{ "Event": { "published": true, "date": "2023-12-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-28", "timestamp": 1703808181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3cec9c5a-cc28-401d-8d15-999de6747434", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abc0e42-a5a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703781916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781916, "uuid": "237954e4-cd2f-4b82-b041-e336fe669632", "comment": "Malware payload (Mirai)", "value": "5524393a1710bcc7a83ff5a68320c841", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781916, "uuid": "e4406223-322e-4681-a508-45c05af439bf", "comment": "Malware payload (Mirai)", "value": "018b547f5039a82dc94ad79c04a5bb9135402ff983286ab16a8a7c7f5734cf53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781916, "uuid": "c645a656-0cda-481f-b993-0c4bb5ddfd49", "comment": "Malware payload (Mirai)", "value": "db5622bd236850289e57ff7444959ef66381f302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781916, "uuid": "0ea3d5e3-4a2f-4151-82ce-09bb2927171d", "comment": "Malware payload (Mirai)", "value": "01847b73e2f40cae502bf657019aeddc5c471cd24be61653c9c367c7c08db893499566debe9ea927f431e3f43815d6c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781916, "uuid": "7f968e6f-7bb6-40b5-b07a-1931eedae62b", "value": "T14BB2D0FFE2843C9DC96D8D7A619E03B12F887152339E4F8893254ED17421C87EC8A0E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781916, "uuid": "69ad0bc7-b19b-48ab-9bdf-e09ffebc7663", "value": "384:6evSM14YsqkEJ6B4jVwU3oKjVLbPAvqiSVBHSpLZKt4kdRWGVCz0Nvnx:6evl14Bqk8wU1LiqVByDKtvrWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781916, "uuid": "c323cd8a-4385-4375-9a08-6c77711a9136", "value": 24524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781916, "uuid": "a429415c-6a37-4149-ba57-8cf9cabed6ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781916, "uuid": "f3b15d96-4fa3-4e39-a7bb-e0b1ba5923bb", "value": "5524393a1710bcc7a83ff5a68320c841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ff456e-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805470, "uuid": "1ce1b5d9-61a0-4812-a23b-15449fe11db0", "comment": "Malware payload", "value": "1995433a2a019dacf9fdaf61ed46e8e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805470, "uuid": "5c5d03bc-5a84-4d53-980f-f537754e7fd6", "comment": "Malware payload", "value": "01c409baeb9610b294033e5b8799dacaaed4dd879877c181c84ea8971aa19299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805470, "uuid": "1a660d77-818e-4a86-a127-30017bc98ea6", "comment": "Malware payload", "value": "f424f992c4228169fc0679fc54dea953a2fdd9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805470, "uuid": "42589c6d-dd21-426c-9fbf-e52e2825a1c4", "comment": "Malware payload", "value": "e1d458c5d0d361a1810bf72e3cbb443271ef7048cfccf679f280fe96fa1f2cc184c4ced1e7ed4b2a6dd19e00d942860f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805470, "uuid": "eb1ed3ba-310c-4b57-8e8e-528a35c22170", "value": "T1F2459E16F2C6C0D6C782233402675B369E7AEE4A3735DBDF5218EA685F334B1A632315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805470, "uuid": "ac25d623-ff26-409b-a4a8-75419ee9d134", "value": "12288:mS8L81OVwkvwt1dnCIbYdtizYiOleWTbKmI8ny49Hqg2bigvc2yG3su:myOukvwtfnCIbYdtiz/enI+y4xmbYG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805470, "uuid": "b6167a8d-5697-4566-8122-84dfcca7762b", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805470, "uuid": "e451e5b7-d111-429e-bc14-048d3c2288a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805470, "uuid": "6e741e11-ef73-4ffe-abd7-3ab7bb46a07e", "value": "SecuriteInfo.com.Win32.Trojan.PSE.13QEMZB.5133.2696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ed820a-a582-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703768839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768839, "uuid": "0937386a-1f91-4767-b26c-92a87d52cd23", "comment": "Malware payload (AgentTesla)", "value": "8733ccfa5f216a3719521711899a667a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768839, "uuid": "afd1898c-14e1-40e1-a4a0-1aca3901d3a7", "comment": "Malware payload (AgentTesla)", "value": "042a7c109c5b7465acba0dda0ef8b3bb8b5737085b7e1581ef164bca7f4426d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768839, "uuid": "ad81fe41-5a4e-402d-8713-1ad1f6498663", "comment": "Malware payload (AgentTesla)", "value": "bd28922d6fa5a57dd134fb9b00210eb49e1a9b9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768839, "uuid": "1d9ec506-e8e1-4eea-ae4a-326bd998a6e3", "comment": "Malware payload (AgentTesla)", "value": "0a378562b23d8ae7259e258e126d4ee656d36cb135bde164e7a99e2de7fbd773fbc99c7b8a0b38c4964d814e3f53a959", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768839, "uuid": "74f9e370-32bc-4a6e-a600-1cb51b2c45bd", "value": "T12F65D43F5BBB192BCD76C2B5C7F48467B313D46B3111AA695AC6DF950302B8228C325E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768839, "uuid": "02678c2f-9e7f-464e-ba5b-b4a3a87f7615", "value": "12288:odKxnV/AyG2iNuOUd7LAGaE0tj79rcaxBdTq20GTnB9V1TjMj5FxS:odKj/w16ZAGkZ9rcandTqwTnB9VpMj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703768839, "uuid": "da25b0ee-bc02-4d9b-a11d-d1168f012037", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703768839, "uuid": "a3f7134e-7197-4740-b3be-3d26afe561b3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768839, "uuid": "4fdb8c76-d89c-45eb-b810-6ff9901f456f", "value": "nShipping Receipt.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72aa26cd-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805525, "uuid": "8748ff69-266b-4881-80d8-27a76d8ef8c9", "comment": "Malware payload", "value": "73930e01cf83812b29e8fda202762344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805525, "uuid": "6dab3dfd-a4cb-410a-a275-f0270dc032bb", "comment": "Malware payload", "value": "06babbe568161c9f78412d6cc1977c6dd793e01aa801bf000fb8959dd52d2f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805525, "uuid": "3068f18a-daba-4ba9-9eb0-db5e33b87e46", "comment": "Malware payload", "value": "85e08ca1de2c52777c61890364e74d7af336027e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805525, "uuid": "04fb9ab2-ca0b-430d-8e76-86f78cd06f84", "comment": "Malware payload", "value": "d8fe9b7c7e96bb613e52f5347d975443f782ec56e35c7e46b095c7847e18431cb6d0278405a9d3778e74f6e69f6f64e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805525, "uuid": "2d3aaf91-9b5f-490c-811b-01de4e98fde0", "value": "T138E35C23F1D08C72D1B11A789C1AA1E9943EFE212C28155B77EC3E4D6D392C1A99D3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805525, "uuid": "0a8748f0-bbda-4a2c-8a9a-95dc812c6eb2", "value": "3072:vqqY9VusGMtHmrJpP2YAwsC3gDjzBNsciEuah/wsq9:PYW5MtkSYLsoRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805525, "uuid": "4f23af09-f3ee-4e83-86a0-a9b3c9fd1902", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805525, "uuid": "c842f45b-b5aa-4dca-a5f2-e185bfb160c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805525, "uuid": "1449f5f3-4a08-4729-8027-61b46304569e", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.27021.7672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a1d111-a5a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703781901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781901, "uuid": "c67666f4-e1ec-4ac5-ac16-09acd2991d01", "comment": "Malware payload (Mirai)", "value": "c5bc7d44bf57423494aa365d245787a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781901, "uuid": "55dd2da8-4ea8-4f70-a4ee-8b40e71b24f6", "comment": "Malware payload (Mirai)", "value": "074f3434587060708c47746b4b0189c89d3f9366baa1457c716d9392ab7cbce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781901, "uuid": "c77dfd9a-9241-40a0-be2e-980a28e051cb", "comment": "Malware payload (Mirai)", "value": "60cb19277962aa7273f8b512ad756b8ab39c6dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781901, "uuid": "4af58ed9-2418-497a-b7f0-45cc466fbc1e", "comment": "Malware payload (Mirai)", "value": "2d7e776a99fd1d9b3536c1e85016df4b4440e901d5c39a6252a93f3f90b76b604435b2ffe82275f7cb1ba5ae990fea21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781901, "uuid": "0c213b65-b709-418e-a6fe-21677efddcde", "value": "T100333A86B800BD7CF56BD3FB8623490DB930A25591920B27B7B7FDD36C311A85A16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781901, "uuid": "f9579697-83d4-40ec-958d-9e10aeee1d3f", "value": "768:p3eDR+hp5oC7nC8AAzazqVlekF/SOtFnHv6dlSsx/deEWbRAC8eIkiQh2:ROCoD888/S4BHv3sx/dibRj8ciJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781901, "uuid": "ae392536-76df-4224-81f2-b7e41db80d0b", "value": 51464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781901, "uuid": "e53e29b2-144c-4c3f-9864-56b5cd52e47f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781901, "uuid": "346bd8cc-4cc5-45dc-91e6-6a4170973cc0", "value": "c5bc7d44bf57423494aa365d245787a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606bc50a-a537-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1703736775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736775, "uuid": "048ca57a-272c-4884-98e5-4bea0d44917f", "comment": "Malware payload (Amadey)", "value": "ae3f5573da344b46430e75c05b864db0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736775, "uuid": "de920b86-42c0-4052-b677-eb6e064407b0", "comment": "Malware payload (Amadey)", "value": "087803c1f1b8f92278be8ce2ff6b451c493b08ea9f315fb24cb4d5a65beb6a5c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736775, "uuid": "fac259e0-5b95-4a7a-bcf6-0bdc15cc5e6b", "comment": "Malware payload (Amadey)", "value": "c7e720d43983353fd2728b03249ae689b1401360", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736775, "uuid": "a13c1da2-3cee-4840-925e-a9f86813b900", "comment": "Malware payload (Amadey)", "value": "2180c9ac01220d4d351bbe63718e7cc51047bca25e0bc52fbffe1ffab0528db255bfb7ece443702b1c42dd71b97386cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736775, "uuid": "919ecde3-1f0a-4875-b170-c2ad2f2c459e", "value": "T15B46337CB08555E1E7F599B54A9EC8A24A11FDDE07121237B1ECAD072E320DE0B3E53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736775, "uuid": "6f39714d-1b56-4985-b9e6-872d958c30ce", "value": "6ea02e00483c90b3f210e2d517ab619a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736775, "uuid": "db6f4f5a-1df0-4eef-8d6c-bce0e50b0120", "value": "98304:x0ffNZyiLLIHChf0MC6VD1+wuDROFZR9T8KBD/hBBDNB2u/s1C8ljQ:xiyiYsc01QDsFZRN8wDPBbUU85Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736775, "uuid": "21bcc321-6b66-4878-9ffb-41abc0e89e73", "value": 5370560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736775, "uuid": "e335d629-b905-45ed-8781-a05bdcca2151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736775, "uuid": "cad8ca0e-0c9e-4dac-99f5-eecf4c86feb5", "value": "SecuriteInfo.com.Trojan.Siggen22.55359.19257.21303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f527cd6-a557-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703750410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750410, "uuid": "3c89757f-9f03-4cdc-9826-d7b72fca84a6", "comment": "Malware payload (Smoke Loader)", "value": "76433c7640e0aaee3cce8dacb5d3828c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750410, "uuid": "faee8a3c-16ec-4e72-b537-580b1f423b98", "comment": "Malware payload (Smoke Loader)", "value": "099ef99582cb2da5e520888d90b4171d6987ac87d7fc00e8219b25f1c4e6884f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750410, "uuid": "2f801cde-9eca-4d9e-a53f-a5e6fad7373c", "comment": "Malware payload (Smoke Loader)", "value": "8586af8b2dc370f53bebf0007abd15368b5e6ab6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750410, "uuid": "146aa6d3-499e-4fb0-8ea2-1ff1ae9985f3", "comment": "Malware payload (Smoke Loader)", "value": "acae5f44717f461c8eb9f9469cc21d88a42b331bcfc6caeeb845573ada0cd08bf98e3ecdefa5b21f14aa74fc8406f428", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750410, "uuid": "ed560543-3f66-4b6c-a81e-4a6cd28e9c85", "value": "T13A54195393E17D54EA274B729E1EC6E8771EF6518F09376A2A19AF2F04B04B2C1B3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750410, "uuid": "39c42f69-f098-435f-a348-62f11376df89", "value": "e0dc07002fbf5e2ad2a1116b5c525f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750410, "uuid": "1c898ca0-a986-4384-8729-6c51f5efafcb", "value": "6144:oUL/bVEdQYVEWgD/BcPPxIuIls3fu8HVlTV7:oU7bIQYVEx/BcmuIlofuOzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750410, "uuid": "0ea5ce65-fe11-400a-808c-23b7d7dc9c10", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750410, "uuid": "15e487fd-ff1b-4736-bfc6-2681bfa64563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750410, "uuid": "935b9975-ece8-4a36-8a35-ad38f9446a95", "value": "76433c7640e0aaee3cce8dacb5d3828c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8add86-a541-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Octo)", "timestamp": 1703741228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703741228, "uuid": "d9656f78-8ebf-4334-9668-33c3b0c06e1b", "comment": "Malware payload (Octo)", "value": "1208a08445e8a9b77434dbe546aa1b68", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703741228, "uuid": "d1587aca-29d8-4868-8fc9-d51a85683093", "comment": "Malware payload (Octo)", "value": "0a2f1bdec6df99d0de397ffdd63f1c89341b7bd53fa4dd5868e567109fdd507f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703741228, "uuid": "6a5f2214-a876-471d-ab0a-bad3405afffd", "comment": "Malware payload (Octo)", "value": "851ffbe8d9ddfd7386756d37c2f522f83d4c7397", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703741228, "uuid": "1d9e4742-6f9a-46ac-9528-a540b46e512b", "comment": "Malware payload (Octo)", "value": "0552776ef3f33db55361bd1912d674ecc72b7b9b382d3659d76a8af6337faf0be0fa30e96f1202524ac6ce9a79b48e4a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Octo", "colour": "#C7ABB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703741228, "uuid": "0f61c7cc-4c6c-48fa-83ee-84edbf9fe59d", "value": "T10314CF4875A8C70AE4BE9B729EA9C5D1993B7E54CE05DB1F3010371C0B73AD14E72A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703741228, "uuid": "4c91ba2f-31bb-46f4-8d02-f9d152aafcf9", "value": "3072:0jn1nL1376RfdJy188zv3Gkh8wgsUG+jsns3Q7G2ZajHDTmHu0DNmM8G792fh0J0:ynZL6RfTyZvNKrxG+QQQpUbPmHu0p19k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703741228, "uuid": "c1251afd-c118-4239-976d-8a2d699633b5", "value": 196083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703741228, "uuid": "6cbcd232-c313-4a3a-9e60-9a3064c09570", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703741228, "uuid": "45052f96-fb7d-44d9-9466-b46523999558", "value": "a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1715640-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736481, "uuid": "800cf605-d263-480c-954d-41692df4b2ed", "comment": "Malware payload (Gafgyt)", "value": "2d6f905e3b029c7025f882f50e083ffa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736481, "uuid": "d81552c4-2c71-4366-82fd-28e4f216d8be", "comment": "Malware payload (Gafgyt)", "value": "0b3d23c6efeb9744e1eb08516e3ae8874368af598bc524ce318f7f28677a83d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736481, "uuid": "1e2e8437-8f7c-4a33-a494-a5c0cbf77d64", "comment": "Malware payload (Gafgyt)", "value": "5764b7cd8e16a22f441180ab60a519d41ec4f2b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736481, "uuid": "1ef4f2d8-56af-4153-98c6-cf8558e387fa", "comment": "Malware payload (Gafgyt)", "value": "44de8e0f6df6278ed10dad0777cfc5c24df235dee8ebba4f2b3bcc0ba001814fcd47a39bd4bffc3e4a2995b9e09fde3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736481, "uuid": "f2d867e4-8e25-4686-846b-88a16d0c5f77", "value": "T143A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736481, "uuid": "117e3cc1-dc0d-4a52-91e5-cc1b5c7edb7e", "value": "3072:wW8FUmgujld6Mkxm6AJ+4flHmmFVcqq0GnDZT:wJFv4Lm6AJ+4flHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736481, "uuid": "cc52908d-369f-4d8e-af78-fed80fa0fcce", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736481, "uuid": "b26d657f-1e2b-46b9-a070-be7fc94399b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736481, "uuid": "e40bebec-34b8-4cec-9483-022f4dd48b67", "value": "2d6f905e3b029c7025f882f50e083ffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca9d649-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805488, "uuid": "15bf55d3-94e3-4da3-bb94-e3d33998d11d", "comment": "Malware payload", "value": "42f6a6004f4e55ea304c8a3603574154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805488, "uuid": "be000747-b746-4991-aeea-f8cf03322dd6", "comment": "Malware payload", "value": "108a1a653a6496506a9589ad756bf812ec4eb5b8ae413c8a744c97a868e711dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805488, "uuid": "f8bfd823-1271-4de9-a05b-e940344d68ca", "comment": "Malware payload", "value": "b702f89335500374c78e360ea8dc187ca5d45479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805488, "uuid": "a8fb41ec-43dc-457f-9ea4-055148719bc6", "comment": "Malware payload", "value": "d276bfffebaa6b49b283b45b85a172af1fdfa822244df311729d97d6b4c0041f995830b89d92937e3a92af412e392d55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805488, "uuid": "2809847a-1502-43c3-b0b4-90e34cfe3223", "value": "T123156B31B69244B3C21504B125EE7735EB79AA354E65EFC3A3A0EDED1D7A2805F32318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805488, "uuid": "658c54db-8dde-418d-a325-865c84377378", "value": "9c04bec1c24a60f969605dfd67480f97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805488, "uuid": "e97e8470-cf02-444b-8e75-335f6ee8ac05", "value": "12288:UEEjExlv8eA5Ro6TQpr9D8ZDIiu4lZJUbWJ9Zv:xEmioAQV9D8Z8iu4n+gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805488, "uuid": "fe09a632-ea63-467e-a9bc-bd1c06bc3464", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805488, "uuid": "d07c8bc9-1d1c-4227-9dbf-c3dfe3a7fb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805488, "uuid": "f48c75ba-5610-444b-8afd-b117fe716fdb", "value": "SecuriteInfo.com.Win32.Trojan.PSE.18X8GXE.13733.21536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c10fe4b-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736419, "uuid": "060d369b-4291-4df3-bc55-de37f255cd3e", "comment": "Malware payload (Gafgyt)", "value": "f412afa004608d558038e56d84d6a01d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736419, "uuid": "034eacad-af60-4229-991b-3cc50e4fb545", "comment": "Malware payload (Gafgyt)", "value": "11ae0536131e85ecd30dada5d74df05e84a06fe0c4595d2effc14def0cf02322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736419, "uuid": "bc3b1315-84da-4bfc-9112-7041188b9790", "comment": "Malware payload (Gafgyt)", "value": "b17f79be2454c8889c32aff0934a0eeb8d5983a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736419, "uuid": "a09fc2ea-ede8-48ba-a191-cb45d3d30b7e", "comment": "Malware payload (Gafgyt)", "value": "f9d1cc86821c4ca668140f241cd3b796a1e5a5d6a83a6758fb16921305f3252558bddf2ffff7de61cbb8f23a5be54beb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736419, "uuid": "d897991f-c7ec-47f2-b94d-efd6699f2f9a", "value": "T135C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736419, "uuid": "91a89c57-afbb-4e7b-a20f-d5ad3349a714", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPWL7ymm/QMurB1nKGNb:SMQplVWamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736419, "uuid": "7084b914-ac66-4d89-ae31-b86f3af60faf", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736419, "uuid": "c08c8f9a-b03c-4891-8a02-fb765fa2dfcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736419, "uuid": "61f1e175-f266-4911-bc9c-1d64a5ecd179", "value": "f412afa004608d558038e56d84d6a01d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e289bd-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805473, "uuid": "7cd01408-04eb-4e1b-8fec-75c3f74a1bd8", "comment": "Malware payload", "value": "f5d2c14b5a495b2be81c7ff3ec072037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805473, "uuid": "30451fc3-7725-4dce-811a-f54721a1cb82", "comment": "Malware payload", "value": "11c2cc8f790e91fd1106125b1158ccde80b5209f0287cf5196a981f0ec3b8b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805473, "uuid": "072e150b-6436-4a47-aa26-163dcc3387f8", "comment": "Malware payload", "value": "4592a24004f333e1e6ef75d199a5fc1607fc1b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805473, "uuid": "74e64794-6509-4095-b325-29b8bf2dc7e8", "comment": "Malware payload", "value": "82448ef8412fc17c2a00fd2a2da13d0cdb7672d2f880bea437b8a9a06c32d335d7ce6f88945be5f74698e0a77ae66c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805473, "uuid": "5a4048be-afbb-47c5-902c-6df532e14a80", "value": "T13A06F142765AB26EC06AC6F08C10D194E77D28FD1A19976733AF1F4E1F3C2A8BE75025", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805473, "uuid": "d6ea15b4-15ba-47ab-928a-5d2fb08cfb4a", "value": "20d4ed4d410e286e9612f805d1fd5c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805473, "uuid": "4192c4da-8b4d-49db-817b-9dd65dc36800", "value": "49152:tVFHINIKNnQC4KFdmvU+vcA+frG5iBXg3YX1260OVBAZdMai9xiKjC3SbgAmEgst:B+ZnzX+vcAn5/k01n0AuYEBDUXrU39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805473, "uuid": "eff121aa-0908-49b0-8a86-42f30f4fcca2", "value": 3774464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805473, "uuid": "a72ff853-5561-4fc3-a47a-46d473eca36c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805473, "uuid": "3db89cf8-1a80-47cb-a1d6-e0e7da5fabfe", "value": "SecuriteInfo.com.Trojan.Packed.2301.192.22499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c5c02a-a57c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703766599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766599, "uuid": "946162c6-51a6-49b8-927b-a6c9b6540285", "comment": "Malware payload", "value": "50349405d9633f56124c6dc3c9036cf6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766599, "uuid": "b8b5a422-2b41-4d6e-8e57-7b10a822a89c", "comment": "Malware payload", "value": "144427cfac38b1585c77b5d3c3c84c1228cc2f9d1849bdf775a3a7be131b1977", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766599, "uuid": "075080f3-5ec9-418e-9664-18de2e4d7494", "comment": "Malware payload", "value": "481079a407624643a0dec5e3e3984dac3aef8b7a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766599, "uuid": "e5af1b91-b07b-4222-96f1-26faa6d80972", "comment": "Malware payload", "value": "09a1bd93e039cfac98e47a884748d9b065507774797c310c08a9288df3f31ff1168fa2cb469af5ccc91a76dfd6fdf9af", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766599, "uuid": "aa6ae1ec-cef9-4d3e-8f91-75d5f01c4d26", "value": "T1BF872307820B0FB1E7084EFB734A5663C58CFAA5AE0A02573FF426315526648775B7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766599, "uuid": "aa65ac0f-ef7d-4f68-a17a-020e41b9e5ec", "value": "786432:Xv0oUiCOSggGp6esosATl+rzvKma6VfEQn32yC5zkVyjtiL10dvrt8RUiadk:XZy/g6osGWT06VfEKhC1/tiZgJ8RUju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703766599, "uuid": "8ec1d1d6-eb98-4418-8419-ba2126a56083", "value": 37968949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703766599, "uuid": "964cd6c2-c76f-461d-affb-27b56d8368dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766599, "uuid": "e8fb038b-a68f-42e8-8600-1e537c8512aa", "value": "ElQuini6-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5a0db4-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805545, "uuid": "2483e52f-c6ac-43d1-bb52-a229cb8fdc29", "comment": "Malware payload", "value": "05fc705f99f8b9d21bbf9a8dd09980b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805545, "uuid": "e80c43f7-4ee3-427d-8c41-2070aaa98a58", "comment": "Malware payload", "value": "149598271201886890b3c1ff140b9cf5484f14cfd6ed8b41c2dc3a559f332179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805545, "uuid": "a0739fc2-63c8-41b2-a698-5fe9420803e1", "comment": "Malware payload", "value": "392e6562a79ac16921b98e1e36a0a8a872b8d600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805545, "uuid": "f5c76d7e-d1ba-4d58-b176-8a199345b13e", "comment": "Malware payload", "value": "00cd1447295f94be4c47ee1e741f984e0b24b1fc6d9d13a547575b43036d0d2d186efde970e0ac3e97d15ef7be81a1a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805545, "uuid": "15206fd2-fa84-4ce7-aa3b-0a06320c7de3", "value": "T11F652312DC9A82E2D25917FA8D37F9745263FF6718414A3C2C89BC23BCE210B49B6765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805545, "uuid": "eefe93f3-161f-4650-9fd4-56aaed45cd73", "value": "6e6bfd01640cf79b782819d359d44422", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805545, "uuid": "bec65a2e-38ff-4248-b3ae-6cce9259d3e8", "value": "24576:kQYl7GLVtgr5Pnyvg1RIHGCBaCNz7EWNLeyhf9Ib8CVP3znapFf+:1Zt8wKVLCK6KyhubzVP3zn4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805545, "uuid": "571823cd-a76c-4736-a481-630ef65fdc55", "value": 1486336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805545, "uuid": "b0de8beb-4ad4-4838-8dee-c9b9b1d6c89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805545, "uuid": "91833070-6d16-477e-b227-0f9c27e108f5", "value": "SecuriteInfo.com.Trojan.Downloader.10142.19998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f79959-a5b2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703789686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703789686, "uuid": "acf2e691-1cee-44ac-b8f0-e83b737f9d81", "comment": "Malware payload", "value": "0c0dc0cf41e3c993ae5a22803275949a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703789686, "uuid": "a0596fd2-d68a-4dd0-9fc0-ed732d4d32e0", "comment": "Malware payload", "value": "18425dae9f0a49097d0abdd28ec465bfe2f4161b7849fb28494b8058a18ebcfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703789686, "uuid": "9c5a76b0-0724-4fb9-bd06-453704b88929", "comment": "Malware payload", "value": "e372df2088dfa0695608a0ecf9b98c133abcf8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703789686, "uuid": "bb734923-38b5-4477-9970-07c5f98fcc9f", "comment": "Malware payload", "value": "9f07c09d91865dedd4e0c74e4bd6016368b93872243d71911ec9edc8b37ce825558fa9d5759bfef60bbab276c1051a8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703789686, "uuid": "b6b67d4c-f11f-4cd4-a40c-21527a4c79c7", "value": "T1A6D633015F292DEBCE28533A20EB6E093EB01E848448B9FE53D1A5F6D67EB41751BD34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703789686, "uuid": "14ffb572-07c4-4349-9963-f5b6518eb675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703789686, "uuid": "b551685f-4c21-49dc-92b4-d11c453a0b46", "value": "49152:fIjotieByewT9gG21ntArAfjm6miv/t61TRORHEuEu1kGNkLde+tMtl1vVsTNwaC:fIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703789686, "uuid": "f4b04c60-8bec-4b24-9faa-55785a0c7b9d", "value": 13285448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703789686, "uuid": "6d500781-ef84-44e4-be55-ed9faff89d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703789686, "uuid": "e17115bf-816e-4fba-8f94-77858a8cbc4e", "value": "SPOOFER.