c2", "comment": "Malware payload", "value": "36fa9fab229a6dbc592f59aa934dca1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655190, "uuid": "d0cbcb20-b4de-461c-8a5f-84475a2af41d", "comment": "Malware payload", "value": "f5ca82a3a112ef4040a39165c3784d5350a9b3276f4378163501e575a1b30b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655190, "uuid": "5cde136a-e0d2-47e0-a2cd-7d20a7ba80b3", "comment": "Malware payload", "value": "aa3141aa71f4c50a6b284bec33775634812fd771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700655190, "uuid": "0cffaa77-3a8a-4afa-b43f-7dbfdcd396ca", "comment": "Malware payload", "value": "8dc046dfd3afecc47127742ea01cb8430c89d96694ea35c6ad08ec931864cfec268c8c0c6e79e0f5d5108b0628d90325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655190, "uuid": "c9824973-f3c9-47e9-a2e9-fb33b3e8496e", "value": "T16F447B13A5D0FC31C47647309F2ED6EC7B2EBC619D68874B27183EAA29302B1DA67355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655190, "uuid": "598eed39-4033-4101-bab9-aa535154f639", "value": "3e5b3e84a4f6aca0aa8f7ccaa6917256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655190, "uuid": "95a90a90-df4a-4531-bbf3-ba89075402c9", "value": "3072:e3JgTZaTARmGzdH3t/HDIcHFnKrDuQKNcZfAKkWC915taRQe/0ep+I2:eC3xz5ZjIcHFKumZfAKkWCrEQZeML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700655190, "uuid": "2784e296-eb79-4aab-9bfa-a72c866e14c6", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700655190, "uuid": "d2e58455-2989-4561-a4a7-ea734926124a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700655190, "uuid": "e2a290a2-fff3-4629-a165-fd8619efd6d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c79e484-88f2-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700628608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628608, "uuid": "b204a1d2-aaa1-436e-9a71-0baf2f870f82", "comment": "Malware payload (RemcosRAT)", "value": "9afe732096be4fa9682e614f16b63b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628608, "uuid": "391ed5cc-6ce5-4c8b-8ce3-163ecfe35d23", "comment": "Malware payload (RemcosRAT)", "value": "f5d82956ceca26f10317df7cfbfacfe99d3854b8aa3fea507e28676f6a6cd9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628608, "uuid": "974cb4d0-af4d-4886-b883-3e66dc01f160", "comment": "Malware payload (RemcosRAT)", "value": "4b15fd8591b4beaecfaf757282dad4ca2bba5ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700628608, "uuid": "a90e680a-5a4e-4308-987c-2d46f53b622d", "comment": "Malware payload (RemcosRAT)", "value": "47b7ae31b872c4ff6cad489da52c1a5b664b550ce4afd344d87c34db0a9d17b61b34146909c106680d7a44f8fbaa59bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628608, "uuid": "b8bbd1cc-2fc7-4671-ba5f-8a7df9009dc8", "value": "T12FB423F627F98E40D75302B7754B1A059A79D4A7C4498BE7E8CCB33D9A2A3DC0488BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628608, "uuid": "e68f02a6-9fb7-456f-b1e8-fd1cad071dfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628608, "uuid": "4159ba8d-6603-4b98-a806-5459689260d7", "value": "12288:JFgT0Buwqth2tSCg/a5jrsAfK1CX11c6+Sznd:JWTfCTSa5jr5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700628608, "uuid": "1da76069-171e-4c60-9b50-d1eb83e942a2", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700628608, "uuid": "b36ecd78-2f6f-4678-b2cd-7f6b6a82202b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700628608, "uuid": "12872d18-05f8-4cda-a561-5c7923b00044", "value": "DHL Overdue Account Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b393c7f-88d9-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700617734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700617734, "uuid": "ce60e453-218d-47d7-a72b-c2a47d8b5987", "comment": "Malware payload (RiseProStealer)", "value": "0a3298257b2f2c02ed5bfc2941f6b2dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700617734, "uuid": "e65b39db-a599-42a5-83b8-50aaf0737c75", "comment": "Malware payload (RiseProStealer)", "value": "f69efb381506e724d2a8ca742900d2e62210ae4a9214cf04e2f8385552a11c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700617734, "uuid": "1e7e4f81-59fb-4083-89ad-5ae043542a81", "comment": "Malware payload (RiseProStealer)", "value": "e350ac73bc9cc3c971c7fec42810b111a963fbed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700617734, "uuid": "bd48f033-3c55-4fed-875b-3e48ac5a617c", "comment": "Malware payload (RiseProStealer)", "value": "b7c236433f379d9fbde51f8311cee797e22c80d0dfad8f6bfcc13d88dbb2f37803a47233d8b5ea40760ce2db0a9282d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700617734, "uuid": "860d83fa-ae3c-48ae-b66f-49ccd107716a", "value": "T14A559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700617734, "uuid": "b04b9479-2a1e-4222-ae10-c6e90bfc1402", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700617734, "uuid": "2465e9e3-a651-44b9-9d1a-852c5ea1be1c", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700617734, "uuid": "d6c8f65f-3b21-4876-a505-3293c67f2870", "value": 1321993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700617734, "uuid": "952e2e65-a7bc-455c-9ecc-5cf2aa58949b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700617734, "uuid": "0c222e63-f596-4372-b377-9dc5ea238e7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f301c8-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638589, "uuid": "3453f5fc-c5fc-470c-ba03-a1561bb7a182", "comment": "Malware payload (Mirai)", "value": "8ce816ea630a08147e6c7bb7451d2db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638589, "uuid": "ace619b2-fdff-4665-8e62-15343471fc8e", "comment": "Malware payload (Mirai)", "value": "f73e3da5b7c94daaa3bd7dcead7c16d84f63f8c61ecf4616ad8dddea16944ce7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638589, "uuid": "41155ea0-21cb-4e33-8bd3-883109edbff2", "comment": "Malware payload (Mirai)", "value": "149cdc15cd821c9b203ed8231484c47238cce91d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638589, "uuid": "b959d52f-65ef-4e7a-853e-0d1b94d95ae6", "comment": "Malware payload (Mirai)", "value": "ce3eeb94bfa17ab90224ce79990df8c7cc85017a1bff7d37642d305b612f1d278d8a16b02d676bf9c14a512205327bc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638589, "uuid": "fe5345ee-ff44-4c04-8e40-8f1e51664c83", "value": "T144830A95BC818A11C5D413BAF92E018E332267E8E3DFB2169D205F2477CA92F0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638589, "uuid": "83b34995-1197-4f4e-90a2-b8baff4336a3", "value": "1536:aUnnPM9miB3/SfboltisGSEILicNG6G1X0Rw6y5zpZ51Lhuc6BIbiQaUDGWbEfI:O9NjtfzEILiMFGVlbZbaUDGWbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638589, "uuid": "ee997682-935d-4c04-92ca-78063abd9495", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638589, "uuid": "6a4523d0-edd2-4e08-a4b3-699d14c9e8dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638589, "uuid": "46b828a0-d5ba-4c88-a9f2-3fd599d71a4b", "value": "8ce816ea630a08147e6c7bb7451d2db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e9e97f-8972-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700683727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683727, "uuid": "a268859f-8876-45ed-a0cc-5735f01fb3e3", "comment": "Malware payload", "value": "6007182d20ef0b7744623ba8cf32bb5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683727, "uuid": "b2fa898f-6ade-4485-baac-91798f5c7060", "comment": "Malware payload", "value": "f90d6b1d57aa25effd10bfff611d754196e2244df30a2da41a2ba56eed8d9bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683727, "uuid": "a7a93b46-fbc8-40f2-afb8-9b6949817394", "comment": "Malware payload", "value": "10c89fda4bcf56a9c694615f18e809f31fb225f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700683727, "uuid": "6cf80634-29c7-4c3c-8a18-69f53ef9493d", "comment": "Malware payload", "value": "b6a06d954a79fef05b5e47e979336238b86b44d404ce2278c3e524a293d8b201f837eac89f2c55e0a6894d105ab2af09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683727, "uuid": "721db9bd-6eed-41a8-8edf-b741eda488da", "value": "T13A35F15BF2596BB0D83A5BF9643745200B739D3E61E8E5AC1CC9B4E714BA7320872D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683727, "uuid": "bc65686d-c309-48c1-b416-06492c5e4b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683727, "uuid": "029b77ed-dc47-4792-a7cb-50d325231ddf", "value": "24576:tIJNidg+LPV8fjIPbn66/dvhCAd9YqBg3Zg39:tIJQW+LPmjUvv3YqBgpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700683727, "uuid": "023ffc30-46fe-481e-904d-5e549763eac5", "value": 