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2d610b-a5d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703802538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802538, "uuid": "25a343bb-adf5-408f-96ca-009d7160bb79", "comment": "Malware payload", "value": "47f4b4d8f95a7e842691120c66309d5b", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "MasePie", "colour": "#1B6F84", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802538, "uuid": "45bd62d3-bb66-4fc6-86db-9c25d7212d00", "comment": "Malware payload", "value": "18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "MasePie", "colour": "#1B6F84", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802538, "uuid": "67f49e1a-cf4c-4ff9-b94f-d776f568effb", "comment": "Malware payload", "value": "1922698073911b18f60edd84ff8d13461fbd4c5a", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "MasePie", "colour": "#1B6F84", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802538, "uuid": "2234542f-75c8-4201-a7bd-2f9b8223345c", "comment": "Malware payload", "value": "881c4bac6a55b4d655c30fe148667f6af76fc74a8345cf0e7b3f5a67e148d7598e6585bcd1e65529b57bb46a713fbc7b", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "MasePie", "colour": "#1B6F84", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802538, "uuid": "cf33e3d3-b474-45d0-82d4-8ceb5c978b44", "value": "T126A13047C89F04FEA562458DC05590C5732F927202763993BAF5CBB9AC8806BB3FE4B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802538, "uuid": "4b079a26-8b17-4d43-ab0d-bd6d5356e47e", "value": "96:DvH2W/NTUnM6d5VM8CIKlrmICNs+jpC34nu/QyaBX:DH2W1AM65E1lirn8CBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703802538, "uuid": "6580f004-40ba-41d5-8b7b-ccdac6ebd08d", "value": 4909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703802538, "uuid": "e9594092-ab4a-4cb7-b446-1d9261a45c4e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802538, "uuid": "cdfda5b7-31d0-43d6-b2f1-4dec163b77c0", "value": "Client.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7f0daa-a5d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703802433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802433, "uuid": "aa9cc29b-db11-47c7-afc7-620427a4ee8c", "comment": "Malware payload", "value": "6128d9bf34978d2dc7c0a2d463d1bcdd", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802433, "uuid": "235552d7-3a6e-413c-946b-d8387a49d89f", "comment": "Malware payload", "value": "19d0c55ac466e4188c4370e204808ca0bc02bba480ec641da8190cb8aee92bdc", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802433, "uuid": "b5c64ccb-9bf1-4b26-9f56-6e810f065fb9", "comment": "Malware payload", "value": "7adf410aa45b05740c7c22b09b36e33bd24db3af", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802433, "uuid": "ddf542d2-de89-40da-9f1b-03eeee03a9a4", "comment": "Malware payload", "value": "cda59381bbac6844ed69fe0b5f2033ee8ea5e903c6642d1ba17093bbe283368c6744d3019a05871991ed1ac12505bbd5", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802433, "uuid": "2db671f8-02da-4ac0-84bb-304817a2e5d6", "value": "T16951DD211BF50319E3B68F39A8BAA3019536B86ADD01CBCD51D0820C1C62626E879F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802433, "uuid": "6dc23730-042a-4cf4-a33f-f3b095a7425d", "value": "24:8Sj7LxyaBK8kWCUAxkWc+/CVma5ZkWSrLRnSPDqddqVR2l4XuHYc6pK6+/CqPF5b:8S3FLK6DZKrFrd0rXuH96BmFcgq4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703802433, "uuid": "c84aa4e5-a8e3-4949-9306-201285a832c0", "value": 2926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703802433, "uuid": "63d25f6f-6436-4c90-abb8-eb87140433f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802433, "uuid": "a5a01793-05e7-4f96-92a9-f09d2f618099", "value": "KFP.311.152.2023.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637261c0-a59a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703779300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779300, "uuid": "f5e5d4c1-0035-4837-8c2f-9b91d9467d8d", "comment": "Malware payload", "value": "896f4ea671e169eccdc1d4a085f54d94", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779300, "uuid": "a8926176-bccb-4126-af3f-52a899dc7426", "comment": "Malware payload", "value": "1a92fc74fe7f62b9700f6c939997c00b1ac0d898cd76a38b8c9eef5624de3d2b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779300, "uuid": "84508a20-b39d-43a6-b388-6794f4f2739e", "comment": "Malware payload", "value": "6c64eec0bb89ddb681fb80d38ac946df34fea0c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779300, "uuid": "51eb6779-66b8-4eb6-8295-cdbbf2f046c8", "comment": "Malware payload", "value": "a295f6504a56f933ad502f17bc0b09015ca71bd2da524f3913971ac7f16800464519c9a39bb449b4f356e4510112f728", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703779300, "uuid": "f5fb1449-913e-4aaa-bf5d-8534e29af717", "value": "T175D633ED596BEF41713790167F630DC923C4B72E8375B368BAF471BB03528B92588829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703779300, "uuid": "23b03fa0-45d1-47d0-b943-b48d9a32db40", "value": "196608:+qdCTn4eRZy8w99qZ2YArCeEJ28X3vTBR9DvsC9eLcpVuchjcCEltTwXHSHIJDN:+bTnXZy84YZ2hSHv9LspLl06w3gy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703779300, "uuid": "33bd924d-bb00-490c-aeb3-e43e56ffedc9", "value": 13280811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703779300, "uuid": "306bf409-11ae-4b42-990d-b54a4f82ae8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703779300, "uuid": "0c230d06-ade6-4220-b3bd-b7f458f28240", "value": "0038127i23T.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61acdfe2-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805497, "uuid": "0c10e7c7-6cbe-4283-a397-864a11a01ea3", "comment": "Malware payload", "value": "f1faf54e8ee4164323b3fc56d2f147b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805497, "uuid": "8bb241a1-eba1-4372-b056-5cce8bf35410", "comment": "Malware payload", "value": "1b7be43d653afc0cec2638e49b19f454dc795d7bd22a664cd55dedbf3e669f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805497, "uuid": "9912986e-caee-43f9-9375-4119eab6edf7", "comment": "Malware payload", "value": "1b370a856c22e101a4ecc41208e32c9aa68d2f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805497, "uuid": "78a4c57e-4865-4cca-af0d-33ce8626f3da", "comment": "Malware payload", "value": "2cbf071c36899d487354b6b584b9f44654937195deed180d8c41e41db276f6d3d91af5b9d9ca58041f0f2537cd949a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805497, "uuid": "a630e7c8-0b7b-4e94-8a44-4cd14a07c735", "value": "T1B956BE4CF7238669E2C7E9F3DE76A17D27DE7E8288C4950BE25C3E560DB074461884E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805497, "uuid": "f54d219a-342a-426c-9d69-98d8f8ee40cc", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805497, "uuid": "b9f3221d-9b57-4e22-ad0c-c0897240b6a7", "value": "49152:X+jNinx2h7BDbWwEEQeEKfI3EaFjIStZXW9vY5a3d4607npGIvMNAZmktD+s8KuK:Xginyd1jcWr0Lc64JBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805497, "uuid": "ce0e8aa6-780e-4668-91e7-4f5866a59378", "value": 6295520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805497, "uuid": "d40fda71-4b48-4d5b-9257-d014e98f18cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805497, "uuid": "291987b7-92fd-4605-982f-6a275e3d4bcb", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.14065.22756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaaca40-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805538, "uuid": "7f3abd8d-4d79-40b3-8cd2-6bd2a0ac063e", "comment": "Malware payload", "value": "182bdb9e75b704a7ff057877e05f961e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805538, "uuid": "a293d7dc-9a18-426c-8775-350f1db313f2", "comment": "Malware payload", "value": "1d9843f93a5a53c353b36ee916d9fac462535a6b8d2a9232f2f9318a08ad5b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805538, "uuid": "a77d0cdf-8924-40f1-9240-6bdf97613ee1", "comment": "Malware payload", "value": "86e0edcf66f5ec0010a74c2f8a9569bc4e33dfe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805538, "uuid": "2efb2d57-6e6a-4b81-990d-558323b3e16b", "comment": "Malware payload", "value": "badd7f1df37f332da4a081482bb779e9c14ba49119787709d46218eda0ecf140b63a2f5236f20c78be45a39d90f57ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805538, "uuid": "e6a6ca78-2125-41a4-a220-cea0b86fd88b", "value": "T1B6469D379E1D5CCDE90124719C5A8FDA29649C20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805538, "uuid": "c243201e-ce35-4ab5-bc49-303c79038867", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805538, "uuid": "1c1109bf-3bce-4559-bd3b-4eb3dbe18244", "value": "98304:yP6wl9x/udgdyEU/PDgiP8hiqTSiOGxdp+mgulfa2FMIRavY9J+:ynl95EgkzPEiPKib8xdp+mgulfa2FMIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805538, "uuid": "33de722a-2473-484e-aab8-b2de544db309", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805538, "uuid": "de2d9a38-d485-4a50-a8fa-a2ff24b825e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805538, "uuid": "128efb69-7086-45df-9717-afc0abf0e49c", "value": "SecuriteInfo.com.Trojan.Crypt.26148.18120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dced24c-a583-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703769359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769359, "uuid": "2b71ac29-b433-4596-acfa-4f1211de11f9", "comment": "Malware payload (Formbook)", "value": "8322b194a78140be2fee3334f02a8a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769359, "uuid": "6486e23b-f562-4370-981c-4c392e026ea9", "comment": "Malware payload (Formbook)", "value": "23f816f490058af7fca827c5e10e84f1715f97c88b21f20d082282fe91544ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769359, "uuid": "2c1c8d35-284a-44af-8bef-920d14a294c3", "comment": "Malware payload (Formbook)", "value": "6a417f300db0ac845ad086d0e3333e892c9394ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769359, "uuid": "1510f1bc-cd55-41b6-a260-53514b7d27b3", "comment": "Malware payload (Formbook)", "value": "a68591963e61e2a68e521a9fd5abc8cc1613ec876150889c99b6b74f0a31bd7d3edee8b8826eca3035e81d4c61ed2740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769359, "uuid": "71ef7724-5218-4efe-8829-3b379db5412a", "value": "T11125E33F1BBB292BCD76C2B5C7F58467F312D46B31119A696AC6CF950702B4238C225E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769359, "uuid": "7b577660-48a2-4ae0-bda7-fc244da21c7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769359, "uuid": "366b5d9a-77fc-4a37-aaee-3404a0e088fb", "value": "12288:DxJjxfGpAZ2iN1xrPQxrPV8zgwIfdeOlg5I4s6FAAy7wfnM/fkob4G2EwdFK:PxuAZ1DZPQZPV80VPqjsOK7c8srdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703769359, "uuid": "54caa4ec-a470-407e-9527-e7434feccaea", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703769359, "uuid": "7740ab95-f789-4a6c-a04e-515ed30caf9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769359, "uuid": "eeea5ad1-a7c9-4409-99b5-6278cb0afd33", "value": "z1CUNGC___PTH____NGM___I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78997423-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805535, "uuid": "d2a57880-9f4f-4a34-876f-1af76e50591b", "comment": "Malware payload", "value": "789b08dcf6269eb601338bff4851ce4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805535, "uuid": "76394d1b-86c2-46f3-a507-c74ee013bc46", "comment": "Malware payload", "value": "23f9cf3d1261da0fe4a2597236f1f2e7e4d27c30aa8ee77b50d543ece59f837d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805535, "uuid": "79ea0658-eb65-4af9-a73c-03aec06dc2fc", "comment": "Malware payload", "value": "837464622e94960f0eda6e87c5853a6cdce0e0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805535, "uuid": "847797fa-2033-458c-8308-074cdd9350aa", "comment": "Malware payload", "value": "704f7f368283795647c0db40363687d468d1a040ca07837acd70e3f40bf8a5484fff87b946da81bdfc294b24d838e732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805535, "uuid": "6119cb6b-692a-4990-b685-9223d2940f10", "value": "T1E0469D379E1D5CCDE90164719C1A8FDA29649C20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805535, "uuid": "b7b8805f-934f-4267-9352-e2b7a92d131e", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805535, "uuid": "94a16cd8-ac1c-4075-86a3-4990f97644e1", "value": "98304:nXUQVi2aPVLgqnCCwLgm1QhrqTR1OPxdp+mgulfa2FMIRavYBJS:nxVi7tLDdwcm1+rA8xdp+mgulfa2FMIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805535, "uuid": "e4712815-c797-4d88-a24f-f3a5a0360c01", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805535, "uuid": "bdbc8827-7b37-4997-b3ba-f3984817ec95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805535, "uuid": "e5b2a275-7116-4654-af15-ce0e86191bdb", "value": "SecuriteInfo.com.Trojan.Crypt.5208.17125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559ecb21-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805476, "uuid": "113b3292-a701-47ab-81bb-1792dd63d662", "comment": "Malware payload", "value": "16bb12ec2055c94cd78813af8169a46d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805476, "uuid": "538048b0-659a-4758-96b3-dcde25d67dd2", "comment": "Malware payload", "value": "240d800eba8d90642a0cc89104584440ea7cd19cf0085f93787179c8b04c0b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805476, "uuid": "2b7cd681-63ae-45cc-b033-0ff36db8f1c7", "comment": "Malware payload", "value": "ed19c4fe730b691be5c50c9065654f39e7fdda37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805476, "uuid": "6184a490-0875-4132-a058-aa68856edbc0", "comment": "Malware payload", "value": "0738b33a92093585d3b68d707eae6bdcd451ed8a85dbbe4dc6a276ab87fb4cadd97923b4cb29e1d30fe7d78e461343a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805476, "uuid": "38ce06a9-cc69-43da-966a-c012b69afe17", "value": "T163356B3675515032D563F9314A1B7A9D8426FE974EF8249A2BFD6C483D30A82BE31FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805476, "uuid": "14b839a6-544f-48a9-ae51-5884384b8403", "value": "24576:oCgbV5DZ5LppAHy5avE7R8Rryn3+EfuGYl:oCUxZ/lco6UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805476, "uuid": "07583acc-4ade-4bfd-a20a-7d2943e2a1ae", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805476, "uuid": "42bb7b7a-f8a1-46e2-9d8f-9a6693b18d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805476, "uuid": "e5ba1147-0b61-4503-ae0b-edc7d8e595da", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.6335.3187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8ffabb-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736475, "uuid": "6631f730-1a81-4453-b318-5e8c7290a1da", "comment": "Malware payload (Gafgyt)", "value": "f4476c4d5c3d4413e6f66efc9ba4f6bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736475, "uuid": "c5f4261b-fd71-4842-8a8a-e08d7d861c0b", "comment": "Malware payload (Gafgyt)", "value": "2484dcd0b74049da92c8390d228d8f3b51a26abbf3c06351ac0609e331a429dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736475, "uuid": "ef4d1a37-15aa-4b10-ba52-ec0f0433ed6b", "comment": "Malware payload (Gafgyt)", "value": "94d9aaab176cea8b5f1f7fcbfd61b4f4d90b0d68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736475, "uuid": "07661331-3b72-45e3-8c54-eab8174d7acc", "comment": "Malware payload (Gafgyt)", "value": "56e64637f6f5f75dd044a26331dd96cc8fce0805028c0b7b4fb4b7488b90a34a4b13c75b6bd8f280100f41948a066724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736475, "uuid": "a8ec8f5f-205d-4c7d-97be-dcaa59090c6a", "value": "T1FDB31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736475, "uuid": "64d7895f-0a27-424a-85e1-6aacbdd29a65", "value": "3072:MDVLSItJP+Xsp4JlN3HfjmH1cuEgvniuN/:MDV+ItJH2l3HfjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736475, "uuid": "b7e17592-a1a4-4c38-aeda-e98952e4b22a", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736475, "uuid": "5545afd6-d42b-4154-bda6-f365dda6a3dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736475, "uuid": "9ea74a12-e92d-4cfd-b013-e0613d1b5aef", "value": "f4476c4d5c3d4413e6f66efc9ba4f6bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8169f3c5-a53f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703740266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740266, "uuid": "80d922bf-f729-4bf3-ae25-5cb13eb4e827", "comment": "Malware payload (Smoke Loader)", "value": "12382062c6abc23ebdf6aec25f383fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740266, "uuid": "bb60a7ae-eaf8-4ced-8fc3-968c321ee022", "comment": "Malware payload (Smoke Loader)", "value": "24b66c0d6f26f5de09b4cb7a2496bf87ad0ed9d45e846870dee70941b565bc3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740266, "uuid": "584bf9d0-48fa-4a8e-be93-d50ec611475e", "comment": "Malware payload (Smoke Loader)", "value": "9834dc9a4fd1f037c574c27a932c96d68409c882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740266, "uuid": "63b2be35-4467-4ae2-9472-d2743cfd932a", "comment": "Malware payload (Smoke Loader)", "value": "d1f67cf5114f9930e23fed86bf38d08b9302e668a4ba37361a9cad13074d4239df066e08d0afac6e82b3a55bdfc5581c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740266, "uuid": "12702ccb-a806-49c3-9bdb-d087766c2197", "value": "T174752356E2F84971C9336F700AF616531336BC93D835866D3396A84A0EF16C5F1B23AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740266, "uuid": "f9d95d29-7e6c-427a-b5e4-a0e70674283a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740266, "uuid": "42d09ecd-d821-419b-a5df-e1185183a312", "value": "49152:/I4a/fuUWyY2dhl3pmcmVFSD2TDi+SyEU/6QB4:wx/GUxmVoJvyR/6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703740266, "uuid": "15640f4d-91d2-4e82-b511-3579be60a2dd", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703740266, "uuid": "0635ceef-697b-4684-b13d-78d50e19f3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740266, "uuid": "25b5dae9-1b8e-415c-87a9-14b93d919023", "value": "WEXTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59180fb1-a5d0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703802476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802476, "uuid": "3957bc32-99ec-4681-bcfa-757e72532034", "comment": "Malware payload", "value": "5db75e816b4cef5cc457f0c9e3fc4100", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OceanMap", "colour": "#4FBE62", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802476, "uuid": "eba60f8c-e128-4944-918b-221334570a49", "comment": "Malware payload", "value": "24fd571600dcc00bf2bb8577c7e4fd67275f7d19d852b909395bebcbb1274e04", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OceanMap", "colour": "#4FBE62", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802476, "uuid": "f017800b-87b8-45ba-9fdd-d92fe6b8a350", "comment": "Malware payload", "value": "2a1461189052a014d345444557611af0c9d3fe34", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OceanMap", "colour": "#4FBE62", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802476, "uuid": "490cd578-38c3-4bb8-8ba7-282c6a47f9c3", "comment": "Malware payload", "value": "72915f525494a2cd6726191be724323c1a82fc7aabe17b2e6607d4c67e73d9126872aa721b75718d83a7aad2280ebbbe", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OceanMap", "colour": "#4FBE62", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802476, "uuid": "39e9e103-7884-4570-83aa-6b03443402c6", "value": "T1D0B2E716B3581790C9B9997320D600AB9FF5DD3A2C91EA67798DF70E1F760E29203E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802476, "uuid": "6b672d93-4640-4b8a-a5f8-a4290a2dc0a5", "value": "384:FH7WwxvyrxCjvCyau13yiI2SekOtWX/5Z+hGs2ptYcFm7B03K:VxxKrx6miInekz/5Z+hStYcFm7B6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703802476, "uuid": "de0b5fb8-085a-43b3-8ea0-852572f5e903", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703802476, "uuid": "6597bd4c-5fb8-4750-b978-15f06e689d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802476, "uuid": "4e432684-4c16-4512-bd75-e95174982f07", "value": "VMSearch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514daa83-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805469, "uuid": "d38c7d89-1324-41e2-8a27-13f469c6150a", "comment": "Malware payload", "value": "ff8af86cdf20abfd787e7a98d25ec49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805469, "uuid": "dc29a5df-764b-4f96-89bc-c20f230b5c54", "comment": "Malware payload", "value": "2692429b5a0fe556c37659473ec299188251ad58b3ba800a64b5cba13c5e0dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805469, "uuid": "d8f9414a-760c-4846-b16e-7496ee8de86e", "comment": "Malware payload", "value": "7eba07a6db4644a4bd94118ef3480b40db600ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805469, "uuid": "4e698a4f-c0a1-4d12-81ec-b7d9f2746575", "comment": "Malware payload", "value": "53f326816571541dc7adb342536e94d82c9de58c2a7c42df64a41b5383a5d0b98f504aa4b06a8e1f1df7937bc3fc7369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805469, "uuid": "8b790fc9-ca91-423d-82f5-12cfe57b4711", "value": "T14B469D379E1D5CC9F90134719C1A8FDA29949C21B5086B9B76C1B969CCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805469, "uuid": "6f86f495-dbcb-4467-aadc-46e4fe8c7b0d", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805469, "uuid": "88c4ee45-3d2f-4e18-b34d-ec2b288ef821", "value": "98304:QCWZa2ktAsR9/aWbzggDvOhnqTTzOWlpxeeoiVLiiR44GqmIgdy:Q5a2+nRF7zZDv0nWflpxeeoiVLiiR44f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805469, "uuid": "b8da6f53-90c8-4568-8368-815a5f8e95a6", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805469, "uuid": "b7a094c4-837d-4508-95ba-b3303b9005b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805469, "uuid": "ed045c7d-d2a1-4842-904d-42c54f7331fa", "value": "SecuriteInfo.com.Trojan.Crypt.22939.16525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f374d29-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1703750087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750087, "uuid": "621a8f66-e21e-484e-a892-3126275f640a", "comment": "Malware payload (GuLoader)", "value": "90c81c7b6a37d8782b4ff746a92d7fb7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750087, "uuid": "8cca29fa-f9de-4dc6-aef5-c5edcd33914a", "comment": "Malware payload (GuLoader)", "value": "2840634c77fdc0d8ea594db41eb8b6d2d18edc86eb723acebaf8d3a99b92aa4f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750087, "uuid": "a725380b-998e-4927-8ed8-72c32d635b94", "comment": "Malware payload (GuLoader)", "value": "ff833ab8e01056a0ba0eb119d131d1c5f14b0433", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750087, "uuid": "dd66a408-7745-4e70-971c-12d1a6a6fb63", "comment": "Malware payload (GuLoader)", "value": "d13de78922916263ce31987ca101a8cb405bc8193eb3ee9686559c1a61fad138631e941efe96170df85d08c2688f783c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750087, "uuid": "2fa55c69-7f73-4b65-b952-16093d8d5a9f", "value": "T110937C61EB99960D8D4B37E9EC808C858AFC81295516205EFEDD03DFA14B45CD3FDB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750087, "uuid": "01f8f723-a707-42c5-9122-79ea0e2844cd", "value": "1536:1cCkoSdF1qEVoe+kZxsLFxSMsfwQjXA58dTjvboqVeG8X+755c:1cCkoSdFPJ+W6F8wk68lvEqV78A5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750087, "uuid": "2fb512bc-7a06-4b2b-b25c-cf4e52181822", "value": 89278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750087, "uuid": "fa91ce52-f12a-43f9-b6e3-ccf5d0535866", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750087, "uuid": "e2110f99-bd85-4398-b541-15a736a90a21", "value": "Scanned_Documents_export-039383-Tiltrkn.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e4f600-a572-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703762230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703762230, "uuid": "42cbba8b-4f4a-490d-99b1-43b832cb8100", "comment": "Malware payload", "value": "62f016a19aac02359a5d6abcbecf7986", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703762230, "uuid": "6d7fb80c-3c90-4170-98c4-0012547ea290", "comment": "Malware payload", "value": "28c153a6c0a0eac23bcc885de6eb1fa86033fbc94e914766db0c4f4094c3d446", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703762230, "uuid": "48e3813a-1531-451a-a960-735704193c89", "comment": "Malware payload", "value": "91eb06ca15f3ace91e19dacf230ed9b08f3b687b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703762230, "uuid": "cade7bfe-61c5-4002-8139-cb413e5a6d8d", "comment": "Malware payload", "value": "b3fbf0b94fc7b274fc0e7bf8b6a719791f14a0d469bc94597b141e55329c85e0ef41b1cc6cd67cb5749e4b0b199cc40a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703762230, "uuid": "c870a196-4b5e-4e07-9e72-ea1dfb9fb7a5", "value": "T198F27A62E1911837AD3344FA43E22F18F5D32898D7875119BAFB1597DBCAE8035B3839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703762230, "uuid": "3045d1a3-8b05-422e-8d80-762c5d0a7a59", "value": "768:AnbTxk6X89yTvmeua36P/s6sbTNt9QJ0TBzh5q7kkqDxszJoS/7Llwi7DYlSTc8k:0eHn0wKigZVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703762230, "uuid": "7b942f59-e81c-436a-b8b7-58430f95663a", "value": 37591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703762230, "uuid": "53d6edcd-7cbd-44d1-81ce-6fc44d11784b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703762230, "uuid": "e66a38b6-b892-4c14-b24b-a5b4242a10bf", "value": "arrow.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e401b2-a579-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703765320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765320, "uuid": "45bafa9a-3600-414b-b1d0-5bd32571ac15", "comment": "Malware payload", "value": "476893436b6f7feca1e17bea59263c8a", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765320, "uuid": "60a0224f-c7af-4c8f-9c97-5e16ad601db9", "comment": "Malware payload", "value": "28ef44e17fd66b19b223b30b7970cd2e8a372f6f40117d6daa5010b522d3c9fb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765320, "uuid": "c00c82f7-a61a-4f72-b828-a391f4b6d9d4", "comment": "Malware payload", "value": "cf595f70434dd2467489fe3824fd5e4544e56e4e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765320, "uuid": "485372e6-35af-4335-b7c1-9be79b0cd4c7", "comment": "Malware payload", "value": "96d7f0eec8722e98e00197a68a4ede5664938dfa78e6d635f72c1511cc9d3f084fa34a7bde3486604eab6d64c408ecb8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765320, "uuid": "55ab2726-aa3e-43b5-9cd4-16d6c5766cd0", "value": "T1121733F740AB467BDF62DA30C702B60BCA370F1F626186747BF01746D74A4EA21A6719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765320, "uuid": "b8336fb7-95b2-48dc-a342-586e4ae11fe7", "value": "393216:TZ0tbR6QibdlVa0W72Jdchh6eJwmc9mlcAp+mK9GjRJZWreKSVV:TZ0j6XXmas6jASAp+mKAJZqenV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765320, "uuid": "27fe6065-3027-4aa5-8e11-47e7f6042379", "value": 18757168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765320, "uuid": "62bd1d1b-8a53-4519-8ef3-a0ae63ac15f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765320, "uuid": "19fbbf25-0e98-4e02-864b-00053b610dd1", "value": "nekojb-public-beta-1.ipa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779a4de2-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805533, "uuid": "67cdea4d-e9f8-4157-94ce-6ce4e144d025", "comment": "Malware payload", "value": "1163e71b4056e7660e916cce3610da59", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805533, "uuid": "be58cdbc-70e9-4898-9241-64282b581f98", "comment": "Malware payload", "value": "29190396f17db8c98f0054e3886b596d2c0602dfb5054d66d51e24ed199783cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805533, "uuid": "4a3e2f4c-3c3e-491f-acd9-01bfc48181bd", "comment": "Malware payload", "value": "c72fe3f2c8f0d2111110df18b24ffdacbf5ff7d3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805533, "uuid": "2715fc9f-3e23-436c-b19b-64a4b22f5240", "comment": "Malware payload", "value": "9d7fd4a40c867299c1d51fd54aa25d9680fca4da51f92bd46fa20e1b4eb54db73024985d488d48e8355afd44a21b2bc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805533, "uuid": "e0c6abcb-5869-40d0-9624-a4ccb3f49b35", "value": "T162A55BD3A2855C3BD0770F3A4C6BD754683FFB212E25984B2EE40E4D0E39A426D3A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805533, "uuid": "f604ef9f-9395-4649-8370-48e0261a53cb", "value": "db4c60c89abf0198b8aeb7b0342a3e8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805533, "uuid": "c10f9de2-8557-40d3-a013-8bb9f846a5f4", "value": "49152:dlJxFSE+w3iOTeFsp7r/q1y7+gFAndzA36nD6BX:d37iDspAhddcYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805533, "uuid": "1c045ba0-a35f-44a8-80b6-908ca88ffa73", "value": 2091632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805533, "uuid": "63df771e-56ee-4f10-94d3-05956a8f7135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805533, "uuid": "c6826255-f508-482f-b59b-32950167752c", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.Adload.16499.28309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c60b55-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805480, "uuid": "37592142-58f7-4da1-8b0a-18ccf5869c8b", "comment": "Malware payload", "value": "aae3eedbdc1b1a99f7c2844f85352692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805480, "uuid": "acbdeea5-0713-46c3-a97e-54c979d2a2f0", "comment": "Malware payload", "value": "2c1d65f58f07ad391492f0c0b1c335321f7b0d6e9f41218e04404e7b58692ddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805480, "uuid": "78908479-818c-4a9c-8942-17bc0facb828", "comment": "Malware payload", "value": "8025c689f73816e6c275e38002649d91244d6db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805480, "uuid": "c47fceba-19da-497d-870f-834f2e52cc4f", "comment": "Malware payload", "value": "a6f6d38a276131d6ba98cd9ed78b3deb399f66c24f9cb96a5d6a86c277eef74363868991202e91a35ca8bb7302046dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805480, "uuid": "af286a14-90e0-4d4e-a04a-17af37b9e069", "value": "T1E9273322BBCAC0BAEBD2233545A99B1F6975F6324B505DCBB3E50B5C4E216C06D36313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805480, "uuid": "2f459989-de2c-423e-a913-01c5a6440299", "value": "404cf80e26b57b92c5197972a37704a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805480, "uuid": "dca21e04-488e-47dd-b3d7-16efd8ff3daf", "value": "393216:MM29LTLRF5Aqahe8A6+M5JnOHz15dDaYqZJRPcVxkbnpIwpmXhd99lEuts:Mn9LBF5AiDzM5OzndDfwJRPUepfmxbot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805480, "uuid": "c7483554-90bc-43a3-b54a-67d469c25a3b", "value": 22004296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805480, "uuid": "94008b14-a4f7-46f8-a763-60b4665c8f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805480, "uuid": "75cb6d5b-0406-4b31-a452-94c516be961c", "value": "SecuriteInfo.com.Trojan.Click2.57467.3204.14689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c525d8-a581-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703768802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768802, "uuid": "4c12a600-17e8-4bbf-8e0e-5f155fc0d5b5", "comment": "Malware payload (Formbook)", "value": "f59ff065a3c18cbd5da53ceea337967f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768802, "uuid": "9567f287-1852-4161-87c5-99ca7e4adcbf", "comment": "Malware payload (Formbook)", "value": "2cc91aca07118474798c2daad4fc680b057db86e4dca2201da9791a24f53181b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768802, "uuid": "4d977b77-c8df-4c4e-b6a2-c7c42fde1008", "comment": "Malware payload (Formbook)", "value": "b8bcec37b992ce5f4f018a0e590e29dcbf7dd355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703768802, "uuid": "131bdc9e-cb68-47af-98a9-8b354a8e563b", "comment": "Malware payload (Formbook)", "value": "8702ad38be50f7fe578a5a3acb304d19f4c961eeec4cbbea2dd46f842cbcfdc6f9c4365513ad9cc80c164bcb3c276c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768802, "uuid": "5dd16d9f-f477-4ca7-bee1-40e65467e34f", "value": "T1F715C33F5BBB292BCD75C2B5C7F48467B313D46B3111AA695AC6DF950302B8228C325E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768802, "uuid": "95a1302c-97ca-49a7-8411-be188923662d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768802, "uuid": "5e1293e1-dfc3-47ff-bfd9-1d0fda8352ee", "value": "12288:Z9VGCSU6RLD2iNcxGpQMOIPNww2OhgxnzAsp5Ol8zBu3A:Z9Ev1XcOhAzAYtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703768802, "uuid": "32cb2b03-397f-4c40-a9dc-776214e1b1e5", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703768802, "uuid": "337be4a2-75c7-418e-9596-26cbc392cc30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703768802, "uuid": "2999b243-2f7e-45c9-ad58-59799549a8c8", "value": "z1BOLETODEPAGAMENTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f7ff0e-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805524, "uuid": "7da2d996-2932-44de-82a5-f3549b0b6a96", "comment": "Malware payload", "value": "8d390c6bd60451e09f972e3981f11864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805524, "uuid": "e5aba4cc-4214-4e10-b7ee-1349e8c87bb4", "comment": "Malware payload", "value": "2d8d362f803f98e2fbfdc3b47bbce5e27b7ebb784e3db12e688eb1f577ea4d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805524, "uuid": "8b9cba25-a381-494f-bf02-da7a858349ca", "comment": "Malware payload", "value": "4740ced1564fa524b35b57c9bd8aa8a5de0bf6ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805524, "uuid": "32dfd92f-2182-4b0a-b70e-a9ae8f014f2b", "comment": "Malware payload", "value": "6f752e77167daa4d82838dc3026aae138e49b01a3356045056cb068a5b2704725093dde0d7ed316c7e39101565501fe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805524, "uuid": "09b7cf70-ef67-401d-8515-a3a455c1c2f0", "value": "T18735D02376D1C03AC07306311A3ACB69B6BBF9725D394A0773D8570E1F745939C2AB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805524, "uuid": "290652f2-c27a-48eb-a3b0-fcc0fcc421d4", "value": "d265bbaaad5a74897f0abc2d08295665", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805524, "uuid": "10516a80-5629-4e8b-b905-55dea3acd4ae", "value": "24576:o4tLZr4LiB7owL/2JhtuSgMuFVnERrpff5+z0:o4tLZXNoXJTIVHER9ffMz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805524, "uuid": "4755ed44-02db-41b9-bfcc-00b55ff56c21", "value": 1069720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805524, "uuid": "43e16408-487c-4b8b-9108-50111df77e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805524, "uuid": "8b4d6836-7188-43e1-aee0-24909b301c38", "value": "SecuriteInfo.com.W32.Chindo.ABGE.tr.dldr.5847.13776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736455a5-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748833, "uuid": "85c638d4-e16f-4f71-8a6a-47d64bbce18e", "comment": "Malware payload (Gafgyt)", "value": "37b44d87c66a1d38dbd0c03d86256bfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748833, "uuid": "aaced576-565a-4cf6-9058-7a2089d57aef", "comment": "Malware payload (Gafgyt)", "value": "33775b8ff34e5595b4cfe34db7ebfed229ba46b37ff47680cebff6698ab1cc4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748833, "uuid": "9b563c99-eec6-45ee-9cd1-a0c52851f006", "comment": "Malware payload (Gafgyt)", "value": "6c8a674112696b9d591097cd446f961b7102ebae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748833, "uuid": "11fa50c6-d9fa-4b2c-8526-d40b276eee74", "comment": "Malware payload (Gafgyt)", "value": "fb79ddf943bb31edd3fd832b821432a6cce69fe5a5a51f29e401fa124a3cad041014e22c9cff488e6feec13496274ee4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748833, "uuid": "f4db388e-c0cc-4fb7-8313-168e94614c91", "value": "T14A13F28322CA5861E3A83E39DC510395B32532847C9B36F6B59C8D184EEB7C79C7B0D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748833, "uuid": "9f73d773-51b1-43a6-a5f7-df9e01cfb0b0", "value": "768:D1XVLF5l1oV2o74PDw0ohCcYB9TIpcTXOM3qbDuugysqtEZMYMq3UgpmmBZOZ8xX:D1lLHl+2ocPk0eCcgJN6XQyqlUZ828", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748833, "uuid": "0bb26108-c972-4a87-aee3-46b410d74d3f", "value": 42996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748833, "uuid": "ef778165-9f9d-4c00-ba46-21f25f81291e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748833, "uuid": "70413226-1b80-4293-ba5f-ff1534c89490", "value": "37b44d87c66a1d38dbd0c03d86256bfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821a3657-a5cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703801256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703801256, "uuid": "f296accf-6800-4653-84a8-708e5acaedda", "comment": "Malware payload", "value": "770d8a9c6f0cbe97a7b738bb46da1a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703801256, "uuid": "b09a6004-dc74-4fbe-96a3-6981f72ed01c", "comment": "Malware payload", "value": "33ab895e270da5c3783cadbee52e1728500af03fb414520c29f1bebb9fe3c504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703801256, "uuid": "e87daf7d-72e2-466f-ba8d-ed40c2153ba1", "comment": "Malware payload", "value": "8614c64540a1dddadaa93d0674c079b501dd857f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703801256, "uuid": "d31468ad-137c-4e51-bd62-c6c4480ea4d4", "comment": "Malware payload", "value": "c281b7d31f3e2618ef43c57f741041b89c96edaca4000c562a51ffa1785fb579f94aa1a27ac50f261358b732858413e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703801256, "uuid": "86cd4ee8-dddd-457d-96d1-c9956da35693", "value": "T116F733AAE1419C1BC17035FBBBF45472B21803B489F5E577AAAC34E0D98071A77B872D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703801256, "uuid": "8e237d88-1e3e-4a6f-af1f-692ed04fd7ac", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703801256, "uuid": "4d5e59f6-4758-4d76-adb8-affc4c1c8f88", "value": "1572864:/4/4rzOchPVTO6DvtS0WeNeGEyvH5lXLf8t7hyTahT6O81em7:QkqcdVTOWw0RpvH5xE9hDGOtm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703801256, "uuid": "6ad4234d-6c98-4ace-b239-f49b2aa0e10f", "value": 74242211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703801256, "uuid": "8bf1acd8-33bc-4273-9d81-febb72f23b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703801256, "uuid": "870fd326-d950-4506-b459-2648f762ac97", "value": "Beast Conquests.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e73d63c-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805518, "uuid": "77dd2ceb-a070-4a93-8633-c11cc8c20fce", "comment": "Malware payload", "value": "210538dfeaf6d7ed905b20c17f180af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805518, "uuid": "2f666ae9-a360-4953-b39b-45e77bdcfb01", "comment": "Malware payload", "value": "350319c2dcc7d37f30000783fb7e8bc3c565f5c55146a5d7a91fc3082191dd28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805518, "uuid": "1224eb01-aca8-489b-825b-47cf15410358", "comment": "Malware payload", "value": "ab169215a0c6685397ecca91ce985bec42c76f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805518, "uuid": "5ff9d995-b12f-4121-ae57-52c013e28a37", "comment": "Malware payload", "value": "d484acb0441072674d9a1bca4470987ea882598f0fdb5d61969b5efd7591c09e297473cced74ac004dd083b236c989b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805518, "uuid": "d857c123-d493-4632-8e46-068a5679aaae", "value": "T1B8057C01F5D280F0C2A81432C9B75335A6355E474E96CE87B764EE6D3E323A16D2BB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805518, "uuid": "4c1c4e59-93dc-4628-b46e-f265df624703", "value": "c2bf7c8d498a16c1e083c3db08951c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805518, "uuid": "ce728c44-7751-49fa-91e8-d3703312170c", "value": "12288:M18VCFFUTPh42nHhJNsCrqMVnw4TytMCgBtMCgd:MeJ/nBJNsCrdVwq8MbMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805518, "uuid": "a6cfa8dc-307d-497c-99ec-4ef8e03af1ae", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805518, "uuid": "0e134533-279c-4ef2-b940-a8f62834946b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805518, "uuid": "f882be4d-ebfa-435e-92f5-a2ff641c562f", "value": "SecuriteInfo.com.FileRepMalware.26781.20535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f798244-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748826, "uuid": "041e0fd4-730b-4bf5-9c87-0cdfb58e1da4", "comment": "Malware payload (Gafgyt)", "value": "f07e40096a9d974947cd0a50cecee786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748826, "uuid": "12167ba1-9d5f-4aee-b0c1-e06a5e1cbc42", "comment": "Malware payload (Gafgyt)", "value": "36a9cfe4525f76b79d3d017928a6c09e373364d0765e2dbbf4e7eb789c4a032d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748826, "uuid": "4a05c87d-af7b-44e3-93ff-cc77800ad8f5", "comment": "Malware payload (Gafgyt)", "value": "f8199d24ddb2eb1d72e6fe538fef85c659a64f77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748826, "uuid": "0732dab0-ae1f-474a-bfe3-54ef5b6157ff", "comment": "Malware payload (Gafgyt)", "value": "2f38357aae9fb9bad7fe3ac0d763fcce8653e9badbe2828098bfaac4554b944633536ffd64900e6d5f1bc13185472afd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748826, "uuid": "294b1cb6-4c82-472f-8484-4026aba3e806", "value": "T115934B4398219FB7C1565AB126EB4D700763BD221F4F1A88752CBAF4033B9CEB40E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748826, "uuid": "f2e8d877-6cb9-472a-a8d8-13c50717d08c", "value": "1536:6S773q4PS2XmKVmEdVEMYDbcaqTCsoFdOmK40pbsizInKJNg:6SS4PvXZVbEMMqTiF0mH0pbscInKJNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748826, "uuid": "4fc463c6-83d5-4180-bcb1-89c2ab97fe12", "value": 95962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748826, "uuid": "99a1ab41-a403-41d7-b600-a2bb62f24723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748826, "uuid": "8b03ea6a-b0a7-4619-b82a-dc8bfe233fdc", "value": "f07e40096a9d974947cd0a50cecee786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11ba59b-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736454, "uuid": "631cb4b9-e9f6-408f-99fe-afda2ace2015", "comment": "Malware payload (Gafgyt)", "value": "bcabe3cbe7fe90049ea7f0494b0eaa4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736454, "uuid": "28219e22-6af8-4d76-8d0d-ab8d5844646f", "comment": "Malware payload (Gafgyt)", "value": "36c011bd060556c8d4faf93a1a6fa34cd250b068d230fd7afbc88f38c6c79e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736454, "uuid": "9b30fc0b-7ad4-48a5-918b-a99167c00c79", "comment": "Malware payload (Gafgyt)", "value": "f09aedb20ff8b0ef9fd26b94b61fe6d18076bc77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736454, "uuid": "9ea55643-1c1c-4054-9339-5b9bed6a755c", "comment": "Malware payload (Gafgyt)", "value": "74e9d3dff2183196a50d99fd66d97dc334c2f3e1a70c449ea7ce267c7151a1972f538ff83dbcaeb78c07bfdaa40718dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736454, "uuid": "314fd805-ca07-4c9d-9783-c65162376e8f", "value": "T11CE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736454, "uuid": "e77ee80b-9bef-4f07-91ce-622a58da0c22", "value": "3072:Cv/WwsLgaq353qHiCOvhOpTqkDQHbeskmhxQwoVSUNu:KPLaq351hOpTqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736454, "uuid": "24572b32-2fb2-41ca-b1f0-5e221a537a2f", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736454, "uuid": "4287987f-1d33-4d31-8034-88db33c4b560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736454, "uuid": "dfcb95fb-6bdc-4e49-8bfc-ffdf2905e9d3", "value": "bcabe3cbe7fe90049ea7f0494b0eaa4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd0df3a-a514-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703721980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721980, "uuid": "7a5e5ced-ad42-450f-844c-1f6682ba7872", "comment": "Malware payload (Mirai)", "value": "f939c71698dd2f747895865dad1db818", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721980, "uuid": "4cdb5aa4-50f4-4411-8859-6f5ca6ed9528", "comment": "Malware payload (Mirai)", "value": "3789cc2ed410b3c30fa7e6e107c96c09048735e496e170cfa3a6b1719cde624a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721980, "uuid": "bcc89fc3-fa96-4bfb-bbe3-ccf12eeefee9", "comment": "Malware payload (Mirai)", "value": "4dd2c83220f723855814150496cf4fff27ed4873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721980, "uuid": "929ef41c-d5da-4ec3-a65f-95ef688da07e", "comment": "Malware payload (Mirai)", "value": "684e7748c6fe28ca1acb46ff263427ba0f2999fedc90cf8bc86e8b88a022d55d96720df662f228a80d89f038c08e2aa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721980, "uuid": "0b259963-89d9-4215-8b21-2b6240e12372", "value": "T1D0B3D40ABF610FF7E8ABEC3745A92B05249D514B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721980, "uuid": "42a586e1-4db6-4722-9cf1-b56e6cdd6388", "value": "1536:g9DYWFx+xx+AaEPiBMR2jk2EkZ+BzYcjKoOvDBgplbngVZ14hvG:gqWFx+xUA0CR2hEkZ+BZpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703721980, "uuid": "e122ed16-5d5d-489f-961e-a297fecc2934", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703721980, "uuid": "0f36d02e-229d-489a-8926-ecd3a7f45d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721980, "uuid": "355ba6fe-01b3-4837-abd8-5ed1b4df4913", "value": "f939c71698dd2f747895865dad1db818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074bd189-a594-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703776569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703776569, "uuid": "9f9bedfb-555e-4705-904b-f7f13a8e188a", "comment": "Malware payload (SnakeKeylogger)", "value": "ed3cdb090dd5f8394b1fa75b32cc47f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703776569, "uuid": "cb483e7a-51b3-4732-8218-cdd97e93bf28", "comment": "Malware payload (SnakeKeylogger)", "value": "38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703776569, "uuid": "cf0325e8-3a1d-4d96-bbac-57d54c644f36", "comment": "Malware payload (SnakeKeylogger)", "value": "27bade0fdd724dab1e067f32bbe067671d524593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703776569, "uuid": "defe6a03-9ca1-4bc3-b12d-49f53c66c7e4", "comment": "Malware payload (SnakeKeylogger)", "value": "5499eb2a35b384ca9fb09a4c2eb2fe5a62bbcc61e3bbea8f0ba9e16b9e71e106dd245453fbe92209965c1fa389eb558b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703776569, "uuid": "7d11a707-855d-48e7-878e-a4d7063651ff", "value": "T17EB4D016ABE8437EE8F34B74F9F244A76E31F9463502DB4E2109772E0893B08569277D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703776569, "uuid": "df5aefcc-cf88-4147-83e6-effa8783f90f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703776569, "uuid": "ec5052ea-b30f-4d40-9c7c-1961ccd5c68e", "value": "12288:/VMRs+xI2TjJDDbrpsLCqxa7T4l09xHY:/KRz3NC+Ul09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703776569, "uuid": "46ecd4cf-889d-4e84-8ecb-faf19f5a40cd", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703776569, "uuid": "1b384799-7a63-47fc-a714-248e62e837c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703776569, "uuid": "36653a6d-5215-49c8-b43c-7a61c420bc93", "value": "SecuriteInfo.com.Win32.TrojanX-gen.12613.8757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d99f9ce-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805543, "uuid": "4909fbb4-dcaa-4eda-ba87-ba62030e2127", "comment": "Malware payload", "value": "6e02f63b614f45a647c403e3ad3f28a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805543, "uuid": "09c7852a-097f-45bf-80f8-0bfb47333f1d", "comment": "Malware payload", "value": "39ea757b7a623b3163f5e71ace3c77a2962c5b20ee855f1cb0cdb71704a1c1e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805543, "uuid": "aa74cc76-3f1e-489e-ab4f-9b0c03cccee8", "comment": "Malware payload", "value": "7a0270204917b688da9e3652592581280d675a1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805543, "uuid": "3dac88eb-b68d-4b77-8ffc-9175d8770109", "comment": "Malware payload", "value": "c7423e068a807f033ff25fcbb20966091264d143733e9aab1b48fde5a358c5bfed97b35095bf0c00210f841c1b1fcbfd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805543, "uuid": "b0d6992a-feb1-4beb-b3a4-64ad79fa7457", "value": "T1CBB5120D7670C4DEF01A05304CA3CED4A5D4B874BD61868B6EF85B6D9EF2A509DA20FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805543, "uuid": "47c7c6b1-123f-41b1-bd8a-16e8f3455b92", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805543, "uuid": "629e63ba-9489-4b11-abbf-38c46a84e66a", "value": "49152:VpDaZmown+0c0HVpQzoJ8NyGWaaNYI3DRfv+d:PDawn+LSzIoyYGMNY61v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805543, "uuid": "f97a7c50-523e-4718-aae5-27d355987a4c", "value": 2393096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805543, "uuid": "e853f55e-103a-4d69-9713-4e2cc898df19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805543, "uuid": "cbf1c1f1-d98b-48ab-b46b-0264614f78e5", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.19811.2090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608ee49c-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805495, "uuid": "49dc695c-8e7c-473d-b09c-15c53977c853", "comment": "Malware payload", "value": "e6222172dd80fb0c078438b7f89b8208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805495, "uuid": "6aa13cce-4e3a-45c8-b31c-a7fd15754ef1", "comment": "Malware payload", "value": "3a9d2d452230e1507fd736b035778d429838c343a4b3dce37d5993ebac2c2847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805495, "uuid": "36b6deaf-b75c-46a6-b88a-1107a57fa279", "comment": "Malware payload", "value": "ca243b1f9fc19e4f3a136d459757fad7374beea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805495, "uuid": "431fb3a5-9df9-448d-8e27-c648f7ff389d", "comment": "Malware payload", "value": "6b58bf26def1a7f6ee39855c0a55d2fc4ac210fd52336803bedd5436ae171d893aa5c3d7c9686bddc08d1c3cdbd200fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805495, "uuid": "f910148a-c74f-40cd-9bb6-4ec132569baf", "value": "T144469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805495, "uuid": "412436bd-ea71-4abf-a216-fc019714a3f7", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805495, "uuid": "0980e072-2a6a-47dc-a4cd-ac47934b6da5", "value": "98304:GS2RgblhMGi6WhNsG29KWgrlKhiqTJPOxxdp+mgulfa2FMIRavQzZi:GS2YlhtbWvE9KXrlwiIQxdp+mgulfa2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805495, "uuid": "0f685051-3204-40c1-b664-b6f80990faa3", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805495, "uuid": "5bea4e8d-161b-4d30-8985-eb8db340861d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805495, "uuid": "a6868dca-a7bf-4bfb-af6c-263a1eefa487", "value": "SecuriteInfo.com.Trojan.Crypt.21933.24096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c83ce16-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748848, "uuid": "ee5021f7-930b-4f83-bada-f6f9df641187", "comment": "Malware