1137152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700683727, "uuid": "c000304d-612e-4c7f-a80e-8ca5129eb599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700683727, "uuid": "31f7e912-6d75-419c-beb9-fac21257f3f9", "value": "ordref_bomyogeshd_20112023165922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99307832-893d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700660815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660815, "uuid": "8baa28b7-567a-4dc6-a3a9-964169cf006a", "comment": "Malware payload (Formbook)", "value": "4e21d61cbdd2e1a5312e34a73d6cb5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660815, "uuid": "971bcffe-b185-4e40-9bd8-f2ef6f442243", "comment": "Malware payload (Formbook)", "value": "fa2c88f99a6730657c40165e33846ad3b90c462cadf9670ead80b2fda9e36584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660815, "uuid": "7e5bf826-1b10-49d4-9913-87a4df5894e7", "comment": "Malware payload (Formbook)", "value": "890f1afec30b9d33ea7c2b1df180231cee5306fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700660815, "uuid": "da854e3f-3e8f-4b99-ab66-971dfc8305ed", "comment": "Malware payload (Formbook)", "value": "46bab43c47459f4002cd774f9a652949fa2da79f6ffa3efbf123627690d87336ffab946d6be5a4d5000486027c509c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660815, "uuid": "ed646c50-742d-4519-bce5-2a05d7f94a27", "value": "T168E412B933FD6772EAB567F62469111043F1726E6530F2662CC660E2FAA0B251E40F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660815, "uuid": "008fa32f-2f0c-4c22-a665-4ff5d4a14de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660815, "uuid": "80d25119-c9b5-4d8b-9fea-8d78fbeafc45", "value": "12288:Mwj1EL2RMn7CiSfhwl5tfZuZ50u2DZdhoFFmpTKWytwb5F7QM/9d2Q9M:31O2RiDPTt3u2DZSFLw5xQ7QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700660815, "uuid": "d09aec0b-8ee8-4d65-bef1-41768b5efaf7", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700660815, "uuid": "f03e1118-34c5-4274-940c-48340fc5cc61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700660815, "uuid": "e0c85d77-8732-42ba-8889-2fa15cbd5c87", "value": "z58CurriculumVitaeSilviaMHelena.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf8202a-8983-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700690991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690991, "uuid": "da12191f-22af-472c-a2eb-f53f7bfff0bc", "comment": "Malware payload", "value": "55a409c02f019b779c6038856c7c1bdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690991, "uuid": "45bb3227-3627-400e-ad60-8cc7c0f5f905", "comment": "Malware payload", "value": "facc892bab57ba7b10fa2c6170577f45137ab714b4a0622187344e86dde0dac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690991, "uuid": "6a176bf6-a0e1-4310-8fcc-a6b77a87872c", "comment": "Malware payload", "value": "a66e697c962300f9c6486f6456617817c24dc67a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700690991, "uuid": "540b3307-d465-4f3c-80e6-00b38aac42e9", "comment": "Malware payload", "value": "1dfa351cb80c8caf7eb07818b7972059bfabd7133d8d3c6bce23c5435bdf2cbc00dc295dfa78233d161f2676b19fc188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690991, "uuid": "9c4733ef-e1d9-458a-bf83-e6f1cb97abf8", "value": "T104A47DDCF6C0F421D0B6C077846F5218D4974868AB070AFB5DA2E0AD17A09E2FABF5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690991, "uuid": "b30d75e5-f3ac-430f-b0fb-23e2fe0f725f", "value": "2232400340dcc019ce7beca49d252453", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690991, "uuid": "059b1e47-0d99-4544-8724-786689570a1e", "value": "12288:fdQ5w1rLeeTkJ7fAYb51mEWPE89T8ya5ANe:1B2751mFQyBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700690991, "uuid": "dbcb7651-af15-4649-b61b-34552ff5b771", "value": 449595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700690991, "uuid": "2998d8af-6ae5-4570-88d0-ff881a71df06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700690991, "uuid": "e32964be-6d81-411a-83d6-ac72100b167a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237757fc-8943-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700663194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663194, "uuid": "d2522758-49d2-410f-bac7-c0e593d56135", "comment": "Malware