payload (Gafgyt)", "value": "ce5e4acfbd3a7874baccb11541ee49b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748848, "uuid": "f345f46e-7830-4c90-8d1d-a84fd79bfeb7", "comment": "Malware payload (Gafgyt)", "value": "3b231b5d034bd071e3608bf02796f65e781fd230ceca99a95196e88dc6192621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748848, "uuid": "a8acdf6f-ad71-4fc1-b65f-c0df5a508114", "comment": "Malware payload (Gafgyt)", "value": "22923e30ca6e800bbf45f9c9351cded18df4eca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748848, "uuid": "31dc6372-bad0-425f-9aa2-e38f194949f6", "comment": "Malware payload (Gafgyt)", "value": "c7a6216651b695cfad1128e57b8afd2794d47dc8f676b16975aa83c0ddab28a4a41164757f8b029bb34263ba533343b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748848, "uuid": "6fd4a3cf-7f2a-4d50-8669-60f7fa2194cf", "value": "T1D6530131B2198671C7A10F39E97F57D362AD9F39906C972A272843B508D29D2F227770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748848, "uuid": "b6a6126b-74e8-449c-895c-4932f6fd0225", "value": "1536:alOhy/4ekbEI27tyw37MWiWTPoZ+5Vzb2j2g:OH/4e0EIetzcWTnHzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748848, "uuid": "79ad7f14-5399-4a23-bca1-8447b11df658", "value": 61916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748848, "uuid": "74bdd976-c0d7-4110-866f-cb171b961ac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748848, "uuid": "5c809a06-f9f8-40a2-8c62-7cb8e2f7cd9c", "value": "ce5e4acfbd3a7874baccb11541ee49b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519eab69-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703780988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "a67958d1-fd47-44a0-8110-39d6f2a40704", "comment": "Malware payload", "value": "12ead7753c24feccc1e04c9cf9b900c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "1017426d-8d4c-415a-a738-8c7099d611ba", "comment": "Malware payload", "value": "3b6c70209cdf14416b88878295ffdd315b137df710c826c1d8f264dbe9bf7786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "50270f5e-6176-4678-ab77-7203960aa02b", "comment": "Malware payload", "value": "f38be9c651a330d2d5cb3ce1343f07a6fe12ac18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "25bcf570-1bb7-4a33-950e-fcce051ae2ad", "comment": "Malware payload", "value": "e792f824a42b995f1dccd9ddd3b5f184f3cb6cd879d7be293907567b558191e6cff38d7d63e323c40accb08432f2ef17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "4b4c8cca-0344-44bc-b531-a23a33f1f0af", "value": "T1C84633066AC6286EC589217CC702FEDF78F177B944408D1EE4785BCFEEA75A650B2807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "5d79da9b-50c9-4f97-898d-1053a02c40bb", "value": "e7a425b4a444d820f97f147fd0d11b17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "7d2e5efe-f20e-4bac-9926-fdfcf941025a", "value": "98304:f35SAxtZgV34EmYc0mT8c6YdEXaolOTNRw8KfbApsmIH9Sbx63F4iVd2GrF8:PgmtGF4XF8c6YKa2t8qcqm763yiB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703780988, "uuid": "892be167-7879-42d1-815f-64e5aa671954", "value": 5577568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703780988, "uuid": "9b9b2ec2-b526-40bf-8a42-dd45342a3433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "9ddd381f-70f4-46fa-b8e8-b6b4e0cc6c9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301fde77-a534-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703735405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "f6c7fa8e-0e00-4482-bdf9-b89fca038270", "comment": "Malware payload (Gafgyt)", "value": "b853191bd1c8432f697b307002f2862f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "e180b107-610a-4f07-846e-61a8123e7787", "comment": "Malware payload (Gafgyt)", "value": "3c8bbb947a54683a9ee17e73011470f20ac3299d3e880f362775d813e808bbca", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "bbc52837-b51b-417d-85c5-09e0389b1d41", "comment": "Malware payload (Gafgyt)", "value": "c88cfca6c84bdd6596b62c3d9de3521195ccdc68", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "180e254b-d768-4e62-82c5-513a17a20305", "comment": "Malware payload (Gafgyt)", "value": "7a23fca69b1c5399b14dc9b4b6855c05511e88101fd2721134f167cd51ce1bc15a04920319a59d7416b9aae615caadf8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735405, "uuid": "d0b64806-8459-4a78-92e1-f5600095d0dc", "value": "T1BEC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735405, "uuid": "a9db67e4-168d-43a8-b2e9-0827f8a988b7", "value": "3072:6jVlyaL5JCrIpv04sXbttiEiTmP46aQyfPlfKsNb:yoCJCN4sXbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703735405, "uuid": "04ab1f5f-29f5-4756-a057-89180d3319f5", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703735405, "uuid": "d7ea239f-6a73-4742-8c0f-ef3e931cf03b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735405, "uuid": "cf78c242-64b4-4b4f-9af3-f0b724c284e7", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00712e93-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703749928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749928, "uuid": "4c049425-ba94-4903-8db0-1227a7bb55b5", "comment": "Malware payload (DCRat)", "value": "037c2d1401aa72f8917b089844091a1b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749928, "uuid": "66cc9333-8128-4259-8eb3-3a64de1e3aef", "comment": "Malware payload (DCRat)", "value": "3fb7af8c998cbcc414afa0dccb923bbe75e68b619eaa3198d8ee216ef48f76b0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749928, "uuid": "e19a331c-3aa7-4ad5-943f-59964e40e018", "comment": "Malware payload (DCRat)", "value": "e57de05885743211ddddf370214b4bef2ebfdcad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749928, "uuid": "48ba97f1-3845-4759-844e-3401381b42bc", "comment": "Malware payload (DCRat)", "value": "a69ff3b68e4767cb092c91b72bd139b667f55941ab529e1e576c6aaa3dc5c0d8eacb7554e89439e90f6303c8e3dd95f3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749928, "uuid": "30697d7e-309c-4327-a950-f65248869bce", "value": "T1F5D523184B5FC971DABD4BB8E195505672F14B0BC002F789BAA828F00D277D8CB9667F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749928, "uuid": "eb7cfa6b-e43c-4923-80fd-1de72acd7567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749928, "uuid": "0b22e390-66c1-40f4-9e15-2049af9e11dc", "value": "49152:Ub19/FcTAfqchYMXKljgsZrUxUZUP6GXqPUmKKL/iBrhXebUjaFH9xbl:Ub19+ceMa5ZrUHJXqmKLavUIaFH99l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703749928, "uuid": "cef4cf0a-0858-4eef-862f-cf70e9e491fb", "value": 2858464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703749928, "uuid": "ad8962e7-192b-4b9f-96c3-d5b7c1aa6465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749928, "uuid": "2e7f6f95-0d4c-4b96-b5e7-7dae4f1ac88b", "value": "037c2d1401aa72f8917b089844091a1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e1787f-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805502, "uuid": "cab28ab6-4eaa-4279-b5b1-05016e47e514", "comment": "Malware payload", "value": "ae4ce590579ba525ba4ad5c539ba7a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805502, "uuid": "d3d1c8ff-fdb4-4525-b515-1de9168c8fbb", "comment": "Malware payload", "value": "3fc29df9d5c2fb8273568bd5a249333375b144e4e6050ea0098b337d3b7baa87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805502, "uuid": "bef1bd80-2be5-4c2b-8b69-e47735a190a8", "comment": "Malware payload", "value": "a864e34dad877747e2778ac9b2b3d25c4de70905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805502, "uuid": "67f44382-fd3d-4e94-bc2e-aef7f091c264", "comment": "Malware payload", "value": "f8a6d8b3430c8dcdc1f456ccf7b4885c6953bc54e71c30390e3b07cd302e3623b2abbcff0b54bd88e011c384a640c17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805502, "uuid": "617eba62-44e5-47c1-8b47-39b62babcdc1", "value": "T184469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805502, "uuid": "999f1716-c953-4030-a5c8-fe69dfd93ade", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805502, "uuid": "ee59ef7d-9473-494c-81a9-a0503419110f", "value": "98304:N60dqSD4ZaTT+wuYkQgPsthMqTVKOBxdp+mgulfa2FMIRavY9J+:N7qSMAT6OkpPs/M4Hxdp+mgulfa2FMIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805502, "uuid": "89c54ab9-f84b-4922-9b0d-e0bb7b79598f", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805502, "uuid": "f0c5e732-47ef-495d-8749-d62e5e9cf443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805502, "uuid": "75148cce-f3e3-402e-a55b-d716f156af0f", "value": "SecuriteInfo.com.Trojan.Crypt.4976.9786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b97939-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748806, "uuid": "44089ed4-842f-4594-bc40-f1abe45cf652", "comment": "Malware payload (Gafgyt)", "value": "19cf9b95c7ed32e9c6edebcd2ca4f507", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748806, "uuid": "8e9efe4c-818c-4627-8607-d94b3f482c76", "comment": "Malware payload (Gafgyt)", "value": "4049a6cf09de6a74fa0fb353292e168075248afe27f69f288caf9d5f7b21f658", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748806, "uuid": "ffd5f778-3d18-449d-97a3-148168309e40", "comment": "Malware payload (Gafgyt)", "value": "e094b5e5301f91db17d4776bc63625c99493a94c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748806, "uuid": "f29016a4-33ab-4bf4-9b0f-083e031913db", "comment": "Malware payload (Gafgyt)", "value": "5008248c7b8eabae45fde4fcd5f9f64f921de8ac0d48b3cca2903601026295e255c17cddd0f61a78eb08d47a059601db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748806, "uuid": "ce75be7e-7be6-4de8-ac8e-ee09a3366f9e", "value": "T1FC03F2E15B8BCC3280A22938F8F2050737DD5492D856B0BBDA30E336D5E7A665B3C781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748806, "uuid": "de8bb583-cb3d-4932-8d98-52078a356e2d", "value": "768:fk48dGfzUkJkvEJG2QAxgXjDN/83Uah4cyUZLbP+ms:mIfzUkJG9sgz6GcyUZPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748806, "uuid": "e9e5e5d4-36f0-48e8-8408-1fb7827d067d", "value": 40784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748806, "uuid": "923ae101-df4a-4696-aafc-71a3d11acd09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748806, "uuid": "92ab52e6-26ab-4a87-a7e1-305bb86635cb", "value": "19cf9b95c7ed32e9c6edebcd2ca4f507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b119413-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703748792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748792, "uuid": "6c8d597a-9e75-40ad-b5e3-1405d45e972d", "comment": "Malware payload (Mirai)", "value": "959208c85f1f5c9e88bf6e2e7e33cf7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748792, "uuid": "c1ae7122-e2b3-48ad-9b5c-d58ce0211cad", "comment": "Malware payload (Mirai)", "value": "406b4af7cedec2f2754a0d976cb132e33b079d35beab2b6ade7eeff190d15fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748792, "uuid": "e265c0cd-2d2f-4172-b254-911beb7b8dbc", "comment": "Malware payload (Mirai)", "value": "f696a84c9384e510efea99e0de9c01228419dfca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748792, "uuid": "9a8a2730-394c-4105-929b-0d22f44a809d", "comment": "Malware payload (Mirai)", "value": "d6f0c08e01402d96e3f2dd0841960774d97fc133feb743e6ec63ad3afa7179db69d5d75da3a84d45ba53f9a02b6e48b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748792, "uuid": "240abdd9-dbe4-4ccf-a0d8-8bd0906614fd", "value": "T18503E130A59AD000F897EEB19DE79BD4F740CBD86CE7D4D5F11386058AE4927E18F988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748792, "uuid": "b24afa55-256a-4308-8c68-ca06dd166c1a", "value": "768:Jr/V89mEukS3LpfBJDXDbr2T1RWJNSto+uqPJInnUDY4kXM4uVcqgw02NWXlS07n:JRvJZB52qj+uqPKnnUDYhM4u+qgw06Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748792, "uuid": "7282f819-fc12-48a7-859c-0b5593af9fcf", "value": 39856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748792, "uuid": "7eeaf5ee-b86f-4bf1-b8a6-4bcccdce69aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748792, "uuid": "f0fd6274-8c92-43a5-af3d-c88f67d474f3", "value": "959208c85f1f5c9e88bf6e2e7e33cf7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3a3759-a52b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1703731780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731780, "uuid": "baf4a4a9-bfde-46d7-83f3-17c8a4e5900e", "comment": "Malware payload (njrat)", "value": "8fbf3e92d90974e43c3e4f27f29b0406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731780, "uuid": "e9cad56c-8187-4c3d-98e5-966a6620d5e6", "comment": "Malware payload (njrat)", "value": "41c0edc3fbac3ce1ffb5f2493b40304f6af3c97b2fd966656ca77892766e6a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731780, "uuid": "7f5e17a8-2b6e-4c9e-99ac-4efa23386bd6", "comment": "Malware payload (njrat)", "value": "488607abb98476900e9653c5b7ae2c9bd8e09a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731780, "uuid": "1372e9dc-2d3b-4f4a-9622-980f96f1fee5", "comment": "Malware payload (njrat)", "value": "498934216ff8f1136946a5410ba5256c8aff124141ec530afd66bb95b7274b8db4a2d952e487ec466c4d5af3312b665b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731780, "uuid": "1ee32b57-eb97-4490-841f-e4bed51a6b83", "value": "T1D3C2C00A916ACFF2CE6B4AB79FA352C032315547319F1E2766D85D59EC913BC9C2A2C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731780, "uuid": "278bdd19-cc07-4b89-95c9-49440ffed359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731780, "uuid": "10db82ae-d355-47ff-8ff4-de0908c3842d", "value": "768:svpxlsvVfibKj5xcdoBQEQmYQgpdv1i3c:QxCvVDj5ONRLXti3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703731780, "uuid": "801be774-e7f4-4846-94d7-50dc194bafc8", "value": 25974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703731780, "uuid": "2211bd32-6b3a-4a4e-94c7-125c6071d32e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731780, "uuid": "3d6bde9f-b07f-4ae8-b82e-70a12fd122d3", "value": "m zcxd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaac39f-a585-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703770513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703770513, "uuid": "ac4002e4-3afc-49cc-ab73-f1e6f56650ec", "comment": "Malware payload (LummaStealer)", "value": "bf0cbdb53bbd724bb231f0b6958edfc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703770513, "uuid": "725dc64b-6b4b-4f9b-8e81-6ddb9f709fa4", "comment": "Malware payload (LummaStealer)", "value": "41d04caed8474ba34136c1e831cd345086a4fd4259557ec16f9c4cc99fb603cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703770513, "uuid": "dc3fc010-00bd-4c73-83cd-785910d2f0c7", "comment": "Malware payload (LummaStealer)", "value": "d825f3d47987356477f6a1d916a0e34cb581ecc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703770513, "uuid": "f0ae90ab-05ae-4b9f-922b-3c72d8f34886", "comment": "Malware payload (LummaStealer)", "value": "54d90bd53dafa61b96ea90bd3a6d5882e2bcb28f567764ae1a375fce27a2513121943efa4c00e999fc8e91a7ac25b540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703770513, "uuid": "4477f59b-299f-4926-a445-a3a48e2a1db5", "value": "T19703D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703770513, "uuid": "08fe99f1-89cb-4f9f-b374-86ac93795819", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703770513, "uuid": "6b3e9b4d-4b49-4ce1-874b-f2f93313fbc3", "value": 38960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703770513, "uuid": "5c6091b6-170a-472c-b4c1-2b3c2be1c1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703770513, "uuid": "654c118c-d88a-4592-b88e-254226678655", "value": "bf0cbdb53bbd724bb231f0b6958edfc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c714e69c-a56c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703759711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703759711, "uuid": "e11d0eb6-5867-45c0-8736-3c6b1cd1e1ce", "comment": "Malware payload (RiseProStealer)", "value": "22552aa59f68564328ae3a0ecb3982c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703759711, "uuid": "e273b10b-06aa-4e7f-b43c-d0127e03f899", "comment": "Malware payload (RiseProStealer)", "value": "4310f5a0b37713c8d7d799fbecdcd58efac466347999fff02e183535c67c86d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703759711, "uuid": "8feb3f6f-19bd-4f20-951d-7e3ca076d1e3", "comment": "Malware payload (RiseProStealer)", "value": "564d761ddeeba891df994119e41013a26b9d3ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703759711, "uuid": "04011cf0-b2ea-4278-845f-e5d3015272ae", "comment": "Malware payload (RiseProStealer)", "value": "c8d9b98754840f9c79e66597e9d893e6dcd43c0f3906dc3b7e42f564dfdc68fa34cdcb60d4e99ce810ca7ab08ae8f575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703759711, "uuid": "e20d9121-3baa-4228-b051-774bfbd80335", "value": "T120C53343F3D60262DCB023315CEA17D22F79BC93CD74630B6B61669E08B29A56471B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703759711, "uuid": "a4944728-2a61-49a0-ac33-13bd748d9dd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703759711, "uuid": "3cc58e16-9160-4fc6-9f4b-fecff8413216", "value": "49152:92CkbUTrCHdh1F2a2xyeN2DjgVlnHkyVYFuun3uMraR7qAe6C0J80O0/wLN6RZqe:1kFFOoeN2Dj7yao8uuJynF/wRbUUXZ/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703759711, "uuid": "7f2ca96d-485d-4fa5-9fb7-f4b0d0cb8773", "value": 2608128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703759711, "uuid": "63329f6f-76ad-4826-b2a5-884db0bf5795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703759711, "uuid": "45303ecd-4a3d-49e2-8e9c-daf315c8d967", "value": "22552aa59f68564328ae3a0ecb3982c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51887338-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1703780988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "a8a6d348-6dc9-4878-9aad-c138a70a547c", "comment": "Malware payload (Glupteba)", "value": "02d1467a9aba04c85ffd71d3cd4948fc", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "4926021f-a2f5-4413-b543-5a87f0c555b7", "comment": "Malware payload (Glupteba)", "value": "43884e22b0a3c165fe35508ae947131a0d01f306f721e5cad6903617c4ae97bc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "b2295b4f-a948-4129-b20b-829226cd88f1", "comment": "Malware payload (Glupteba)", "value": "26b3a812bae1348df07890dcbcaf95ee215be2a8", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780988, "uuid": "931b2137-952a-47b7-9c36-40177297711c", "comment": "Malware payload (Glupteba)", "value": "a47db61f16e5a3a4d11d60d44d481ebb9769b800b87306ee8cb8f0c3e801df640f1b0ddfeebc67530ed3454c04b7a589", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "10841347-ab87-418a-b4b6-6104867543ee", "value": "T19275F1FFE62C4EC6EF72EB64885219D1B868D0CE137CCB505758B9255FBE13924E2122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "b6a6b063-7390-4f63-9f4b-717d712fce33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "c83ab307-4e6c-4d55-9eaf-b5fb950f6255", "value": "49152:SN1powac0SEgTnrNlxoMbyCbzkqXfd+/9A7:SzpygEgTrzcMzkqXf0FE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703780988, "uuid": "3bb8316a-3dfa-444f-8d58-f16e458e388b", "value": 1652448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703780988, "uuid": "796df6fc-3aca-4e29-b55b-816453b3b46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780988, "uuid": "8fa37be7-f91d-4a99-a931-ab07b8b744da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876fc806-a584-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703769912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769912, "uuid": "146e3d15-cb47-4e6f-abee-ddeca75f9d17", "comment": "Malware payload (RiseProStealer)", "value": "dd9c8943dd86a1589b3f7a1eb46f124b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769912, "uuid": "d449ece9-5e14-4ebe-89ce-3846116e89c2", "comment": "Malware payload (RiseProStealer)", "value": "44d85e7e0e05ce06956da634a3f19633f1393bf7f82f1faef84e2c4e9d57af5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769912, "uuid": "ca4f5538-d717-4920-8f4b-420552146411", "comment": "Malware payload (RiseProStealer)", "value": "ef2ca05a8169b4a2e2c56f5f00f754bb20076f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769912, "uuid": "c13abc05-a8a0-4329-937a-7dcdc68e292e", "comment": "Malware payload (RiseProStealer)", "value": "aed50ca8e87612f33cc7fbe6865d6053f79f7f123ee96c2e587560eeb55fc1da4c019f6f478736050dd3013e6db3efbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769912, "uuid": "cec9696d-f005-40ea-91a7-ec57cd541bcc", "value": "T16CC53383F7E501A2DCB1233558F913D31A757C93CE38634B2B71668A48B3AA5353276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769912, "uuid": "da23b109-97c0-43cc-9130-6491a5234ddc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769912, "uuid": "274239f6-47dc-48df-a4bb-1050af0e8739", "value": "49152:RW8s9Buq2R5aBZ3IzHgY2EdHycYIXfnSd6Ea7uTlVFe0Nalj936LPtZ9q2yP6lfL:zDqQiZ3IzHHyjWqdBP5Wx36zwj6lf3vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703769912, "uuid": "28ae243d-06e5-4805-a11d-45a4e212cece", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703769912, "uuid": "e8bb7184-4d0b-4203-978c-280d25d80326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769912, "uuid": "e0a54830-8a68-4c63-85ac-e1dbda488dc3", "value": "dd9c8943dd86a1589b3f7a1eb46f124b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628e112f-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703750093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750093, "uuid": "3dbe0277-da6c-454d-93c6-9a0a931f7536", "comment": "Malware payload (RedLineStealer)", "value": "f2b70985c1860b87ede3aedce879efd1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750093, "uuid": "15fa26b2-12a1-4d45-b064-8aa9f3830392", "comment": "Malware payload (RedLineStealer)", "value": "45ce1f6a67cd9257d890047f5f866cdc55c50fb9bac165a5e33eb4a586d95496", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750093, "uuid": "d83369e7-88a1-4f27-8b13-f562383068ab", "comment": "Malware payload (RedLineStealer)", "value": "57dcfe594baea2c8e54a28797de6d4ef16306943", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750093, "uuid": "190a4c96-743f-4a90-b2ac-16ee10d832aa", "comment": "Malware payload (RedLineStealer)", "value": "a63a90d87e9808e471d84a0dca97ef7ce485a2119b943372684f3dd933c8ffb3fdf1f011a756c0bfdabaa3d51be10340", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750093, "uuid": "f6f0b2d5-f28e-4ac8-8e51-976a414ce85a", "value": "T1F902DE2136FF640CB573AFA61FD9BAF55DAEFFB1561A506D2000030B4A22D54CEA2736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750093, "uuid": "f3369e60-ca78-4dab-aa02-3d202dbe2eae", "value": "192:4zBdGnBe+E0rzBdejsRUC4nBeTVQov1l+QoFx32Qoz5nBeGN:4vGnBDv0ZC4nBCWov1Ror3boz5nBXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750093, "uuid": "0b85763b-2f23-471b-b60e-614eeb94e291", "value": 8512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750093, "uuid": "0ea0b9ef-5c9e-45ea-b34d-be481b5add67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750093, "uuid": "2ff24f14-e2e5-40ef-8ec4-a4331860e82b", "value": "confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9163549f-a529-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703730844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730844, "uuid": "f16a878d-e39e-4e50-a130-ec1f8962d38e", "comment": "Malware payload (RedLineStealer)", "value": "880aa4e6aad34cf4705907a9ca8d6b5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730844, "uuid": "c3e4c8a0-ba28-41f7-8bd3-51b46f1186f7", "comment": "Malware payload (RedLineStealer)", "value": "462aa03cb4d72a816097c836c0a30545b49c173537aaa304ed584c9f3366e021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730844, "uuid": "5ce2ae45-e20d-4356-88b1-2738454b99ec", "comment": "Malware payload (RedLineStealer)", "value": "68c80be5c28047516b753f4ff0ad2bbb9e86142b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730844, "uuid": "ff3fcdab-e32d-4ac3-bd66-20e3416b8203", "comment": "Malware payload (RedLineStealer)", "value": "be5360a329a591145c7b5131b70beec113fc924902f6d46a066409233ae15314fdd6cc051f44d53ec34f8f5f106b7130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730844, "uuid": "754b5321-47bf-4a13-8342-5a1a5c42d5e3", "value": "T1AC747C1877ECC922F23E07B595F0D2B59375EC52A452E31B5DD52CAB3D22780EB012BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730844, "uuid": "8d986e23-a946-473e-811b-e2362a8a1c85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730844, "uuid": "b406fbe5-7136-469d-afea-61e77fff1dde", "value": "6144:9obMM+tBV1sx3SAXVMRqT6D4gL3YBmT9om:p1GFMsW8g742F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703730844, "uuid": "8a07cedc-a9e7-4720-8628-1c14471838e6", "value": 357200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703730844, "uuid": "03c21618-fdfc-42fc-82f7-f249238ac667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730844, "uuid": "cfd03286-7694-47d6-91ff-4f6304d18ff6", "value": "Yelts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6b7afc-a5b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703788687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788687, "uuid": "92a222fe-6ba2-4b8e-931c-32bf4a75cf51", "comment": "Malware payload", "value": "9afaf589e43fcc98ce95624a8ccc9d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788687, "uuid": "4756e13a-c759-4894-bbae-64c0fb648337", "comment": "Malware payload", "value": "465c7b3acd3143fa4bdfe6d11907346bcdbdfe5b0797468c3407a81ca84de967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788687, "uuid": "4afd1ecb-2650-4a8f-a463-8edc297f6417", "comment": "Malware payload", "value": "89b677b5fdb431c4d5a0dcdac9266a9c54077103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788687, "uuid": "78549197-25b0-4171-82f9-8e30acd8d492", "comment": "Malware payload", "value": "5301f96ff450a2eda2158d06525f41fa20e49fb6e464c0163fe099e2a3410e0cfe6545f23d295c0669a2e1c76e32d737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788687, "uuid": "ebd47d14-8791-4828-9cc1-c760af9c1bf4", "value": "T1C3D22A0A1AB21673F0D8453854CE2F3F71FF86B365584CF0FB662A9D14E1292B26EA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788687, "uuid": "a6380369-6afa-4e35-bc57-4e15f90fdb86", "value": "46084168b412e051097ae39c055c9320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788687, "uuid": "eb0fbfb1-3975-42f3-b1dc-d41ea2aefab8", "value": "192:mj/SHiv8S/NWITnL2tA9yNzJ0ANdOdSRST5nP1o:m98wWOyO0/OdSRST5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703788687, "uuid": "3fed07f2-716a-4797-aa6b-6608d0ac5903", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703788687, "uuid": "3ad81cf8-1bc8-4e8a-8472-79f4d1a70d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788687, "uuid": "20aefd83-dcea-4b2b-99d8-a072d86ca565", "value": "89b677b5fdb431c4d5a0dcdac9266a9c54077103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75998db8-a51c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703725214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703725214, "uuid": "74ff9867-fb34-4b20-8033-204eb6862cb6", "comment": "Malware payload (LummaStealer)", "value": "d470377f9b683b10aa2230b05a5fcdcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703725214, "uuid": "b3eed734-86a6-483a-ba66-35d23a6730df", "comment": "Malware payload (LummaStealer)", "value": "46ac37f4635f315ac0e174392855fa549410746e8826b2d3b066d2352b1d6ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703725214, "uuid": "eae03ca1-154c-4e85-99ce-00269864033f", "comment": "Malware payload (LummaStealer)", "value": "4a0cad3fec3871f69abb4217f1793db5499ea049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703725214, "uuid": "acf0478e-d6bc-4d38-91c1-573c866fd00c", "comment": "Malware payload (LummaStealer)", "value": "422eef91587a2137a83ba7f67fae1fe4ca4c12988e8d7aa0f5792a08d6f438f7b0e69cac195d406605b4536cde776200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703725214, "uuid": "51fcb41d-dba5-4b96-a99c-a3cd597248e8", "value": "T14DC53383F3E60162DC7513305CEA22C31B757C97CE74A35B6B61128E49B3AA9357272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703725214, "uuid": "d19319d5-ad94-4a39-bff4-40baffde43be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703725214, "uuid": "ef4b7f0d-fa74-4df7-82ee-aabd9d2872d3", "value": "49152:/VQlMW+hFp202ey0+dlagJTy7wyYYLysn5uaRa9ZfP3UW0vSckwc0LoDZoqOCzAZ:WSWMp+V0+dlaeyXuWulPMlrc08J9zA2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703725214, "uuid": "6e7f37ff-893a-4b5b-a38e-6666c04c37af", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703725214, "uuid": "49999af4-4fff-4a95-b4bb-bf86bb73db5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703725214, "uuid": "b8faa129-f44a-4813-a8ec-26cf8cf7c9b2", "value": "d470377f9b683b10aa2230b05a5fcdcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a285bf-a5a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703785072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785072, "uuid": "979794fc-3651-477b-920c-15fd8c890ebc", "comment": "Malware payload (Mirai)", "value": "80891a92da0d49deaefa6494afc2f7aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785072, "uuid": "bc58b42a-4aea-45f1-a8c6-6c2f611a15e6", "comment": "Malware payload (Mirai)", "value": "4703310eb638325269ec0df43333f49a3389a3e053ad0992f455fa8f13bec8d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785072, "uuid": "2e9db3ef-6fea-48fb-a6e0-33d75f7445f3", "comment": "Malware payload (Mirai)", "value": "1db706a4fffe6345b8594b87ce0d88f90b6afb15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785072, "uuid": "0a2180c8-cf06-4fc1-8a30-254a00cd5bf1", "comment": "Malware payload (Mirai)", "value": "8d3fad3f6d716d57bd7747dbd2a081c430c95deaea1093f7320d8e82442a5b7a3d644e82c5a802ab7fbdcf7eadc97961", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785072, "uuid": "eeab9822-4a80-41bb-87ae-fad01fdbe3a2", "value": "T1D8334B26AA791D57C0E8647A62F3432AB1F6224F64B88B5D7D720F9DFF605C0A40B1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785072, "uuid": "e2a4820e-88bd-4a91-8153-ba2c32b944e1", "value": "768:/w7oxx6VghmSjgaWla3NrCkJdinO+CyzllCFEDD:/w76x6V2mSjvWlaHJdi7d/CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703785072, "uuid": "52be004c-c322-463a-8758-871b2eeca624", "value": 52104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703785072, "uuid": "fbbbfb4d-7548-415e-b182-735b26c5f42e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785072, "uuid": "6645e45e-8cb0-4d66-bcfa-77e5f0f7c4b2", "value": "80891a92da0d49deaefa6494afc2f7aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cafa02c-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805515, "uuid": "56210d29-8053-4f99-933b-11663e88c7bc", "comment": "Malware payload", "value": "549d89b8a2026aaff9f6b25e433f1b43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805515, "uuid": "2a92f6a9-7e96-4fdd-a65e-77ffa5f24836", "comment": "Malware payload", "value": "4791854cf92006b32c05dda1b9f14cf53daa70ce468493dbc3897906c6d8341d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805515, "uuid": "df585702-89ad-4c0f-ad2d-8784c46cb45b", "comment": "Malware payload", "value": "602be289ad577b3ab75510c0d124fe543c217cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805515, "uuid": "eae24c5d-d6dd-434c-97a0-29cc2d1c0a3c", "comment": "Malware payload", "value": "d6449383f197f1957fb81bfa6a884136ec0274c84c8c8787118f862aa56c421127ec4d4b76239a7ef83786ce697a07a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805515, "uuid": "3a695d1e-6bac-4466-a882-91cc144c1be4", "value": "T1EA469D379E1D5CC9F90134719C1A8FDA2994AC21B5086B9B75C1B969CCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805515, "uuid": "f2b9a80e-6a2d-4402-a992-c79d21871446", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805515, "uuid": "eb905318-0120-4d17-84c6-9c5e32dc340c", "value": "98304:yAmjhY9uvD3817VN60gHx6h7qTMAOqs5x+eovVbiNR44anz4VhG:yxhYAr3UH61Hxg7Nms5x+eovVbiNR44e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805515, "uuid": "8bd0c488-ae85-4f4b-a850-4c65d83884a3", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805515, "uuid": "2817291f-a215-4aed-a3a6-91a2f9b8c20b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805515, "uuid": "83c4932c-2b24-44c0-a50a-beb03f193f73", "value": "SecuriteInfo.com.Trojan.Crypt.5090.26576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d7c8a5-a5d1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703802849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802849, "uuid": "90ecf17d-d9b6-4301-8d55-d5019fb0cb6f", "comment": "Malware payload", "value": "0e0632d21e879cb4f5d6196a404599a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802849, "uuid": "108ad675-60f0-4994-aafa-80df1d417c68", "comment": "Malware payload", "value": "479a100fc558984bbcc4d1d429742e3daea1ff8e395eadd2a97e0600cd8a7027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802849, "uuid": "418ac580-dd52-4f1e-b0f1-54ad179fa630", "comment": "Malware payload", "value": "a321163783ff8f6434edae89a3b4de1835638abe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802849, "uuid": "01d7dea8-025e-4971-9bee-1069640b83d1", "comment": "Malware payload", "value": "6b9d969dd991e1754c43e2abf7de011bdfbae4417ba3f99d0bd7e0ed370f9a31ab8c23bf5d3963ead95a5f0d8011ba81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802849, "uuid": "b3900012-61a3-46dc-a5d8-bccaa0e3c5d7", "value": "T10402E906A7F84229D5FA8B7C58B2430083B6F693A633CA0E1CC501FD9D61B58CA537E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802849, "uuid": "efca7002-83ce-43d1-ad99-e3ded9ebda1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802849, "uuid": "3c777474-f763-4325-8bde-6c464f997fc5", "value": "96:exNlv/rn2JKbqXRh9AuxipOe9gV579WbhRN6ylfwls+VsKbN+EhkhG+9MXzNt:k/rn2JKb+Rh34o9WbhRNNWsUyQIMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703802849, "uuid": "0ca919d8-67aa-44bf-8da5-c53261f50516", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703802849, "uuid": "82e53355-65f5-4451-87be-c79d7bff96eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802849, "uuid": "b5facc7a-ca9c-4049-b27f-14174ceef0f0", "value": "Cpanel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aea23eb-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805485, "uuid": "b09e486b-8ea3-416f-bade-2e313b058969", "comment": "Malware payload", "value": "e26159f3d33e0a7e087881e92b9959af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805485, "uuid": "d26fced3-7451-4430-a007-a2e41373e95c", "comment": "Malware payload", "value": "4aa9e283503100fe94c6516eca4ee0e3f7293a82f782412dfaca3409959d15d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805485, "uuid": "3c4a15eb-cab8-4ed9-99b6-1c57c5d3929c", "comment": "Malware payload", "value": "33c2dd43cc789069948a19237cc7708ac5586524", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805485, "uuid": "a07134cc-7002-453f-8d91-a656f043393f", "comment": "Malware payload", "value": "e329a5d94e6e4d7a4c0d616f50a7034f70d19d97fa110c08a4e51230a898ad4b55b643cdde07e29f99081495bad5a521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805485, "uuid": "c067ae7c-3e9c-4fa2-a5ce-2f341191de02", "value": "T16774D1E273F4D405F050CBB4948A4F122F79B97113A8E64EE9405B4EE973A92A321F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805485, "uuid": "ad4bd872-d390-4b88-b7aa-281d8c073112", "value": "eedca3cd4d5f133b3c1ec5535d19ee00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805485, "uuid": "3571348f-abb1-4138-bfbd-1abb585e602a", "value": "6144:qwjZBZHzhRvCCM5wBvbuV523wq6txm1XtCBofHBy4LzYfw1UF:hjZ7vLMKVZwHK1XQCfHByo+weF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805485, "uuid": "4e57bed3-2cb4-4687-bcd3-1703b5c49e3e", "value": 354664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805485, "uuid": "db1a4175-56a8-40f1-bf62-937b7f7d3204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805485, "uuid": "9474b459-e3b9-49f9-986d-b39f07891aae", "value": "SecuriteInfo.com.Trojan.TR.Dropper.Gen.13342.19149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9705685-a51b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703724979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724979, "uuid": "fb96fe35-5335-401e-af13-6e9572c799a9", "comment": "Malware payload (Mirai)", "value": "7eedcbdb51d7b49ca9e7e90fecc4fa2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724979, "uuid": "95b2ef52-9ef3-4b41-af05-cf317a638428", "comment": "Malware payload (Mirai)", "value": "4bee7a31766503ab7283bcd614f33258955eded7cd7f55208b15f3bba263c615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724979, "uuid": "9708edbe-953d-4f8a-9f01-076967e79638", "comment": "Malware payload (Mirai)", "value": "3f6c6b4a0a6c3dab01ce6c602b6ce71c2f04941a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724979, "uuid": "16f440c2-5e4a-4b2d-956c-24bcce3f23a9", "comment": "Malware payload (Mirai)", "value": "9e07b7fa573003e37902c0706b10a79a5779b44042024e9489af75c1d8293a608db244d8f2519975ecb45b7f3e9a0b20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703724979, "uuid": "0c307300-6845-4231-a0a8-29460a6f8484", "value": "T1C6A3D71E6E218FADF76D833147B74E31A39963C627E1D641E25CD6001E6038E685FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703724979, "uuid": "f855d3be-687b-45dc-a4b9-f3a875dfac21", "value": "1536:hBw2j5GjUS66hZbSXf4AFuWzQBW3eWGneWyPFj5/oN3Sze9vENuNvFxJ:h24GfSNcWzFj5/AS/uNNxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703724979, "uuid": "83555937-30e8-493f-94aa-3400ff5067c4", "value": 101320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703724979, "uuid": "7db73d75-fbf3-4982-bde1-994bf4584630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703724979, "uuid": "af276e1d-9a21-4738-9fb0-a3e68a0f5f74", "value": "7eedcbdb51d7b49ca9e7e90fecc4fa2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3298b9-a5d8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703805915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805915, "uuid": "5bffc3e9-a8b4-47ce-ae40-0e3d9b0fe7b0", "comment": "Malware payload (RedLineStealer)", "value": "cd4535bcc370daafcea1feaf3e8704ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805915, "uuid": "11e0fb46-4387-4d8a-b4f7-73e64fcc9ec7", "comment": "Malware payload (RedLineStealer)", "value": "4d49d50b59d87b380045384e5b23ddcd57ee91c3cc52c63457fe94554f67cd3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805915, "uuid": "d66f1669-14b6-4ff3-ab93-46130b159e64", "comment": "Malware payload (RedLineStealer)", "value": "5148317b1070e76b0dd9378a7bfdecccc73a0222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805915, "uuid": "bc22eb7d-6f66-462c-abd5-9aad83f94b14", "comment": "Malware payload (RedLineStealer)", "value": "d3f8faa51cfb3a9b4625b12200089e38dd03a1c5904359267c44167f717c98a7fc62ab2f4b9bab4835ee22e2fe13d488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805915, "uuid": "b2e38c0e-a453-4536-8bf3-e7cd6d9ddd03", "value": "T105C533A3A1E40276D8B9977114F71AC72335BEA19C74224F13205ADE1CF75E22D1FB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805915, "uuid": "f64cb6da-7def-4a5a-ba8e-1620fedaf8b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805915, "uuid": "7a4dd614-625d-4488-8fd7-117a3189c148", "value": "49152:A+QInJbeYnVWRf2RbXFXapGdbMiGJJcnmgdvLZz9bJ8BDT4QdqU5XTXf8:RQbYKfiVX2Gdgzzc3JYHqU5XTP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805915, "uuid": "ec3f8a7e-faf7-4126-9bcc-32497ce39d44", "value": 2605056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805915, "uuid": "ef82d2d9-eac6-4e6b-8d18-6c7de77a0792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805915, "uuid": "35f0ebe9-f823-4302-9600-c688bddddf03", "value": "cd4535bcc370daafcea1feaf3e8704ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc7269d-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805542, "uuid": "b6f8f634-1150-4401-9620-1008defb737b", "comment": "Malware payload", "value": "57fb169bf11a758658ac6b2a4ba8ef2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805542, "uuid": "a884dd8b-8662-480d-9fd8-13513b3e376c", "comment": "Malware payload", "value": "4dfd9f2ce0b1466c0022a3cfd02e085312493aaa6690b9716eb22269781307f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805542, "uuid": "77bc114c-4c3a-4832-8a4e-1718474717e0", "comment": "Malware payload", "value": "dac74e6ff48e68936fe0b07efded57b80eca78e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805542, "uuid": "ca6ccecd-d6ba-4e5f-960e-d5cb18cd26d1", "comment": "Malware payload", "value": "abec7b288c356fee3230b13d217a7f26e7ef74ce1d03669bc6790e20919c9ebd30a577fdbd098e6979e8abd01e0cc389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805542, "uuid": "c29ffc48-7ec8-4eda-8077-bfb4eee0d3f5", "value": "T1BD468D379E1D5CC9F90124719C1A8FDA2954EC21B5086B9B76C1B969CCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805542, "uuid": "eb70f450-a940-4431-8830-84b93703f74e", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805542, "uuid": "60d6a4c6-1235-4681-be2a-c2c448a32175", "value": "98304:bBXI6SwRawU1BkDWaQ8gAjmhQqTDrOwVNGduIdlzCb5nLXRBQ3hK:bB3SwoH165QNAjcQqVVNGduIdlzCb5nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805542, "uuid": "773beedd-df0e-4f13-ac48-2359d1fd9d07", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805542, "uuid": "ebf0e256-91aa-45e2-b345-4975ed101af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805542, "uuid": "413c4f04-9231-4a17-ae09-2ea62896106d", "value": "SecuriteInfo.com.Trojan.Crypt.32315.21312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78421a3d-a5a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703781912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781912, "uuid": "3bb8019e-21e3-4a1c-aa9c-506488d9bb91", "comment": "Malware payload (Mirai)", "value": "d8024a5bd2e30d4f7a0dd27e362c8c01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781912, "uuid": "7d9b274d-3336-479f-b1da-c2cec6d98652", "comment": "Malware payload (Mirai)", "value": "502b934adfaf4a443897ec3dda6710ccc60a142f0e5ce3e3f4b190ae8ba687e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781912, "uuid": "15355527-e88d-4c1e-948a-5b95cf624ba8", "comment": "Malware payload (Mirai)", "value": "b4ccc23ec0166f12017a59d41a6125341aeae96b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781912, "uuid": "81af8dc0-dbcb-47c0-8395-8e94371d3c4b", "comment": "Malware payload (Mirai)", "value": "fde0118ee69ffc9d2a78c099d0500107723a8a37a04b8282f49ff678498c1ea7da9eb185490fa89f9452487213e86cce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781912, "uuid": "6e8253c5-225a-4b16-97cb-e0c121e86d8d", "value": "T179237D73C86A5DD4C6944974A328CE3A1773D418E2972EFA5A078A76900BFDCF0093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781912, "uuid": "1c1dbf55-5337-4657-a73f-1be8c34a88cb", "value": "768:sBbYO9FeDmjgDCUVO1Y9PLcCQo2lxtFCLpir/:stT+D1VO1Y94s2lFCLpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781912, "uuid": "caceadf8-8de5-4e7b-8c34-2b7613a6a775", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781912, "uuid": "6109e0fe-ff06-4046-bac2-acd0206d7b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781912, "uuid": "5e8fe62b-7619-4134-9ef8-55fe50660510", "value": "d8024a5bd2e30d4f7a0dd27e362c8c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5476ad-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703781011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "124f3770-73d7-4ae6-984e-a7cbbcf920da", "comment": "Malware payload", "value": "64d5c80905425c161526e00e77e407c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "ff48e1db-8361-4091-9c4f-e1f0f833aff7", "comment": "Malware payload", "value": "50da3adff9e154d3e08997f592ef7507360d5f2f2d6569963aaab1c6a88e53a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "bfad5977-e4d8-4ddf-94cc-33a9896d7d30", "comment": "Malware payload", "value": "2c345de6a8a267fbaccd94600ab63c7edc7d4d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "4cfadc12-fc26-445d-a3e2-0d16b99b132d", "comment": "Malware payload", "value": "f947f651ef9a78934d81d898654c913fb45369a478b540ac84a0c4f085cdb963eee520a097a3a25079c81d3c85777206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "ba3ac7d2-374f-43d4-833d-bb0e2746746f", "value": "T179645A89A6C3A1B9FA434131016DB73FAF3647156A20CDF7CBA0DCB05862691DA3E71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "43b854d8-fe96-49e4-8118-7e53be03cbf1", "value": "d7dafa66f3e3aabd6741e795c2c33a0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "2ed1155e-ebd8-4bd4-970a-9449efe34e10", "value": "6144:soFqsl6IVJdr1xrKXCDkyGpMzDUWcWKk7QIiSIsEu+a5iTYpg6vqv/ej3L0jmut9:TqsTHf/cm7QIiSXEu+a5iTYpg6Sv/ej8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781011, "uuid": "74b6d1b5-6bde-481f-97d4-01da801c7fce", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781011, "uuid": "ec276bc7-b7d8-4e73-8df1-94e22b97e958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "ad428c0b-d95f-4d00-aae5-dfb782dc12ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4327326-a579-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703765289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765289, "uuid": "675222ee-8ba7-40df-8903-7d8f3b130abd", "comment": "Malware payload", "value": "7af5ffd4a3e20904b14c148ccd2e20e1", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765289, "uuid": "cef90166-01b9-4aa5-9834-5c7b476ef6bf", "comment": "Malware payload", "value": "5269a63131b0732d90509b8f9df91ecbea7c6021a1053fc2cc2a23868fbb07f2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765289, "uuid": "2db1be5a-79fd-47bd-8dd0-fe2ef8f32f54", "comment": "Malware payload", "value": "7f75f0db0b5593b81173602e756985567f4c040e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765289, "uuid": "b7b9636e-52b4-4d81-81bf-f8dda3141ecd", "comment": "Malware payload", "value": "f8f3bebe55df50927b3421d46fe27807c3b48536b2fe0d7473f869b4c15dd3d1719b85905765e4b54517e90e8fbe2fd9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765289, "uuid": "c3148bf2-9548-4357-ae39-050183b1b463", "value": "T1E4152388F1AE5A1BEBF680BBF5F40EC3E641008163175CA4B91DF80E9F613F1626754A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765289, "uuid": "ffce8a60-2804-49cb-912b-dfa33568cce7", "value": "24576:tllvfSnmjdNwOFCy6sFIgZlbF0mSXOc/j9I0:tlbjD1IJsF0Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765289, "uuid": "4f207d71-0964-477a-a746-183ddbb0c896", "value": 878938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765289, "uuid": "a3b42f89-31ed-427b-abe6-d65caa817106", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765289, "uuid": "c8bd0f97-f599-4807-870c-d56fd4d4b962", "value": "meowbrek2_1.1.2_TS.tipa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f116287e-a514-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703721985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721985, "uuid": "94a28080-1aad-498b-93b0-f70893f09b8b", "comment": "Malware payload (Mirai)", "value": "7a39b22df5db4eca5d1841f6e48933bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721985, "uuid": "09e4fe35-eab0-450c-b825-4b10ff2557c5", "comment": "Malware payload (Mirai)", "value": "52a1bc9e47f61a3e1ab869bdfcdeeeb653e3c5e114a21187a4d32a2f3149ef25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721985, "uuid": "b424177f-fcbc-465e-9082-3504f4242e07", "comment": "Malware payload (Mirai)", "value": "ed323511649671aa7eeb321083894355b6e9949d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721985, "uuid": "f8869966-d072-4607-b3f1-afd371e03283", "comment": "Malware payload (Mirai)", "value": "ef701c1eb40c8265365d2fc523dc5289d29bb610930debe14b845c0cad9215ae70d78aab47309e74e4375d1c750dc61a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721985, "uuid": "b1f7a483-b960-41e9-bfd9-2b8586a3590d", "value": "T18F73AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721985, "uuid": "07dc0353-0668-422b-a971-6232cf339b17", "value": "1536:9aD/MEGvbwt+i7EhHcnn8C/0rrnmF5lrKkNGIkFgCJl2c:9OkdzeEh8z0rjklOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703721985, "uuid": "478ef9f8-09a4-4a99-83a9-94c1f68faa7d", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703721985, "uuid": "8c9c2a3f-7a26-49f7-b72f-12950d6b429a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721985, "uuid": "cf063012-d738-473a-9fa8-8dd2b4a98b36", "value": "7a39b22df5db4eca5d1841f6e48933bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19404c9f-a52c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1703731931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731931, "uuid": "66d0f0fb-c3da-4599-b3ff-e8eb45f80efe", "comment": "Malware payload (AZORult)", "value": "baa5fbc91623902055e3f536c616d486", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731931, "uuid": "5f0c4124-f246-4041-9736-2f5d73413804", "comment": "Malware payload (AZORult)", "value": "52fb21f13b9e10f039a34d2233d7deff597bfc9a575d165a3c3fde200fb4100a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731931, "uuid": "f56e9804-5237-4a72-8f92-f6359151ddcc", "comment": "Malware payload (AZORult)", "value": "23b8a9905f689175918238cff9982f22874b0a42", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731931, "uuid": "f207afc8-237c-409f-b85b-576eb079af3b", "comment": "Malware payload (AZORult)", "value": "0752c97b9c6ac2b5d7fd51b17772fb16ee192fa50f18a7d80f720cd6b25390f4adb8dab2220749d068fce8c1790471bc", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731931, "uuid": "12eaf018-8fb5-48db-8b4d-678f146c22f8", "value": "T114F4120271F80D03F9BE7B31482875943569F91A9428E1FA4237D77E9B90AD19D323EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731931, "uuid": "56250973-a8e0-4a50-a8b8-5de407bf40be", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731931, "uuid": "20efff91-a748-45d6-8c4a-6576958ba28d", "value": "12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi75E:arl6kD68JmloO7TdNaPymUi63i62xHLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703731931, "uuid": "202c36fe-3ba4-4e45-bfe2-cf3dafd47ba2", "value": 738432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703731931, "uuid": "8cc21056-d05a-4d47-9799-756737460fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731931, "uuid": "b264f14b-d3db-4ab3-97d7-880d3610c88e", "value": "AuditPolicyGPInterop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a28b26-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805537, "uuid": "7f084417-908a-4906-8159-44a34fa01944", "comment": "Malware payload", "value": "1c9a339818b864ee8351367f57e53927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805537, "uuid": "e0a221a5-82b6-4ff2-9039-02367ef42342", "comment": "Malware payload", "value": "54a8de008bb74d6bb4897197da7485a9aae4eea0e02ad6def97921ee911d2d39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805537, "uuid": "36bd0c7e-19b2-43fa-a2c4-372c459c754a", "comment": "Malware payload", "value": "3b7812f558baaf509ba65fc0db6f5ba79d0d58ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805537, "uuid": "546e7f7a-73ec-478d-bc90-291e976b3b9c", "comment": "Malware payload", "value": "3fa5ece8c9a84a04c575f00e598722f8d05dc27a14b293e9b126e15122c752d844fbd64545e4e4e9977a8cd3e7ae45f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805537, "uuid": "54f0264b-30e3-460b-bf14-0774a210ee41", "value": "T163469D379E1D5CC9E90134719C5A8FDA29949C20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805537, "uuid": "708af51d-c301-4413-8db6-58a553e934bc", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805537, "uuid": "ddabe063-1918-460d-bfe1-e20fe43da6f9", "value": "98304:TWDZe1YzJ2e+aoCZz1ggn2hMqTmROllpxeeoiVLiiR44GqmIphm:Tee1wQeZfzOgnsMXGlpxeeoiVLiiR44w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805537, "uuid": "9ae1a29d-69af-4add-bd35-c1ed9569a61c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805537, "uuid": "5815e54b-0233-419c-977a-881c8ad72bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805537, "uuid": "68e802e8-6bda-4110-ac14-e3b9a133def2", "value": "SecuriteInfo.com.Trojan.Crypt.11715.19406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40109e66-a57b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703765926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765926, "uuid": "9248fc7c-cd00-4ca0-bf4d-ae3f2044e561", "comment": "Malware