payload (AgentTesla)", "value": "fd1a3f36b3d42f8ba70b7743436f4fa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663194, "uuid": "8e667638-72c3-42bc-b083-432a5d54458f", "comment": "Malware payload (AgentTesla)", "value": "fb8142d85bdf16d1a9a6951ab543d5430cead7eb7139ade188136d9a3aa87eee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663194, "uuid": "3bc50ae9-c88e-418a-8314-1f5c7e8ddd21", "comment": "Malware payload (AgentTesla)", "value": "858061ec177e911342fd8b42a30298f86ade545c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700663194, "uuid": "8ddc539f-53e4-4131-b311-2d48cd4ee174", "comment": "Malware payload (AgentTesla)", "value": "2d105166b73244cbf31f794a0dd7d40e691743ec2c2de1b69a16b50d6eb4afad3c2611e754664ff08441c5f2628fda43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663194, "uuid": "c2c859d1-817e-4e9e-86a5-bae6abddf1bd", "value": "T13C5502223364582BD16C06F8A462518057B2EE13B1A1E75D2DEFBFDE1BB374257027A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663194, "uuid": "40ec43c3-d6ff-4778-bf97-94b445f23a2f", "value": "12288:2rhLlfFPlJzO4yJ6S72+UKQBuGaghq/gklfNnJE:qhpCD79OBuGatL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700663194, "uuid": "584a122d-86de-40b4-a4ed-de29ff95ebac", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700663194, "uuid": "347afaad-86d8-44c6-91be-afcbb2947779", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700663194, "uuid": "98aec76d-9c62-447d-9779-a1572c46e63a", "value": "nINV INVOICE 09348576859432.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58db391-8909-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700638582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638582, "uuid": "f8327109-7431-4517-b915-6ad8b66aa51a", "comment": "Malware payload (Mirai)", "value": "8db116494997ce00f61ceabda007e37e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638582, "uuid": "6d750309-1c59-41f9-8551-c46bbe31478c", "comment": "Malware payload (Mirai)", "value": "fcd27f31ae3f84e689beb1bf2bdda4a0f59ae2b2a514887c72feb8f705b9f5ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638582, "uuid": "fa5aeea4-8ac0-4313-bd83-815c1156e53b", "comment": "Malware payload (Mirai)", "value": "a93106957e9843a25c599b21d02784de81524f78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700638582, "uuid": "36d7de7a-9d8e-44f8-95fc-3fd4997d6100", "comment": "Malware payload (Mirai)", "value": "53dd42289e3fed89502d522d20c0d88ebb841dbcb355721a3615ea8c4d81a4f4b0cc5d82fccd43eaa0aa6c6a42eef076", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638582, "uuid": "4ab55e6e-2bda-4b56-b989-d432956e0108", "value": "T146A3D60ABF350FF7D86BDD3709A92B06198C550A22E97B367930C858F64B21F19E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638582, "uuid": "7be8ecc7-ba94-4a76-bca2-080effa41983", "value": "1536:5kkhyTy3yryaiNLVeMoWpIxqzj8DmoixIINZTBuBZD2wvxzwsnx:5kQ0UMKJCWsojcIXuBBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700638582, "uuid": "b0cda0b6-a7f2-4dcc-98ce-0e7c0bc92813", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700638582, "uuid": "50fce0ba-7ddb-424f-90e0-3e2f6761d1f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700638582, "uuid": "36327a3a-a96f-4af9-a12a-83dff047cd96", "value": "8db116494997ce00f61ceabda007e37e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58932aed-8910-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700641379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641379, "uuid": "dfcf3529-3b9b-4852-964b-acb99f143b21", "comment": "Malware payload", "value": "e3894ac7df0bd66dc1a178c5e0513411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641379, "uuid": "764f23ef-f8bc-477e-a860-72b6ac906e88", "comment": "Malware payload", "value": "fd787202cfb815a07775e5a12a87a8cec0736207ad3b27aadadb3c7eac245070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641379, "uuid": "c4c0671e-f4bd-4816-a04e-51ba548dd547", "comment": "Malware