payload (SnakeKeylogger)", "value": "a49c8e41e81db9a91f28b5e25c9215ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765926, "uuid": "081c2f8e-0255-4115-8fa5-8d5fc92b6dd7", "comment": "Malware payload (SnakeKeylogger)", "value": "576ca0fbe491aadd6c66a937af35e94d616d9dd9c079b3c7c617fa25b7010700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765926, "uuid": "b7ca3fc5-99bf-4159-a11d-ff2ad803cc13", "comment": "Malware payload (SnakeKeylogger)", "value": "c50e5181bc5f09e07b281451fc11d04d913e5069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765926, "uuid": "045fedfd-14c8-4174-a6b0-fdf9efd8e070", "comment": "Malware payload (SnakeKeylogger)", "value": "7036e1b32b1135a518eb9798052437fc508b54dee4f373588b27cd53e46b56117da12bc78c331f8cd0063db8f4cf6419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765926, "uuid": "17e3fb99-2225-4787-b207-0e962b081047", "value": "T1F0B4D005ABE8437EE8F78B74F9F244676A31F9463502DB0F2608772E0893B48569277D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765926, "uuid": "e9827afb-9ca2-48f9-a607-268b15b2a742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765926, "uuid": "ddf8c897-948b-4ff3-a4bb-8b801f121130", "value": "6144:j2GxGnRTs+BIcvteOde7fz5DDGMlyCpsL+woXxLm7w0FeIZR4Xu/UG1AH3gB4:jJMRs+BI3OcJDDbrpsL3qxa7Nj87H3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765926, "uuid": "3f58e333-6836-4a70-9c32-a4abbc82c7d9", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765926, "uuid": "4c47b5fc-e12d-4034-a5e0-2be4861ca379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765926, "uuid": "b3b4bad7-7c84-45b2-b0bb-d76bf625d481", "value": "SecuriteInfo.com.Win32.TrojanX-gen.18269.31801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ea127a-a5d1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703802794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802794, "uuid": "167fe8bc-1655-472d-b44f-dc16b8ad6fde", "comment": "Malware payload", "value": "825a12e2377dd694bbb667f862d60c43", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802794, "uuid": "a0050fb8-48db-4f62-99f0-09176a41c40e", "comment": "Malware payload", "value": "593583b312bf48b7748f4372e6f4a560fd38e969399cf2a96798e2594a517bf4", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802794, "uuid": "51682161-73ff-4118-804a-07c6f62e4363", "comment": "Malware payload", "value": "4018b68de4b2eda4a831852df158a7a756470aaf", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703802794, "uuid": "e644b2d1-ecf5-4564-bd72-24278124eb82", "comment": "Malware payload", "value": "3f5d61b457605c71cbb834f1aba9e66866681f21da5f93a4d4cef19f451e49a0fa1a7ecc86b93559e9ab5846e7c3d61b", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802794, "uuid": "221caba0-39bb-43e1-80e1-1df42ff95a57", "value": "T153416B151BE15719E3B68B39ECBAF3058272F911EE46CBCE119091585C25225F874F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802794, "uuid": "d2408b75-31c8-4c94-9926-bf8d22bb3c69", "value": "24:8mcHJ7IZWqCD88C5RK20ELW9AIWkp+/CWP2+/CVma5ZkWSrLRnSP8TcMpK6+/C9n:8mwJOWqCDy9012gDZKrFTBRX4q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703802794, "uuid": "0a22332e-0f07-401c-93c1-47a538ea6308", "value": 2136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703802794, "uuid": "920a8ce3-d0fb-4577-8f98-8a7eddc81ff2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703802794, "uuid": "aeebafa9-b379-44ec-9e5a-1d4eb95cff9e", "value": "KFP.311.152.2023.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb52d2c-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748820, "uuid": "4230b635-6244-4a7d-a345-b3dadd0c07a2", "comment": "Malware payload (Gafgyt)", "value": "cda761235c75f5b09899c9795e3db1bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748820, "uuid": "14b54ae0-0eba-4116-a779-b4bdb0ad8735", "comment": "Malware payload (Gafgyt)", "value": "59567834b8279eeb6a21309827bec32e9ee4fa7860857933e448f5e07d7d8344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748820, "uuid": "a6a91d5a-59c9-4b2c-b56d-acc41ab49f99", "comment": "Malware payload (Gafgyt)", "value": "f557eb2fe55965082b53fb8687078b9ec697526f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748820, "uuid": "02e88e00-14fe-4373-8915-6796b7b12c15", "comment": "Malware payload (Gafgyt)", "value": "b98d8194a4c3ac2df47c064bc0ade819ec9666456d9f26769c3824df1a2887c407a5a01f116cc43705f78b24099ac97c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748820, "uuid": "63b8d342-3595-4aed-aeb2-39b2ff3e856a", "value": "T177A31992F900DFA6F40ED77604D34B217230BF664E931676B21B39A6AE362D43827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748820, "uuid": "e648f78e-8fdd-4619-a604-4dcb6d416d41", "value": "3072:80Mm1pdAnYB0obrzTyrh9oRmm/0pbxsCnKeNg:88AnYB0QyrboRmm/0pbxsCnKeNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748820, "uuid": "b2e0bd20-cba1-4a4f-896c-28419c4bdb6b", "value": 105210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748820, "uuid": "329e566a-7674-44ce-bd08-eab002ee6f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748820, "uuid": "0d95b4ea-b317-4114-a68c-6e487d631bb0", "value": "cda761235c75f5b09899c9795e3db1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6768d8d8-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805506, "uuid": "7c7aa297-7813-45c4-9c80-21302c335c29", "comment": "Malware payload", "value": "6385b1c2b1525e92ea54354dfdd55f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805506, "uuid": "bd45a9ff-3449-42a9-b945-fcc2af68d917", "comment": "Malware payload", "value": "5e075bd1dfda76e79c605b145ffe679ea7c936268942528df176624766b575b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805506, "uuid": "202c1b40-4753-40d5-b8df-098461e211af", "comment": "Malware payload", "value": "6ce436021c27ee19787b9f99fc4208c777f5f93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805506, "uuid": "82c9021b-e0ff-4e65-93d6-9989325a9ad4", "comment": "Malware payload", "value": "e2e8cb6a96d9a4f583663b7c5897ab3a98ad791710bcc0b4725ccd211c65eb6a1da082581d71b59099eb85e564000917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805506, "uuid": "b218d641-57ac-459d-8cbb-ed72dd2909cd", "value": "T1F785CF26F2619880F3C83E72857B93355A78EE651774CFB75368CE2DDE31111A92E2C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805506, "uuid": "d6837887-8ce8-422c-877e-e4f257e06f27", "value": "24576:IpsqHJwc7DLFUtxeNTKPVlR4zq7ti4Hw7v8Qr:IpsqHJzJMoN+tlRvdHwb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805506, "uuid": "8bcbcf91-434d-4be9-b893-dbb37803089f", "value": 1855488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805506, "uuid": "b21ab421-c3c5-46e6-a151-ba2adc701489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805506, "uuid": "72e81a78-814d-4809-ad4d-d28670ec06c5", "value": "SecuriteInfo.com.Win32.Trojan.PSE.RV5K4R.32506.20997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94d693c-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736468, "uuid": "6bbdf77c-75af-478d-92e7-499d704d8cf9", "comment": "Malware payload (Gafgyt)", "value": "85f59b05298e56dfed64ca7c7c2a00d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736468, "uuid": "6d03b79f-ab8f-470f-ad0f-ed860e6641e7", "comment": "Malware payload (Gafgyt)", "value": "63d7eb6843478618c51476b715f7aefbe92c2a14899b286f9961fc86e5f5f36a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736468, "uuid": "76743277-f7a7-42a0-b523-7824a11b0ec2", "comment": "Malware payload (Gafgyt)", "value": "4b27165cd80b3a2327511fe8e3782933fd9868bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736468, "uuid": "0f14df79-bb3b-4b76-9388-d2cd40ae9121", "comment": "Malware payload (Gafgyt)", "value": "f7fc620b1fde7ebe333265a1b6ea8d65960156fd6abbbf28ef21cc553505fa7ef7a728a4724b0fb4f658750c711ed83a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736468, "uuid": "e6dabda1-ef29-44ae-a31d-8175ab5fd39c", "value": "T181E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736468, "uuid": "ae8d1b2f-aaa0-46ce-a49e-2345ab62bea0", "value": "3072:JW6dm9tS1aRGQdK76t/zC8I5mrThPaLEnvPrNb:c6IG+LCBmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736468, "uuid": "f226585d-3477-48bc-8b90-207c41a7ce6c", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736468, "uuid": "f0acb8fe-8924-47fe-ba77-4315148718e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736468, "uuid": "ad7330bd-e097-41f8-88c8-5bcb8e1fd180", "value": "85f59b05298e56dfed64ca7c7c2a00d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f734b6-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748777, "uuid": "96506ce3-f09b-48b6-85e1-9bd61647e4d7", "comment": "Malware payload (Gafgyt)", "value": "0a8495f22660af0dc7c564e69193f0eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748777, "uuid": "38ad55e3-104b-41d6-9779-fd103c2014bb", "comment": "Malware payload (Gafgyt)", "value": "64cc83ddcb9646f67e3fa2dc09670939d0e1acbe62dddb8f9dbf2e031d567ccd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748777, "uuid": "470ff29f-de69-4f13-8a6a-bb9d33ff5172", "comment": "Malware payload (Gafgyt)", "value": "9b0f01133ff27c19d9afcafba5d29153230f7918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748777, "uuid": "697c846d-d1ec-44e2-a602-f49adfd1db80", "comment": "Malware payload (Gafgyt)", "value": "9ea06b7c465f412ea0ca37d51f77536e177025048b01dfd34efc152f3125375741c2367ecd696c82bee3aa7761499f67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748777, "uuid": "2dd633be-ee69-49c5-a439-d9a5a9b20b8d", "value": "T15303F206A5B64118CA1AC17B152B6CD90973130EE18CB8F28FC93AEFDFA7FB55506242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748777, "uuid": "0c376b4d-0662-4f51-921a-e863c8e096f5", "value": "768:vv6Drhhsps/HeuCgFzp2f3GqNtqXDOQfYBigtRnbcuyD7UryqJ8eXNSS8HcLi:vcrEsdCAsv7NtaOv7nouy8mqRXNr8Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748777, "uuid": "e9739961-aafa-4cf4-9ae8-5ec80430b44d", "value": 39832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748777, "uuid": "e3f96f85-3d82-4136-ae2b-e45289bf408e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748777, "uuid": "ce1182cf-020d-4fc6-9d8d-501943e608a2", "value": "0a8495f22660af0dc7c564e69193f0eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cd9754-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805500, "uuid": "096fa6fb-64f9-4707-ba63-4dc91e954202", "comment": "Malware payload", "value": "79d20b6b6857a0b0dd3fa4c3add11b36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805500, "uuid": "296bc96b-693c-4d62-a606-1aee8076d376", "comment": "Malware payload", "value": "6894032b02c50ccbb5ac7ff5b3fd4b75d7a1027ae3679552b611cc018fc927d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805500, "uuid": "b592e621-c0d8-40fe-9d38-c1b3e818de2b", "comment": "Malware payload", "value": "3c8ef4fbd9040c02a170c167e963181903f06d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805500, "uuid": "70841dab-1c9c-4ada-900a-8f018711c0c6", "comment": "Malware payload", "value": "eab675914039438b9011cc2dbb759245d9378cdc70a49aaa14d344c58a6c00c8a542a36fe9c5e49424bc12770eb73385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805500, "uuid": "01779368-c159-4f5e-8f4f-ec4cce3053b6", "value": "T16D568D61B242C417E1731A319927C3F8AD27BE209F78609B3A75BEDC3F7464179242B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805500, "uuid": "72412b5a-e81d-4c7f-bb77-1ba35bd86d04", "value": "49152:hSKsddrf7l4Gul6SYvNvZiJ8vUi+a5kRKk62I8uXaXsTwXI7m3j5Fakr0Q6AA2dr:AXVulORU8ipuqXNYaFbL5dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805500, "uuid": "b8fdb4bf-e80f-433e-bfc1-408200e1edb5", "value": 5894144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805500, "uuid": "8ba38ab1-0e11-4864-9dd8-d84ee240f8ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805500, "uuid": "03f26ad0-aecd-458c-b92d-ef7122bb5971", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.3097.22639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a12bda-a559-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1703751325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751325, "uuid": "7f62dfd0-63dd-474f-8e9a-54dcf1519cc2", "comment": "Malware payload (AsyncRAT)", "value": "8dab3141efa021c698ab7017ec39f62a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751325, "uuid": "29cebb63-1d15-469b-9ffa-c885847b2fb6", "comment": "Malware payload (AsyncRAT)", "value": "691458f7124dae50b04f813747eb7c657d9f86a09dbdf72514893e65d1172ad6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751325, "uuid": "5353ebb7-3538-4520-b7b3-52b96a999975", "comment": "Malware payload (AsyncRAT)", "value": "054fc0059b62af8e58bfbe6a74301150f716eac7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751325, "uuid": "6085e096-71cd-4b7a-a127-4ad41c571354", "comment": "Malware payload (AsyncRAT)", "value": "270d81e2849fefb8f5781928bb6e13ec6d46e587c9f37a76bce49ba8e3d3f3e360edf3d96192906f1e706b23dfd37bfc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703751325, "uuid": "9d7ce1b3-4100-4584-8f35-b3510e02ddc4", "value": "T10A014C0637E84B3A3AB648550A21351D89D14FE0257D27617B302CF931A8B71A5024EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703751325, "uuid": "1850bfef-3520-4323-8464-f18330a59eb0", "value": "12:9vWd+Z9lnKLDUH9lxhOEm6s/29lvGhEqximtVv69lQZ9lQ1EXtn:9A+Zvnuuvxnv+VVSvkvTXtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703751325, "uuid": "4a1ae094-1012-4ded-84ab-8b72da7b16e6", "value": 686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703751325, "uuid": "eb548717-8daa-4566-9a6d-d5594c4347d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703751325, "uuid": "33eac0ba-4f99-4da2-a1e1-f88766915c26", "value": "8dab3141efa021c698ab7017ec39f62a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734b6828-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805526, "uuid": "6e168276-95b1-4156-a7aa-286637c0b816", "comment": "Malware payload", "value": "f95dd05c988d7e2f9671e69d0b019d20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805526, "uuid": "ad4ef073-fe02-44d6-8482-2a0060521493", "comment": "Malware payload", "value": "69d37af76495d54a2c090cef9db4039f45598e1015e0b4f7c251e003041205f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805526, "uuid": "18012e78-6b40-4422-94d1-2bc9be03b041", "comment": "Malware payload", "value": "bd34ea45cf08013b35e22fbf05918101af42c49d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805526, "uuid": "e2619735-c936-4f32-9099-f52a54991626", "comment": "Malware payload", "value": "7b9af8dcb58a465b2c9b8d0ae78bb532af93050934ea295a6e92274690d91cdeea6a88e04f5004a044f227c5e785e244", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805526, "uuid": "c94968eb-a96c-4a59-93a3-c09e5ed1e842", "value": "T193639E26B9A381F7D289037424E15B3B5E7F6A1106D288938FAC9D556F316F1E23B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805526, "uuid": "bbe24838-6a3b-46b5-aa2f-0c6d8c4e12a2", "value": "241f606165613c2702e3f92a5546832e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805526, "uuid": "58365bb9-7f37-46c4-ab90-1f83c4042a0a", "value": "768:RJ0a2GS8TYXGvZAneK1oOIlXRmrv9X0BvfSr/iB99JbuxccttQHjc:s78TYXNqOAM0Bv06Artkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805526, "uuid": "df5714af-b356-4cdf-bd85-86c24674a0ae", "value": 67679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805526, "uuid": "c9a2fddb-10f0-4dca-aee1-aec65622fd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805526, "uuid": "5753f552-b9c0-43fc-82af-6d46dbf308ba", "value": "SecuriteInfo.com.BScope.Backdoor.Attack.16183.3307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703155bc-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805521, "uuid": "4869d0f0-d1f5-47d2-83ab-67e629d26fdf", "comment": "Malware payload", "value": "3392ff189722ee466b47ca61d4c9e379", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805521, "uuid": "dfbe9029-40fe-4df8-8d7c-a109ab0df2f5", "comment": "Malware payload", "value": "6a4cbfa3b8595741a723136f8008319385eb5ad45e8aefda5975c73463e68aca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805521, "uuid": "e3e11d6b-3312-4645-b8ce-a25f25e8c7cf", "comment": "Malware payload", "value": "690bd4bebf530b9219711cbfc67a6797d56a7b14", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805521, "uuid": "d3b0d874-d30a-4df8-876c-3c5b2d0aa2f6", "comment": "Malware payload", "value": "acf78b8a7cafbbab8322b9dcb261663949056d391327e3748e687a0362e7b7d57ef1121c9ad103e6334474da14ce5ed7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805521, "uuid": "5d371934-1041-4870-acaa-53e3051f519a", "value": "T1CA25F11DBF6DD852DC0C3D33F8978AC8EDB6BA426D45C24B3674565E2D623E05C220AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805521, "uuid": "1803d451-d0fb-409a-8dde-e0e243ff06f0", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805521, "uuid": "9d2ea6f4-8092-4f62-a34f-864cd3cdd877", "value": "12288:+R5nWFpPoSjpHiXinD1A+aMd4QZYbbHth9GEPyGBtCHImXHbRUCBn:VbHiXI1jbRYbbpPyGDUHHmCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805521, "uuid": "d17eeb77-d6a7-4891-910f-8f2c28919095", "value": 998200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805521, "uuid": "bf75a330-ccbd-4909-8b65-8499e297ea90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805521, "uuid": "059005b2-9b5b-43c6-a66f-ffaa0530a552", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.22503.1609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a842617c-a579-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703765242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765242, "uuid": "7441c9cb-b922-4851-ba85-d888399ba541", "comment": "Malware payload", "value": "71ea72641a9bc220ece6b1ebd65f2089", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765242, "uuid": "7b469a7c-37d4-4650-8382-9d9129adfaea", "comment": "Malware payload", "value": "6ad0bef47a7d344ebdcf94ab27fb9ebd2e42f6f454f16949e5177de6e7234f21", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765242, "uuid": "812d4c5b-5e26-4f16-a259-ef2aa8bae211", "comment": "Malware payload", "value": "65a5c613d565c4fa9c7658ce029d8ee9c8336555", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765242, "uuid": "5749db3e-59c3-4148-af3b-2f27c99923c6", "comment": "Malware payload", "value": "af9b7491d3a784923d854fc8ce1bf7f3a0b87b572d3492d1b0eba1de50d4ea09cbc476bcc1e4ae1b118b56ebeb14e8e4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765242, "uuid": "69583fb1-7a44-4ea9-91a6-7571d93ced80", "value": "T1EBE312AB53CC328BC37936BF405260DBD448A105B9B737612D46F2D86368B2DB683299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765242, "uuid": "e25cbf2b-9b34-4e78-9094-88a8bc358efa", "value": "3072:mwocInB3+KGP/GB62RSAJcFd+QmDYzJm2RlKCp:OF8GM8SA48QKYQsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765242, "uuid": "dc0e465b-328e-4d3b-8e57-06c7988b715e", "value": 154102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765242, "uuid": "b4468993-d1e4-45a4-9edb-13f1d112bcb8", "value": "application/x-ios-app", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765242, "uuid": "e14edf3c-7df5-48b6-bebb-ff9c49cf867f", "value": "71ea72641a9bc220ece6b1ebd65f2089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f734e5e2-a529-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703731015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731015, "uuid": "438d9c86-8ade-482d-975b-7be5af3b100e", "comment": "Malware payload (RedLineStealer)", "value": "b284f70ee48a068ba6f31bb1a24da5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731015, "uuid": "9194c92b-7c77-4d72-97c5-9e12a9608e5a", "comment": "Malware payload (RedLineStealer)", "value": "6d1adf470092222401edba38ae95ffe66813dfd440adedfd2fdb556e2f6b4de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731015, "uuid": "8f70860a-0ade-4fb5-bca4-c6ae4201c5da", "comment": "Malware payload (RedLineStealer)", "value": "c6d022bdd5f4c66c6da05e28d7d61f9ae82ee2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731015, "uuid": "b50154f1-1c41-40d4-8046-d148b91d2faa", "comment": "Malware payload (RedLineStealer)", "value": "85b36e37a686414fddf41472d7115c61fd123e8bc0d011daf21be6de2c6ecf8c18f330f003157d43e0ca7e74c1612bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731015, "uuid": "a62a10d1-623f-4d1c-b2ae-bf0c11f4294e", "value": "T14FA35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731015, "uuid": "ef6b9f7a-8e2a-4e36-be16-59fa92287a83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731015, "uuid": "fafdbb90-4939-4040-9bbf-1827ea7644db", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2f3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703731015, "uuid": "1bca2230-915a-4e4a-9915-925e6ca005e9", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703731015, "uuid": "d098db47-5573-4aa4-8a76-b3eb3ade9e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731015, "uuid": "c3175c36-7cfb-4f77-9dd8-db2453373b61", "value": "Implosions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf20ac0-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805487, "uuid": "ef081616-a39e-43a5-b2ce-730025e28d0f", "comment": "Malware payload", "value": "3c8df611cba0819476129c179120b9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805487, "uuid": "440598d6-9e4e-4498-82fc-84290ecc6a1d", "comment": "Malware payload", "value": "6d56d9f71fd2c741a621efdf40f57964e94ccadea46f0079c5e9365dfa785d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805487, "uuid": "e7dd2138-8e0a-4920-bd84-a18a7fa6efee", "comment": "Malware payload", "value": "f6ebc9d69e1209b82ad4c4ce10f375aa499f89c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805487, "uuid": "dfea3c05-c4e1-4a44-94ae-a87e3605b389", "comment": "Malware payload", "value": "88e9f1f6a63e8da8b8f69acd60e1337125a3e5909138e913d5fd97c7005bfca4ef901472f44b8bd33234e39ab1a5f53b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805487, "uuid": "ddd74a15-f8d8-422a-ac35-df40b03c868c", "value": "T15C469E378E1D5CC9E90174719C1A8FDA2954EC20B5086B9B76C1B969CCB0BC3BDF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805487, "uuid": "dfaa3525-2bd4-4c1f-9fed-ce39097f838b", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805487, "uuid": "8ff9d747-49f2-411f-adfd-67b77db64df0", "value": "98304:P1N3jLTbxlblMplAKKg+0jhcqTZhOUX0G8uIqlDC75QYcB73F1+:PvjLn3bC4KT+0tcoPX0G8uIqlDC75QYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805487, "uuid": "f113012e-cead-44d7-9223-5b8f66903aff", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805487, "uuid": "3e06758c-3dcb-4b11-8132-bb945ff9dcc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805487, "uuid": "9efcd205-fe68-4a76-8685-a92b6fe70890", "value": "SecuriteInfo.com.Trojan.Crypt.14838.30484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81705acf-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748856, "uuid": "a12d38fa-d213-4e6b-874d-2393d2953d0f", "comment": "Malware payload (Gafgyt)", "value": "ce225d2ae7b4d15ea7fd9874915aa9ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748856, "uuid": "4d8ab28b-f006-46ee-a0ab-e2f2d3c1f928", "comment": "Malware payload (Gafgyt)", "value": "6e030b1809bf57372a84b4c9446b8ba02ac0f6bdb0c465c801670cfd42f7f354", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748856, "uuid": "63333d37-d234-48ac-9f91-247175203947", "comment": "Malware payload (Gafgyt)", "value": "37e2be19660600ee07b8eefcef94f1c961216e58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748856, "uuid": "9151447d-9516-4599-8133-baf645331b7f", "comment": "Malware payload (Gafgyt)", "value": "af200a0769266c439685e45a4943bbf37eae40af2800b1c7af4a6b4f02c649c0c42052b75a793ab69d9f5970e8b5a1a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748856, "uuid": "52e5b45c-3f57-470a-9ecb-45e9f4500515", "value": "T100B319377B174E63C0CA107112E30332A7B5DF1938BA5397A9A07DAC6F36A8434167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748856, "uuid": "86447b0b-5a3c-4ffb-bde6-d97a566c8888", "value": "1536:QFVqLUj1Ra8I7N95DnwbtNetYseXhPV5mmi405bNyzCn8hNg:+r72NPDwyreBrmm/05bNsCn8hNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748856, "uuid": "8dc1537a-fcaa-4234-94d2-6092a7aaa0f3", "value": 113437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748856, "uuid": "3f2269be-5b9d-4bbd-818f-766acdaf6e48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748856, "uuid": "a4864a2a-02c7-42b6-bb1d-af689a83e107", "value": "ce225d2ae7b4d15ea7fd9874915aa9ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab97fa5-a598-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703778614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778614, "uuid": "1558f33d-2c38-4b4f-a246-2125220c861e", "comment": "Malware payload (Mirai)", "value": "bfbf11e06635d043f1fb87cc18d219b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778614, "uuid": "979f5476-0f7b-4965-a138-f66b8eeb10e9", "comment": "Malware payload (Mirai)", "value": "6fcb21635d63b95d618b311f532030f135db0553d97194f8719dd302d8d829c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778614, "uuid": "b60679dc-eb07-46d1-bbab-5954f26eb093", "comment": "Malware payload (Mirai)", "value": "fd64a7abd2ed3142623b7ed28734ddd330b74322", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778614, "uuid": "1fbc40f3-4172-4de4-8775-ccd37bbddf4d", "comment": "Malware payload (Mirai)", "value": "84790012c40cdad37ea383e349c6b9e7ee9673b931cd2cd621ac590d6c576adad89cecf2e34991732e16e52a148baf97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778614, "uuid": "4a9802a2-9db0-4618-961e-810772aac9e8", "value": "T15CA2D07A6102D570D3B818B4EE290887BB2ED7B4D5E93D75386D07289E0F205B0FA55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778614, "uuid": "6d6075e0-0171-49b8-9851-780b62329746", "value": "384:d1MHEoLJKWu8Tbs5uKWxfV1G+WCT8Iso0huuKnhcDChymdGUop5hV:d1MHEotKScuK+f4INTu1DCs3Uozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703778614, "uuid": "ba2ff073-8c46-4080-8fa3-9fd8643d54c4", "value": 22468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703778614, "uuid": "b70ad4f7-ca06-4106-9046-3346bf711b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778614, "uuid": "586b6e6e-95d9-427e-9592-1d2e4d5f2df3", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f895ef3-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805493, "uuid": "75990fb5-7a6d-4c09-a503-e4aaf09d78bb", "comment": "Malware payload", "value": "6eba2310b192803fb0ef3415bb6cf344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805493, "uuid": "e7c7b8d5-01f9-44ce-a980-d25185a8a019", "comment": "Malware payload", "value": "70473249eae4adf6cec79abdf2a06efdca08540a53a7dfe806006742e8ce6156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805493, "uuid": "b3ef8b55-549a-40f8-b768-8487e40627b3", "comment": "Malware payload", "value": "37fcb14e1de3bd3077eb3618db1f6236b015ddbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805493, "uuid": "4f9e8174-31c4-4e50-b01a-e1a28f467765", "comment": "Malware payload", "value": "2beadacedb6b04d05014c0ac17a8b736e854e767d6e7c6bb9c4fdb69395016a29c67c4ce88b444c9799e846dfebbf4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805493, "uuid": "70262fe7-58b1-4d80-98ea-85ca4ebb7a4c", "value": "T12C469E378E1D5C89F90164719C1A8FDA2954EC21B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805493, "uuid": "a40960ad-5335-4cf9-9bbf-8ec06802d755", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805493, "uuid": "09ec7920-cf6b-4abd-b85d-72e66db27d3d", "value": "98304:q4LQ7pDzUdrf7SWURPgF4hhRqTzZOlX0G8uIqlDC75QYcB73yBK:q57pfarjAR4F4TRmGX0G8uIqlDC75QY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805493, "uuid": "1fdd7dc2-607f-4503-a09c-f0e6f26b5f9b", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805493, "uuid": "8076a4d1-6b15-40fc-a0f4-97b92066ff03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805493, "uuid": "da60bbb7-0ad2-440c-8f10-788edc2f15fb", "value": "SecuriteInfo.com.Trojan.Crypt.10350.22053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46f0665-a5d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703803515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703803515, "uuid": "b302ea02-602d-4e1e-8238-2b1acd37f312", "comment": "Malware payload (DCRat)", "value": "05807a1da055a7f5f9685785a492e378", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703803515, "uuid": "26f0f1aa-1994-48fb-a711-78e84068b9aa", "comment": "Malware payload (DCRat)", "value": "7198c021c349195154979637b443482046379e1dad61a191a58cf8a0e1b0d9d9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703803515, "uuid": "ee12546c-bb89-48b3-8f04-9c316612fde8", "comment": "Malware payload (DCRat)", "value": "75d35a78322318316003274df065556127c7cf82", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703803515, "uuid": "38abde0b-424b-4621-8d91-8f59726091db", "comment": "Malware payload (DCRat)", "value": "bb425a16257079a1fc2288954a6f2b92a77a4986bd2a071b53cd7344f78daa779dda72d0e5d7da5e3fbfbc9951ae44e7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703803515, "uuid": "e9798bf8-57ab-4565-a2f2-3997f605bd75", "value": "T1242518127E448E01F0191233C3EF458957B4D961A6E6E32B7DBA3B6E15123A77C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703803515, "uuid": "522710c9-b9fe-4bdb-9fbc-d59b88cb940b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703803515, "uuid": "d0ed3647-e28b-4b03-843a-8959d8095f25", "value": "24576:ow5fINw7rTQVHC+sofD+Q//+IrbeeDdVrnAlR:okfIOTGC+so7F//NDXnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703803515, "uuid": "314a24c3-06a8-4b55-b4c5-f5270ee2ac33", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703803515, "uuid": "53c2b410-c1d6-4e06-ae26-11c2b94a0e6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703803515, "uuid": "06e96b4b-fc7c-4ec5-a4b1-25be861a1617", "value": "05807a1da055a7f5f9685785a492e378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573655ed-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1703780998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780998, "uuid": "679958ae-e2e6-402f-83a0-b4b8d6815d6a", "comment": "Malware payload (QuasarRAT)", "value": "43e01ba3077ac42632292b7ddfb47275", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780998, "uuid": "eb108766-2a4e-4d8b-beeb-9637d8f5cba7", "comment": "Malware payload (QuasarRAT)", "value": "729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780998, "uuid": "2eaa56d0-ce74-4099-93db-0c141fb590bc", "comment": "Malware payload (QuasarRAT)", "value": "3eb8d7d6cfb24ead4c8a417e374053029301a1ac", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780998, "uuid": "d42f3502-1d01-4db5-bf36-fee7c7078dc7", "comment": "Malware payload (QuasarRAT)", "value": "2867c4b3f8f9e9c6e3068ba8d56b2ad74ec66b911a1461c83b2287a62d1c5e28597992c030c6acec0e54a5abe958f483", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780998, "uuid": "8cf7bef2-3038-433f-b5a1-dc8900756b10", "value": "T113E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780998, "uuid": "0e3310f2-740d-428d-914b-dc7dfe301f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780998, "uuid": "96d0282d-4aac-4483-bad7-710f5ee2234c", "value": "49152:QvnW1i2R+at/C4PAlOqmicAhHzlK8RJ6BbR3LoGdYTHHB72eh2NT:QvW1i2R+at/C4PAlOqmVAhHzlK8RJ6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703780998, "uuid": "db1c3867-9a45-47bb-a0e6-125204a5b4d5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703780998, "uuid": "46b70c25-7659-418a-9d8c-183f52496693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780998, "uuid": "468f874e-61db-4743-af20-b0fd56a0c20e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85b126a-a545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703742909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742909, "uuid": "160321f5-48cb-46ff-9c56-252c008eb810", "comment": "Malware payload (RiseProStealer)", "value": "f6dc7538025f5e2c1235347966fd34ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742909, "uuid": "178f2dd3-e40f-454a-96a7-7cca3ed5da97", "comment": "Malware payload (RiseProStealer)", "value": "7324e9649a54a5f6767cf58fcec138770627780486cbb709f751a684be7a0b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742909, "uuid": "e9f0ded5-a7b9-432a-8137-30de365ca84f", "comment": "Malware payload (RiseProStealer)", "value": "fc8d6c40d007e6e97051e836ccd6d0b5acd711b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742909, "uuid": "b68098c6-9cbd-4b16-9fa7-ac618145c2ac", "comment": "Malware payload (RiseProStealer)", "value": "5c394a25c0ab079a461cd328ab4590cd975f784079cdcb685c1085ebdc6127b4c25e759696b22cd8dcb4896818e2b1a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742909, "uuid": "aa2ace44-265a-4d10-a89d-5d7a2f925dc8", "value": "T191C53393E6E20266DCB5233058E903975F397C93CEA4630B3B21A59A1DF3D616471B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742909, "uuid": "784d3078-2228-466a-bbde-c1bcdbe7f17d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742909, "uuid": "a8356f08-e666-46f2-9d47-c04470b36195", "value": "49152:TQ7ZcG9WCUviOuy2RhJMeog/7g5lamSyZYIAJntuqSaDHBkR7C01yYVCkrLyyvQo:E7Z44yGmeog/7LyGZbu+Cz1Mkr+i47jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703742909, "uuid": "3c0b06a6-50fd-49be-a9db-bef5a29eb45c", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703742909, "uuid": "417bc752-5774-4127-b902-69121ea07e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742909, "uuid": "1cb59acd-85de-481f-afb8-f0d6b5b32672", "value": "f6dc7538025f5e2c1235347966fd34ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9dbddca-a598-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703778613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778613, "uuid": "c704f4c5-3d8a-4326-841e-b7c1485af6fd", "comment": "Malware payload (Mirai)", "value": "91e9c9cebb65ba4617aaf9a7527b26bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778613, "uuid": "e9482f0b-422a-4f33-b7d9-5104da4e10f7", "comment": "Malware payload (Mirai)", "value": "73f99b5e3a59b7a1312941dda070fbbbb686873f5ac19f3c5254f7aa05b402c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778613, "uuid": "04c70258-46f0-4485-973f-21c8f601f69e", "comment": "Malware payload (Mirai)", "value": "7a5739be67cafd26c2f1d12475a3688d9e918560", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778613, "uuid": "3f0f7460-facc-4761-8205-eba3abe600c6", "comment": "Malware payload (Mirai)", "value": "9582910898eb80c1d778ed7a7f986e90116d0af271ec87eb44ad65be5f5f7e63701c098e85f10a1b74e8189e327cbbd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778613, "uuid": "19bc5b0e-56dc-4a41-bedf-964fe709c085", "value": "T19123F11AD51BADB1D3707D32FEA054D92A8807BEE59A62F30641872CB98489B07FC196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778613, "uuid": "d1c1c07e-08f6-4b0b-bf1b-d2fcacc43671", "value": "768:OUgsDnoZOd2uZwbZprCcfjWqd2Dge4yW29q3UEL4TYAcSBj80cGxlfj787yqEd8D:OUUZYBZwbZprzj+gbyWbLXAtNbhfMEQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703778613, "uuid": "5e2b8c53-0626-49a4-8fea-0fa048a99eaf", "value": 46736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703778613, "uuid": "06a88a0c-8ab1-4a3e-af1e-3dfe54208743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778613, "uuid": "46fce779-1267-4df2-959a-6d3195e30d9e", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ab7ce2-a5b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703791026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791026, "uuid": "d1db1232-b960-4c77-88c3-821a98aee541", "comment": "Malware payload", "value": "39c2c3783f7d7877171f84c772b86bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791026, "uuid": "39d77e66-e783-4596-80f8-2624b7e82006", "comment": "Malware payload", "value": "776ee8c4b5a0021015802616d59d025fa6a9f4598264355bf8388d1aa4c2fb1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791026, "uuid": "c8245e78-8a18-49c0-b3b0-1b46cfb3282c", "comment": "Malware payload", "value": "08a5c1e17e7a304109312b753c64856e4375f728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791026, "uuid": "b570ff6c-f465-474d-9983-15f4e237dd97", "comment": "Malware payload", "value": "9990f654cc1a4601dade09c659e97a3d0e691b3606fe59ee70fe2aa57ee64906fae7583c0f67565213e6c6b22ad3574b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791026, "uuid": "6d8d02a0-abf5-4837-bac4-56e09bb3947c", "value": "T1E5E7337CFD05518BD88046BBAA6A6FCCA04023E3B304EED70B35DB54D5227791A989FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791026, "uuid": "c445c5dd-9c6b-4181-8c3e-eedfad6a9a1b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791026, "uuid": "ca52bee3-0877-4437-9545-ae1fcdb9070c", "value": "1572864:Cm6AlMvaMu5nAcX/HPMNMLpZyIdiBcQ60E3z:h6AlMyV5nAcvHPfLDjih60E3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703791026, "uuid": "4946a06a-a7aa-44df-9a2b-b73c8a405cce", "value": 65473792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703791026, "uuid": "ad17adb2-2351-449b-ae74-5c412175e5dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791026, "uuid": "1b470c04-ed0f-4582-800c-cdae9a0a3b62", "value": "SecuriteInfo.com.Other.Malware-gen.20071.9619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c7a17f-a514-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703721997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721997, "uuid": "4c69c516-2ddd-4003-8436-20c475b47e44", "comment": "Malware payload (Mirai)", "value": "0ccf3bf5cf75ba70717911344e38964b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721997, "uuid": "d02fe0c0-d130-40cd-9f62-78bd83c1932a", "comment": "Malware payload (Mirai)", "value": "779a8e95d454c28b0c159e59fabd09c48b3307499739dee9a215ca1366f17540", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721997, "uuid": "540212af-8499-4ff3-85d8-6c6d43bf6f38", "comment": "Malware payload (Mirai)", "value": "71ee848a84bbcb9fd721f3470b987d9e8f48d064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703721997, "uuid": "cc63bf38-fa12-4907-a789-caf2b9107715", "comment": "Malware payload (Mirai)", "value": "b7bc85b21d31e5237f347edd1bd3d2947fb4fecd3a1f257fa466498847ca248069f4b91de5df62ccc26e1158492e9063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721997, "uuid": "426f2adc-7869-4a15-ac52-9baeae312fe0", "value": "T165832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721997, "uuid": "9e5ef95d-a8ac-4d52-8c64-f51894f93a24", "value": "1536:qLf0+QM5PHyVwi7f21UiEy+DlOo7mL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fw+DMRSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703721997, "uuid": "a92f86f6-9d6c-49af-ade5-babb2c5ea829", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703721997, "uuid": "e89a4703-1cfa-4b96-8703-09cf6387356a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703721997, "uuid": "f1d12ff0-7e3d-477b-a81d-434d6a225680", "value": "0ccf3bf5cf75ba70717911344e38964b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236443b3-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703749987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749987, "uuid": "323eb278-4aa3-4c2e-babd-7cf00fda19a2", "comment": "Malware payload (AgentTesla)", "value": "310af0e0f1436536906f2c2ebd23f505", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749987, "uuid": "37ec04c2-06a7-4efe-bfe1-0b41bd126e71", "comment": "Malware payload (AgentTesla)", "value": "7946520668dd4b2ab8597b62456bbf07661c10c0ca1f35105132fbdd4634f74b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749987, "uuid": "cb2c392c-3949-4f01-afb7-550897b1a7b5", "comment": "Malware payload (AgentTesla)", "value": "3488bd8f479b920187b6655882a1a1a20404e5c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749987, "uuid": "7ce4f86c-8121-4966-b9b2-fdd35d1b2305", "comment": "Malware payload (AgentTesla)", "value": "f83557deac175218d13ea2d0da62c1f4bf41380544d81cc3a57912b90d3a297fb51e3023abdaff3bdead5c80a88f3e66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749987, "uuid": "9fd9a093-09e2-463d-8a0c-e154397d2683", "value": "T11724456DD34F01698F62537AAB2B0E4582BCBA2EF34451B5306C533533EAC3D91662BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749987, "uuid": "bfa7293b-3145-487f-a7b7-6dfe11f2044d", "value": "768:fwAbZSibMX9gRWj52FdRrXyM1ygXg0g6LqMsqSbVaje9Ct/FT:fwAlRvdRrXRXwb6LPsqShkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703749987, "uuid": "372e63f1-a9fe-4736-a5ff-f1c7e9350879", "value": 210330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703749987, "uuid": "a4b6d866-8e17-4a7e-b3aa-296d45ee1c09", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749987, "uuid": "457cee75-985a-4e20-b9ba-549ab5a4aeb1", "value": "Invoice3392.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e4b614-a56f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703760911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703760911, "uuid": "2d125699-fac8-40e1-9008-5ceafefbe4b9", "comment": "Malware payload (RedLineStealer)", "value": "65a607da7d22cac2f15e2d8a184f46f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703760911, "uuid": "887e8c32-f10c-407d-a8d0-2ae157412116", "comment": "Malware payload (RedLineStealer)", "value": "799c7bed3c5fe743f6b748efff0994fbda6f19028cc9921a06cf633e7629bba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703760911, "uuid": "322ab823-2999-4305-aa21-f3cceb77066c", "comment": "Malware payload (RedLineStealer)", "value": "1018831ce237770e9244b3bba5d5262c0dc74497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703760911, "uuid": "d0bb1940-587d-4772-8ff4-f42f7a2343c5", "comment": "Malware payload (RedLineStealer)", "value": "15997723b03310d5df387433b0930d9be9fbef6b3e373681aca04e12c77bf4ade44ef0c2697bd9573ea3dc3e594886df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703760911, "uuid": "f8224c34-56d0-421c-a05d-4ce10132bdce", "value": "T10AC53383E6E100A6D8B023305CE917D35B357D93CEB4730B7B61A5CA5DA3AA5247273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703760911, "uuid": "a41619c4-de83-42c7-b596-ec2e8d0e1639", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703760911, "uuid": "c02e86ab-a946-4bf9-aaa9-511b1a43a9a2", "value": "49152:SJwn8nL2Y2uBkGw4pg/DG+EyoYOoUn5uSCaldONfcj0aAPkGvwLwIZcqeeMXKf:8LegkGw4pByHreudhb3vvw0G1MX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703760911, "uuid": "f83167ce-e3ea-46f6-b533-5f0cd14fff75", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703760911, "uuid": "dec5a793-c257-4dee-b576-525153f1d486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703760911, "uuid": "dfea8eac-9dc4-4ffb-b07e-5b511672155d", "value": "65a607da7d22cac2f15e2d8a184f46f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617ed1bf-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1703750091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750091, "uuid": "0ed961a0-2086-4937-adb2-273b9d3bb965", "comment": "Malware payload (XWorm)", "value": "822d64420c4da7cd9f59b7d86f22c2d2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750091, "uuid": "1dd41797-b1de-49b5-9098-56c8b916ddcf", "comment": "Malware payload (XWorm)", "value": "7a22e3f371ea410c70c6cd43fbda6954e2080ae8d1853474807bd0fa459b9fe8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750091, "uuid": "c3cc9689-b080-4641-b894-953f6d0db107", "comment": "Malware payload (XWorm)", "value": "58f659bf07585ab5976ca75e6f233f877ea5074e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750091, "uuid": "51d103e1-9890-4d45-a1b1-425b18522397", "comment": "Malware payload (XWorm)", "value": "d949e68d40b7997f40d7da76885efbf692a2a223452a354ed9ae043501f2de5dd123860d10849e75667b64aa0cdc73fc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750091, "uuid": "36ca41ef-08d8-4eed-b413-fb6d5aae04d5", "value": "T14802401039FF910CB2F37E562FE9B6E95EABF7B62A26515D101007078A52E40CDE1B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750091, "uuid": "e55b4904-5da6-4438-ba06-f19c347f520d", "value": "192:t2AixkLeklaxklac2AixkkklamVklarUNexwSIaYzCwwlcIaY7IaYzwCiPIaYq:sCVY05mNNXtMtMtHtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750091, "uuid": "411d38ce-1c8e-456f-b101-db04b5adcf75", "value": 8512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750091, "uuid": "68f9f13b-1059-4a70-b41c-ac433c2154e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750091, "uuid": "1ae76ef6-f326-4bde-b262-0c52fab5e063", "value": "IMG-662466100.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f02e39c-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805546, "uuid": "d735c5ce-1726-4efd-b65e-7af869487871", "comment": "Malware payload", "value": "1f00e7b125f2e40edaa438b5e39c6ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805546, "uuid": "afa6d751-23aa-43b4-ba15-f723bc520487", "comment": "Malware payload", "value": "7c47a54683a20dcc82926eaebb0ec197d8aca36eaac44595dc690a8f541c6a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805546, "uuid": "80ef03b0-0935-4e05-adf6-be59cea9097e", "comment": "Malware payload", "value": "f959f312f3cb9ce1865ce320435b848c1103fa3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805546, "uuid": "92f9ba8d-54b5-4823-b634-7637e1d82af1", "comment": "Malware payload", "value": "963371479bd590212f72e4ec48e85cbf7a6aa716b39e639188813cf97fc722ffa575538fb9af4f44d3d089b44e1a7c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805546, "uuid": "e9327719-2363-4dab-b5b7-d2dcf98a7ba2", "value": "T13CB41206B6D0C111E4E91BB0E9B64F6C0F017D35E5384B5B25A5BF8EBEB26019D3632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805546, "uuid": "d2e6df48-536e-45c3-9c05-ab0200e1c175", "value": "60c5e36aef0788e441998f94f248d1d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805546, "uuid": "9d5b1b0f-f65d-4da4-8ee0-3b3e58438826", "value": "12288:AMAi00JcKpn053TAn8eEU56fTVlHjpE9pMuBTHQbl:P00Jp0588eh5Oja9pMuFw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805546, "uuid": "fccab392-6256-4564-ade6-73976c850d9a", "value": 538368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805546, "uuid": "4b6b29d3-533a-438e-b23e-0566f3ed630a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805546, "uuid": "765b02b8-3f08-4554-99fc-59bc323fc7f2", "value": "SecuriteInfo.com.Trojan.Wacatac.23387.3608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c58f6e6-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703781006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781006, "uuid": "624ff402-b0ac-491d-b445-3dbda1a7b811", "comment": "Malware payload (Stealc)", "value": "e6baa0a669a44ea6d98585bedee9fc7b", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781006, "uuid": "f3349904-64fa-4fe2-8328-90930d033f69", "comment": "Malware payload (Stealc)", "value": "805092e0147098b3b21bf2c822e85b3591ce27a8ac1c3be99829fb2747ca02f0", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781006, "uuid": "0fb3e530-a146-4db6-9a61-9363d82e328d", "comment": "Malware payload (Stealc)", "value": "255a1c50692cdd4bd995a4f97e35b081dccb4042", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781006, "uuid": "df189bab-79a4-4824-84eb-1e01ecb1c694", "comment": "Malware payload (Stealc)", "value": "f218c83b55a99e657897bb3c7d181b8bbc58d80a3fc9ba5fefb0b4fe990a47221b95face082bf311ad89fd9875b0a5ae", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781006, "uuid": "5f3487ff-f404-445e-b16f-0bf4b0452c7b", "value": "T15085E0265CA12D30FAC68F5FC4BDAD53C32161B26FDEE44E79C461E147312A66F80B68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781006, "uuid": "4ec0d622-6abd-4d65-8c19-449f779101ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781006, "uuid": "e2d72290-15ff-41fa-af33-1aedd9f0a6b1", "value": "24576:i2L7AOrqaJO4+ARXRBMdkLMucB/a8FeDkiUwvnJb5aHQ1UzRLIkqjVnlqud+/2Pb:jfAaqgz8dkCe4i9JQUackqXfd+/9Ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781006, "uuid": "116153e5-7f70-4814-aaeb-ae125e47b86a", "value": 1768672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781006, "uuid": "fdb65394-4fd1-46d2-98fe-41d00c5501e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781006, "uuid": "e0162009-3c20-47e9-b954-16021c07c68d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560aa6a3-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748783, "uuid": "eaad1e55-2f6b-4b38-85e9-affe8a8cd809", "comment": "Malware payload (Gafgyt)", "value": "b1fc6d87d4cf84cbcce8a9dafa145ab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748783, "uuid": "3a9da537-ad49-4beb-a58b-91f320fa7c30", "comment": "Malware payload (Gafgyt)", "value": "808c0639af78ebf9f10de5778b2901c2370accc61e32abd320c96e195f0ff8c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748783, "uuid": "2042e157-4b11-4382-9445-41b59d0bd938", "comment": "Malware payload (Gafgyt)", "value": "356a7aed10528e6b9a48d028a1b1199767760a69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748783, "uuid": "8f1e402e-3d33-4c30-acd2-17fcd0065fcf", "comment": "Malware payload (Gafgyt)", "value": "5386d05de0fa16dce0b176bc277be5456ae7d005f2de49d1e93df325f63bc07b9ecb28daac9f7043d8464aad45748e09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748783, "uuid": "5d0c4734-2cae-4931-a28c-8593d6e2dd01", "value": "T18D03E1E4E2E51F58C47DAA3B3EC6384D2894C35DD1028FF6EB9C24222F41F985A6C306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748783, "uuid": "fbb0b593-86f1-4bdb-9bf4-babc171dc515", "value": "768:iR1FXYnJcFQB/1XHfid+PionjbSUutyy1PvVMmivnbcuyD7UWyqkHTcAtnB5DFa:iRnonSOZ1Xfidfonnyevnouy8NqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748783, "uuid": "22f3e48d-8548-41bb-aabd-b1c9f97e3dee", "value": 40064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748783, "uuid": "3b7cbbcd-939e-43a6-91de-88d09fee7006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748783, "uuid": "8c1737a3-b847-44ef-8e66-e4ce4479716b", "value": "b1fc6d87d4cf84cbcce8a9dafa145ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d7876a-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805482, "uuid": "fcb3776c-47d9-4374-b116-f71098699e55", "comment": "Malware payload", "value": "92b12809531f4465ade7852a2d6be229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805482, "uuid": "3f1b98d7-ab41-4885-acbb-3a6ff29a5f57", "comment": "Malware payload", "value": "8099d06f643e1f4535b1f4816e3e4198f74e28ce0a86d7ed0e9d22b04a116546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805482, "uuid": "c62d5551-fbf4-4b4e-bf8a-01bdb5a83a25", "comment": "Malware payload", "value": "da5064ea16fb62c3f402118ffeb66d0843bcf640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805482, "uuid": "d8b031d7-0cb2-488f-bc99-af8dfe87c31b", "comment": "Malware payload", "value": "75fad25ea5f80a4a0cadeced400b786a7c5e31c74e63956ed8ad4cd0fe478becb10b5f7246f1d6d4ce6c1ac65ffafea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805482, "uuid": "823f27d6-8534-4b4a-af80-df05d5931e33", "value": "T139469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805482, "uuid": "7a18cd92-845d-4432-80d6-27dd91556d8f", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805482, "uuid": "8cb1ae55-99ca-4c73-b62a-a35bbde132ee", "value": "98304:AFExlJzmOYe3FwRg6GJgU2+hmqTvHO5xdp+mgulfa2FMIRavYBJS:AFeJzbF3uBGaU2kmmIxdp+mgulfa2FMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805482, "uuid": "f3239001-9119-4871-ab60-4642a2dea1ec", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805482, "uuid": "1cbbfd45-6b3b-400f-91f1-b33b37f58ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805482, "uuid": "2e48673e-4550-4fdc-9da7-e04939cca76d", "value": "SecuriteInfo.com.Trojan.Crypt.30013.20017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6799ee64-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748813, "uuid": "545f990d-a55f-403b-b197-12d4ef557aa5", "comment": "Malware