payload", "value": "9434e7a6678947d0005c68db44ce3a8f68610de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700641379, "uuid": "6fa2d269-29d0-4eed-ae87-0f978b3ab146", "comment": "Malware payload", "value": "ab588bcb42f29265f0c232fa49c550bda50011fd65169043e72b35069b62d2e032375e305dec315250ad23327c481443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641379, "uuid": "0c6c2d94-e1ba-45f8-88be-ce9f25061a0b", "value": "T14B546B0365D0EF71C89603308E3D96EC7B6EB8224D65974736783E6B79303A2E667316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641379, "uuid": "aa210df3-b339-4003-8466-50974ed34d33", "value": "c001cbd1a4a4c74d1eb06d60e4b8b11c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641379, "uuid": "d32a9477-9034-4cf7-bcfd-a754bff2021e", "value": "6144:pskaAY1V0wqAyBURhYbf6DRox5b8XK5TSL4xm:C/AY1VNqfYKUg5+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700641379, "uuid": "0c18e6a5-48cd-41fc-b0e1-affbb582eba6", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700641379, "uuid": "17e91e75-9dcf-4743-8b7e-7fa73758a56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700641379, "uuid": "84171032-c9ce-4e0a-b14a-22ff732ec881", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975ae84a-8926-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700650933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650933, "uuid": "40a88cff-c92d-4f34-93c9-4007bd132156", "comment": "Malware payload", "value": "7e691e832d22b8fe3839376f434feede", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650933, "uuid": "48ad10df-7639-4b26-bb55-a73128a8b231", "comment": "Malware payload", "value": "fe03c3c1a411a00eaa4e94b06d1126abcdcfe0db368fa8516b367fff776b1d9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650933, "uuid": "a004d8ad-521e-4bb1-a19f-bc6e97158a18", "comment": "Malware payload", "value": "7b199042b71949a983a17a99890e0fd3eff1a3ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700650933, "uuid": "aa0e0606-e1e6-43a3-98ba-c059540116cb", "comment": "Malware payload", "value": "520f7faaa15d5263155dee7c6bae66fde7ccb62be77385e29071367717886dd107089f0af9d8b979b465d4ec2374be3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650933, "uuid": "44c72b51-54aa-46d8-a275-3c2dfe68bbd5", "value": "T117E423B8D82F1101574B821E30AABC7558295D0BC67BC7EE66FBB40C2F36E469D7924C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650933, "uuid": "c489336f-a799-41e5-83cb-f0f9e27350b9", "value": "12288:Vs7UWDzwnv6JEkIzF4mQfxQEuTS3f1ZU80glBJV2KhEBE2HR3iPfhzS9DA:4D8v6+jFtkxB3flB37OBjYPfZGDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700650933, "uuid": "d1fa9dc0-df3b-42b3-ae3f-a547b79f6061", "value": 661540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700650933, "uuid": "cba4a413-50ce-4603-ab90-47e9ddc1ad90", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700650933, "uuid": "0784a5ae-728b-4201-8766-a076fcc259b4", "value": "proof of payment.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde3b52c-8975-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700684928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684928, "uuid": "a1fa6c13-0496-48e0-b96c-220610bd47ef", "comment": "Malware payload", "value": "19ece561bf10e338892e41aae6d7b80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684928, "uuid": "7d37c171-3cac-4182-850e-67b55421486b", "comment": "Malware payload", "value": "fe2a22e0262eff4f01823581009b74960783493d459156dfe00054af0962b9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684928, "uuid": "3220fa5b-ad2c-4d99-b71f-f042311a0193", "comment": "Malware payload", "value": "6f67c5913e99ec769b9ddc46b6013f523424d220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700684928, "uuid": "6dd8787e-157e-4a53-a18b-8073ab9a52bc", "comment": "Malware payload", "value": "da8720eec7265ecb5c73af3fdf1666ee578c5811b9b9201ece90b1c420685785a1a7d2d5f86dfa7fc18e4bab0c6dd75d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684928, "uuid": "fff9017f-a4e4-4704-b9a6-c1e4dfed1bfe", "value": "T14A45E11E37772172D1A792710A9DA01E82742E883D73F3E9BE198241C3FB5D6179EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684928, "uuid": "c6bd2353-967d-493b-821c-c7253f2edc07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684928, "uuid": "92574528-fd09-4105-a729-e157f5db7493", "value": "24576:D8F2bFS2TKDbqI4a74ZZqI1sj59piLkG6qCxaGVQwTxP82gp:DF0bpI1sD72CQY1gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700684928, "uuid": "ab2d4887-b1b0-40a2-abb3-f2adc8c41862", "value": 