payload (Gafgyt)", "value": "26e9959493663d83650c99146dc3ecb7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748813, "uuid": "08ee59ce-e9bf-4ecb-95e0-aae87b08622c", "comment": "Malware payload (Gafgyt)", "value": "8176f34d7c1fdd10d0dee7657ca0926e7e8feced93eba71d274e79dbff57099b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748813, "uuid": "d89b4913-e6c6-498e-ace1-6c9f1c026d09", "comment": "Malware payload (Gafgyt)", "value": "c5290bd94ca796c87e639f0ca00961b29610442e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748813, "uuid": "2ec572e1-b79e-4b49-a109-ad7d3b82a28c", "comment": "Malware payload (Gafgyt)", "value": "32cb60d48cf26cbe179b628432e62eb66ff7d3ee5061987772e6f6e66e9055f757114f57d6879e669f5c703d80882388", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748813, "uuid": "114e623a-3bdc-4dc1-b33b-eca7b52b2552", "value": "T13513F183C7FFFCF1E093A5BA712C47C5B925FC95BD0219A602556EE899B2D821C70B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748813, "uuid": "99123358-34b3-48c5-99b0-7903d05d5a08", "value": "768:Ay65Q+pywrxgdk4cFPojy7LSPy1WgjNlr15UPF+EdwGHrRfdsv9sPYy+Bxxp1:Ay83ruv9jy7LSP7gbHUPF+63dqFuYN5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748813, "uuid": "c2c02c97-e32d-4248-971f-6f3e40026e70", "value": 42972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748813, "uuid": "a316923c-e36a-45f6-b509-54da7e5cf68e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748813, "uuid": "5c0aab72-13af-4669-a521-6b275cf889d7", "value": "26e9959493663d83650c99146dc3ecb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3020b24a-a534-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703735405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "c93680a6-20a3-4b88-8658-ac77d94fd29f", "comment": "Malware payload (Gafgyt)", "value": "d488188c1953ff88355938989e2dfe0a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "bafb4e57-9e5b-4a9a-9269-b1bd26239bfe", "comment": "Malware payload (Gafgyt)", "value": "81b2a59f07fdf6e303ff2eac95c28745c087e4fe5013470189eb0c94ed44ff80", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "a2650c13-cadc-4465-a38f-ce5a77bcabef", "comment": "Malware payload (Gafgyt)", "value": "0e5548a9be10cff9a783d12f41a00d65dacfca72", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735405, "uuid": "5b11ece6-d42d-4c13-a8d4-e55d26592dc2", "comment": "Malware payload (Gafgyt)", "value": "4bfe895eecf7ddb677aa49435b7f07aaecc656e7e8cfdd66a973b2e3dd9c14a2e17c5d23f52d8432373991ea39e15204", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735405, "uuid": "8686250b-face-4b29-b961-768dfbeb8ecb", "value": "T1F2C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735405, "uuid": "5eb21e94-cdf8-42fb-9569-3185afce1c29", "value": "3072:4jDy/+mh1vtbPIKahbpcUPium7/L7QsvmGfIiNb:mOJ1vxfahbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703735405, "uuid": "d1e859d0-5956-4f18-a174-e377fe8be7bc", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703735405, "uuid": "4b14b2ef-5379-4fbe-9a71-efcb7632fd78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735405, "uuid": "d0bfcc9f-90e6-4b6a-b1ba-d4cfd810ea8a", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0e3250-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748799, "uuid": "c8bdc75e-2a66-4c3d-a46a-137bb24d5304", "comment": "Malware payload (Gafgyt)", "value": "d2c714d7f6ccb246f2b3a1e75cb27065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748799, "uuid": "199dc582-c4aa-40be-a132-4528129dd634", "comment": "Malware payload (Gafgyt)", "value": "81cdffe5b5a8a73bf438e7ddfb7963d10e59a5667301a93529d0843f73789088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748799, "uuid": "9a387f7f-8374-40ef-a233-2c65f6f3d01a", "comment": "Malware payload (Gafgyt)", "value": "1f3a8df49f99addd7445e6370f78a0f19f05c252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748799, "uuid": "ad7acd60-b787-47dc-9438-48dc167bd73f", "comment": "Malware payload (Gafgyt)", "value": "20d416c96ad67fa81e7f66b89a510cec45207b8ded831c8daddfbe8fcd70ac388ee38994776cdd871db2d7d45cfdbad7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748799, "uuid": "e79bda62-78a4-4c6f-b10c-1c2e7b99d964", "value": "T1B423F12EA624B770F5F01C73EDDD8823AA16726913EEB12367014AF897D3D0239F5582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748799, "uuid": "80e6b318-9564-4562-9c12-37b9115d62e8", "value": "768:MzelXzy6/lDAQTTVr9pJf9d8nV06FML0hMpfZ5bq3U7ksANq5THPpmrGtz:MzelXTTV95gkSyfZt+q5THRmrGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748799, "uuid": "a6e30cb2-2852-4bb0-ae42-234490e11b0f", "value": 48556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748799, "uuid": "f95fe58c-ad51-4d8a-a544-b3bbe75e8e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748799, "uuid": "aa6174bf-5c8f-47f5-9fbe-b29287f3b6af", "value": "d2c714d7f6ccb246f2b3a1e75cb27065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655aa0f6-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703750098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750098, "uuid": "58f2c5f8-44cf-4792-bdf4-0658361f0ae0", "comment": "Malware payload (Formbook)", "value": "1bb3334c556d0b4a30dc7cf46c49ece0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750098, "uuid": "7ef20ddf-3f53-4d3e-b729-e27e3e06c8b1", "comment": "Malware payload (Formbook)", "value": "833247f90a2c98ad685148493767644e8e3886ee0026938af3eded2883e633d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750098, "uuid": "e2716db6-76a2-49b6-ae95-8e440fd56653", "comment": "Malware payload (Formbook)", "value": "b87364f588305d5c3ac3d75109c905e513a651c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750098, "uuid": "33302079-5d08-4079-a7a1-3d27cd2cff0a", "comment": "Malware payload (Formbook)", "value": "da15f2f84e75e0284b29324e2e8ec4ead66868b0c40a4033693df4d953db45de4737d569c3007a4e783127d19f03d237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750098, "uuid": "a2a42225-db5a-46d8-8e56-de58a051904b", "value": "T1CA05B0FD08BE12F781ADF6A58BD98B27B014887B3111696B94D743534306A9239F31FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750098, "uuid": "170b1bb7-430b-4f99-be1e-86169ec9cc74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750098, "uuid": "f5e76ab5-953c-4b9d-a23a-a528af4198e8", "value": "12288:W+bnx5zkzQR6i+SPwPf+OjY50lfJOZ9P/hmmVwIlpCVqv:WS6vLJ8WFcZ9PJxiIlpCVqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750098, "uuid": "55f56a32-dc07-4598-a53d-0a4586c3b152", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750098, "uuid": "dcdaaa72-bd7b-409a-b2dc-aac149b77507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750098, "uuid": "03bb44c5-6dbf-4f43-a104-e7565bfa5e54", "value": "Gecikmi\u015f \u00f6deme #0098383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69844922-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805510, "uuid": "46c6a6bf-e614-4548-9f5c-0a8084f84599", "comment": "Malware payload", "value": "5300425e63cdbbd477038358fa0537ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805510, "uuid": "d0bc683b-e8e4-432b-a0a9-222509bc70c8", "comment": "Malware payload", "value": "85a63f64fb8e1ac3d5694ff661c61321964e22fafbbec4c48210e2f7eabb012c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805510, "uuid": "8d93ef61-994b-4988-a93e-d58f25881e87", "comment": "Malware payload", "value": "7e69cbc69a72e194b5eb86ba9f865f7903c2dbc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805510, "uuid": "70d9fdb6-aaf8-4081-880d-f098985414c5", "comment": "Malware payload", "value": "6785b3e9d35ae6d3d6fe4d9c5683c277250fdabc3cdbe9ede1654cc8dd12aa2a17d2b4348bca77f6809d8a56fea2bf8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805510, "uuid": "4bf4950a-cf5d-4523-bc85-9a545f3b4ab9", "value": "T1FC468D379E1D5CC9F90124719C1A8FDA2954EC21B5086B9B76C1B969CCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805510, "uuid": "c00e2f50-1a98-42cd-ab34-88669a9f5fc9", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805510, "uuid": "d3930771-f541-497c-96fb-628313399886", "value": "98304:LdESGvaYettn3qMwbgogaNNhTqT8TO+VNGduIdlzCb5nLXRBQ3hK:LdsvaV7n6LgxaNfTdjVNGduIdlzCb5nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805510, "uuid": "f6ebe8f2-109b-4620-be69-2259bf1df751", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805510, "uuid": "3cd2d433-1405-4deb-96c8-2cc44d6e4417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805510, "uuid": "63690a6d-2851-4963-afbd-3d77bb2f616a", "value": "SecuriteInfo.com.Trojan.Crypt.25400.17486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fea787d-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736425, "uuid": "570250d9-2417-4e1a-86ce-d2d4a031052c", "comment": "Malware payload (Gafgyt)", "value": "62c95710673cfd0595a1bad1bc393978", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736425, "uuid": "7c77b0cc-233f-426e-901d-7ebfe20196ea", "comment": "Malware payload (Gafgyt)", "value": "87c676112fb390bd251f1209a1a0b209f3edeb0144481746a16666837a908c82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736425, "uuid": "1ecee46a-c8f7-4ac5-9600-0bb24048923d", "comment": "Malware payload (Gafgyt)", "value": "260c6330a484a49aa4b2e0e84d2073b223e7fff9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736425, "uuid": "0eb1d249-0637-4d1c-a5d3-07454589ade0", "comment": "Malware payload (Gafgyt)", "value": "23b9cda2aa7a22c1c5d44b6b0c321b871b4e0ed64a07c92b96415bdd6b3bdb22ab8007f8d2e4ea1043becf264fb1ba39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736425, "uuid": "44df1fb2-aa6e-4916-8cde-799b23a3dddd", "value": "T1E2E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736425, "uuid": "b6f3daac-143d-441b-bfea-5940f508286e", "value": "3072:dgZc9h1jlnLA2PiXYeyCc1VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ1VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736425, "uuid": "9711a526-a5d2-43f8-b24b-f72672e77398", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736425, "uuid": "8c6e1c04-a2b3-47ac-8627-f3c087019231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736425, "uuid": "45a60dff-5277-4c89-ba37-b704535e1233", "value": "62c95710673cfd0595a1bad1bc393978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68787431-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805508, "uuid": "e1065142-7c41-4956-a8a8-80df4443a9f7", "comment": "Malware payload", "value": "4b18a1295434be15812f63da375164fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805508, "uuid": "33be515a-c4ce-498d-9917-f42b49167705", "comment": "Malware payload", "value": "8ade95f2428392a056f3867f72eb0a75de77362606e4acb56500d29eb3b9c2ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805508, "uuid": "8c64d2be-15c5-4ee9-9608-0c54a9f36f44", "comment": "Malware payload", "value": "4aa4b8480c5b33fc6de5a0622c5400dd79afce06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805508, "uuid": "5288be94-96d5-47e7-8035-7a242c3ebfee", "comment": "Malware payload", "value": "d014bcb8fb7f2ea91b522dcf0955702a9de8188d497932d352af03b12166a62a670ccd5a497e1ee815703b29b659e8dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805508, "uuid": "00c4427c-020b-489b-aba1-747aa1f0b755", "value": "T126468D379E1D5CC9F9012471AC5A8FDA29949C20B5086B9B75C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805508, "uuid": "1bc264ca-6ecf-41fc-afed-6477d684146d", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805508, "uuid": "0a641d21-8300-4f9d-84cd-60bdc883b12c", "value": "98304:erNJLj2It1PYEVejhQgY3RhYqT35OJzZOVGwx1XKXtb7thxVvcN:eHLjNLPV2hpY3DYGCzZOVGwx1XKXtb7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805508, "uuid": "c79a37ae-575a-4c54-9e41-ccb744172b00", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805508, "uuid": "c43defd9-4352-4e84-9686-739d5ad6caa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805508, "uuid": "1f235348-ca6d-43c9-9343-726352152d53", "value": "SecuriteInfo.com.Trojan.Crypt.4894.14975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92af0d71-a57b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703766065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766065, "uuid": "2bb4e4e7-dcb4-4a77-8601-3791ff118053", "comment": "Malware payload", "value": "358d5ceb571c91f46fd7705d31003faf", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766065, "uuid": "199af50d-12dc-41c5-a740-18fa95cc315f", "comment": "Malware payload", "value": "8bb1bef5403337e33167aed9015d7e3343cb63757ec8d5224c5d8c9f050438d2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766065, "uuid": "a6aadba8-6416-4319-85a4-d4b579d1a0b6", "comment": "Malware payload", "value": "ad19a624954b5f3fbd2ef955448658e6ed12faa2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766065, "uuid": "9726b568-719b-4c22-82bf-a6dd372528eb", "comment": "Malware payload", "value": "5f0f0f11bd8748d1d448c86f3ec55ae640c17084c3d7fc4cb445318b62538fcfc84573ed8635a45d24227e9dad34fef0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766065, "uuid": "00c8b778-7eb0-4634-a87d-8bfa0bd89371", "value": "T1D8B4B853E2805FF8D57C5738C5CB0339A726F70B96A6832257228206AFA33654B3DED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766065, "uuid": "cd4cdba4-e4d8-4c8e-a94a-760341933b22", "value": "12288:E52GTzxPSCKaKmKGKIQ+gaQ2ojfikgxGH4Zg:tCZ3KaKmKGK3+KfikgxGH4Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703766065, "uuid": "772c910c-80fc-484d-8159-dc64351974b2", "value": 508784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703766065, "uuid": "bcd1756b-d8f0-459d-a87e-21a9e27d0651", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766065, "uuid": "b6b44a99-c669-4b7c-9177-9c48366032d1", "value": "358d5ceb571c91f46fd7705d31003faf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e854380-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805491, "uuid": "7af16a20-e452-490f-8fe0-9a5e5710d30a", "comment": "Malware payload", "value": "fa4d580992ba8336d6807643022abf27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805491, "uuid": "88954410-fe05-4696-90c2-dac00c86fff0", "comment": "Malware payload", "value": "8dd90a7ab8abf9b36364ad27df0bcc7a03d6b518ba01248d68257bf1feecb52c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805491, "uuid": "b9c1787d-0205-4b79-a8c2-d7e5382b0afb", "comment": "Malware payload", "value": "8c9e05f9b2cd4b3a790c246f52bc1a7a4f38c3e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805491, "uuid": "e3db0ec4-4f70-4af0-b7db-7e78420ed370", "comment": "Malware payload", "value": "647caab3fff5b12fc76c1432a1d4be5873e27ef4eb6287784067b1c9aa38f1a0cbfec9a92751726bf250f17724a158dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805491, "uuid": "883b2a5f-d6fb-4022-82e8-2e76366ac834", "value": "T12775231376939085D06534340BCE8AA84B37DCB7765A67B30828F19B49B73E22FC2E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805491, "uuid": "f5a2ce47-5068-4c48-87d8-c5d2144943ac", "value": "ad7157f9328b5e7e782dffd95aaf08f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805491, "uuid": "0fd5caf6-afe0-497c-a46a-b430161af1df", "value": "24576:L1jWN33Bruj87aJavQ2FQlUT2g1jxsmE1k43Ku2dazI4izpqvouMKUpDtf3srRs0:ihKn2qUigH8jzIbgvouXEtiRsUpUCCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805491, "uuid": "68f7ab20-ada0-4e07-8ed3-55418afd37e5", "value": 1615872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805491, "uuid": "14f32250-6f09-42f0-a00f-a2fe44215ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805491, "uuid": "1458cc5e-6c8c-4eb1-a760-3a8f50300ba1", "value": "SecuriteInfo.com.Trojan.Win32.BHO.21501.11458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c2c066-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805529, "uuid": "261f169f-2351-439b-8931-7bc21030376c", "comment": "Malware payload", "value": "86265b072ed0d84418932f5628ad1abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805529, "uuid": "47d4d2d0-9378-4725-97bb-87246280d37c", "comment": "Malware payload", "value": "8e6bb07ca82d3156c2fd8cb2cf00ece0b4c0ad294a6583c7b30cb73f65a05327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805529, "uuid": "1416fdcd-d8be-412e-877a-7c02e5b40281", "comment": "Malware payload", "value": "2e2d7d350c8250f4008ddb06b97ee33a33b3772a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805529, "uuid": "779f2451-8afe-4da4-8b4d-118661065ac9", "comment": "Malware payload", "value": "317616cfda36142b394ac3a8ffa5981dc5f006aedca1815142bce6758060935e58c07ced107c93cb41d908c6f77a90f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805529, "uuid": "73908213-5fd2-420e-a816-c3e36df13d60", "value": "T179457B96F582D891D30A243305A363755F64F68737348FDB22A8CEAEAF33591983B135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805529, "uuid": "0aa1bb86-1f00-4aa4-8b84-18cd3e42d088", "value": "12288:lJOJD0LId95ickH62bOJbac4k6FnA5fpkTxzpZ:lJOAIdTifWJac2MkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805529, "uuid": "6fe67cdf-1b3d-4446-b96b-43001e553983", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805529, "uuid": "79aa4661-8c55-42d7-8c0e-4c908ba4c726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805529, "uuid": "4d384098-11b5-4921-b242-d56c5862ca9c", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.4414.21462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6254f93a-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1703781016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781016, "uuid": "4c8a18e0-9a93-45af-a87c-6ed1d23d251b", "comment": "Malware payload (Smoke Loader)", "value": "b8324acaafaf40cebfe3c91ff01a33b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781016, "uuid": "45a82414-bef7-4449-852b-ec0deadb34b9", "comment": "Malware payload (Smoke Loader)", "value": "8fca1f9021a9ced5f64038dfd78e59a5aa1250758d1455064a752fd142da4a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781016, "uuid": "a1e0e725-5a3b-4a41-a248-10c6921e76fd", "comment": "Malware payload (Smoke Loader)", "value": "fe686866bb58ae8c4c72edd1686ca2fa5bda16c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781016, "uuid": "3c24e614-48ca-4baf-9fbb-d90ad5117d67", "comment": "Malware payload (Smoke Loader)", "value": "de000b12396cc377aebda9613425411f1510538b6e40f8ee700dc148f77d15daa816daff96245d1060a30fb0691bcf4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781016, "uuid": "d08e3da1-ba4a-4322-a22a-0451cec85d03", "value": "T193548C1132E8D431E2F31A354634C7F50A7BB8726825546FABD42A795E60FE2DA30737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781016, "uuid": "eb0e0381-7a18-48b9-9899-61ee9a535e79", "value": "d3be11f6df42332786a4c0379b6f9121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781016, "uuid": "85005761-d721-4234-9f54-a8d5ca506be2", "value": "6144:Eec43GFV0FLNzEw8Y6Eeq7fvueRu/6wmbRXMA:Eu3GFmFpzEmeWueK6Nbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781016, "uuid": "82383cf5-613e-48f8-8c2c-fbcf96bccb45", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781016, "uuid": "0a3bc09c-0cba-402a-95be-2a87a3b8c904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781016, "uuid": "3b16c25c-eff9-4f20-a83a-1dc27da8a660", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9452d5c4-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703736433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736433, "uuid": "e7583e88-9755-439e-9d05-d0b2cc6badba", "comment": "Malware payload (Mirai)", "value": "082d196e8f4647958f852bd70c110966", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736433, "uuid": "b86e982e-9624-4738-884a-4449176d0c11", "comment": "Malware payload (Mirai)", "value": "92026ea37dc90bc99fb5d8a3b1bac515950e86e34483164c4169016981675645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736433, "uuid": "a768d2e9-f956-4ab8-9baf-e3a0a5cc1de0", "comment": "Malware payload (Mirai)", "value": "9467040f0a0496a69502107da742a00aefd59b89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736433, "uuid": "6c78fcbe-aab3-4285-a822-e3e58ce7389a", "comment": "Malware payload (Mirai)", "value": "e8382997424db26b4f617323a2bc92670d2a184465a2abbe5f21be77a1ac863e75e629888670ff129cd61056537feaf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736433, "uuid": "68a054f3-d7b2-4631-8ae7-890fe7e2a70f", "value": "T12AB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736433, "uuid": "998105bc-6654-4256-bff0-cf4cadab5a43", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZgoamm/QcuLB1niDNb:YuFX0GIk1MHyph5amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736433, "uuid": "b75b7980-39aa-410f-b162-8550ac50dbf8", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736433, "uuid": "4f167993-0d06-480b-884d-4e81566a6ef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736433, "uuid": "e5d07877-1d5f-42c3-9ecf-b61c8139574e", "value": "082d196e8f4647958f852bd70c110966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f4a4db-a598-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703778612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778612, "uuid": "6a59c8f4-8a3e-4ed5-a4f3-c9ce95d79cfc", "comment": "Malware payload (Mirai)", "value": "9b6525b2faa7615b618ec50267bd76b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778612, "uuid": "9416b7a6-b613-4826-9836-add5e4770f61", "comment": "Malware payload (Mirai)", "value": "920d8ba367f6c5db37da7c27329f83b6e63b426fa73d28c6edda9e7c7b9314ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778612, "uuid": "52b1c6bb-954b-4078-aba4-05fd15e73d75", "comment": "Malware payload (Mirai)", "value": "168329f609f602d464dd5715f85fef01f8696904", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778612, "uuid": "77297495-29b7-48d0-b9f1-efac163decd4", "comment": "Malware payload (Mirai)", "value": "260551ed1b81039c3b139f64e608485a43088b4d6337ffca4b3e25b63b74bf1d83b7292f7459e46b9cc1b1952707ed0b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778612, "uuid": "a65b1315-866e-4374-82ce-e45f6901d0bf", "value": "T16BA2E11AFD71CEADEEB092B985044465D3C0EDE11ADAC50D87C66E43636520B9F81ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778612, "uuid": "79a0b986-56d7-4e1b-bea2-ffc9fbfae2b9", "value": "384:MhkS+lhSPvMN1yzdYAGwn61EqfMRdVVVMk+kPGNrG491hH4ROBVRY0NyG:nzzGzRGiaEldHVYCAqR4sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703778612, "uuid": "a7d3e082-0177-403b-853d-529895c96b89", "value": 21908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703778612, "uuid": "0cb687a9-e85d-45ac-8d63-b8e0787ed379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778612, "uuid": "6b0e9bea-c370-44d8-923a-d10f4c7bd089", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1223fc-a579-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703765304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765304, "uuid": "af485021-920a-44ca-98ed-68cff1e50a74", "comment": "Malware payload", "value": "07a96737abf9a3dbb0f144f3bb2e7ab9", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765304, "uuid": "a4f6e38b-e4ff-4ff0-9ace-a410f7203066", "comment": "Malware payload", "value": "954ace438b52efa3c2b4101af7ad7292ce2b4fa1f5898c4d63426af449a868e0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765304, "uuid": "838a67f3-61ce-4690-874d-a61f678207a0", "comment": "Malware payload", "value": "26cd667764f3a24df3cd5c7e0a2d2a491bb79cd7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765304, "uuid": "218c63f9-8c17-4102-9331-a0ec7a3f285d", "comment": "Malware payload", "value": "71df0a99c8a6773be9ef8c8e74fa3b2d83573e29c1459179c12addf5038d843ad803daf7766d2f8f1dc29e1f7ed0b0e9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765304, "uuid": "87159123-9262-4b1a-ad27-d73fdaa08457", "value": "T1CDD57D82EE1C2852C2CEB27E89190754B22BF1A1477183773B31516CDEDE7E07D69B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765304, "uuid": "7a25237d-c72d-4b3c-8de5-d01022358d77", "value": "24576:wEbQXEhym7s9nbmFYizN5tXoKgQ1gQ75c/yDr/KgQ1gQ75c/yDr:w2S7E7vzN5tXzL77DSL77D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765304, "uuid": "cb04fb33-bbb1-4861-a689-132473e01f2c", "value": 2990640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765304, "uuid": "1b313647-04af-442b-a958-3130e987fb8b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765304, "uuid": "228c5ffd-db32-42cc-817e-cf8e2dd1c2f7", "value": "07a96737abf9a3dbb0f144f3bb2e7ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e91604-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805475, "uuid": "7eb1f6d4-3763-4eab-94e4-438e91bb4eda", "comment": "Malware payload", "value": "f6f9d6bdf65e974b66069871cd6c19ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805475, "uuid": "76bd03a9-c2c9-4ebc-9b5a-c55b0cae0a69", "comment": "Malware payload", "value": "98d8c640e9e03d11ea874a6332e4b2c39409594b6d621f0d894a8820844b3792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805475, "uuid": "4bbed6c8-ecf3-4f86-a5b1-e2f288829738", "comment": "Malware payload", "value": "e54c9094c3f75caebbbfe25718fd55b9165e8ca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805475, "uuid": "c1b10c68-20ec-4c17-ad89-1cc0f3664117", "comment": "Malware payload", "value": "81f7ecee999813ab25caf73fd3542dd89aed287c38946a723907b819e1bbce0134102219056099ad8a16807a93ee1971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805475, "uuid": "3d1201f7-82f1-4415-b7a5-91e1e81621c8", "value": "T109469E378E1D5CC9E90164719C1A8FDA2954EC21B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805475, "uuid": "903f1bbf