1236880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700684928, "uuid": "1a1a5586-a859-4ff1-a3a1-0a070a3b02e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700684928, "uuid": "290c3423-7b85-4ebc-8a64-eeb437985801", "value": "SecuriteInfo.com.Win32.PWSX-gen.27953.18773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6910704-88cc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700612304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612304, "uuid": "c44c9076-b14c-46c6-a50c-1ce44e390f3e", "comment": "Malware payload", "value": "f038a947a04fe5364700831f3e0da573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612304, "uuid": "0f360d6a-aa68-4f14-a556-fd37e2661db5", "comment": "Malware payload", "value": "fe2b3415794cd8ccb9ee4b28925f88c6815af95ccb14f58ac756210e9ad2d205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612304, "uuid": "9210d02b-c02a-4c56-974b-434c9575643d", "comment": "Malware payload", "value": "2a8bb8fbdbebce41b98dfddee68337a29893de60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700612304, "uuid": "3033a0fe-dbb8-4418-a7cc-fc0b628fa02c", "comment": "Malware payload", "value": "706b418eb3172e04e32bc9b2868360da1c49e5eca0cad4e2b635961839f2e1a459ef6afc73c28fc4d4942139b8779371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612304, "uuid": "4a76ae57-06f5-4886-9f5b-9fa4c28b2cc1", "value": "T170446D1253A17861E6134E728E2AC6F7661DFB518F15E6AB2324EA2F09711F1CF63F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612304, "uuid": "4f0e9e8f-55ef-4b93-b9c0-fd3b7278a31b", "value": "edffd74b291a0c850c46a44e0038abd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612304, "uuid": "c9f13e3d-70b8-47a5-b2dd-546722b6483d", "value": "3072:GcoEhFxJNsMnwzN77vK5if6XWhgnv2hJRnQg1IFlmmg0P/5DP6cPB:t9bDsCwB77C5iAWh6v2lQQIFFRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700612304, "uuid": "1e888e43-b916-4ce6-9c70-98ec69383ca8", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700612304, "uuid": "d67f6dc7-de5f-438e-96f1-fb8e15e3fb36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700612304, "uuid": "df356e6e-17bc-423a-9e43-45f15ff5b8a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c43b680-891d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700647049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647049, "uuid": "6aa013cc-457d-4753-ae25-c6686e928615", "comment": "Malware payload (Mirai)", "value": "e891ffb57811b50be1480ff47a8c805b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647049, "uuid": "10c27718-4fcf-41c2-8ab0-c9390142f8be", "comment": "Malware payload (Mirai)", "value": "ff8056228dba85e2050045772c22abce6d62eab3f8dcb0e49a1679f8a1ca2853", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647049, "uuid": "4dad8e62-1ac5-4139-a4ad-c65a3a49e568", "comment": "Malware payload (Mirai)", "value": "6b3518eda9a1af0b461d8794b057c005bf1baa1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700647049, "uuid": "ce8b0430-deb4-4e59-b007-10b7bd28a10e", "comment": "Malware payload (Mirai)", "value": "f6226ef97f56742311347c1811d80470f87b2907dfd14b5c0f561205d5e5dca21bd3b14c44011352dad2b95de40ccdc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647049, "uuid": "62efcbde-94dd-45b1-a1d0-28f6710427c2", "value": "T1AA533B99F4029E3DF88FE9BA84160E05B93023D212931B2767AEFDE37D321659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647049, "uuid": "6a0f1309-3fe9-4f92-9651-edc704a738ec", "value": "768:me4gpsM204GEkRbj3eXf/nQi122EQtBa3gFHn1eu48B8vB6J7EzNfXQuJpozby3T:mo3EkRbrQoizRFn1X48B2SEzNfAuJfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700647049, "uuid": "c72100ae-a68f-429d-b363-a97199bafa6a", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700647049, "uuid": "41df96c4-0767-45c3-8f8e-11aab8172a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700647049, "uuid": "e4aed4cf-dd14-4810-830d-88057b8602d7", "value": "e891ffb57811b50be1480ff47a8c805b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }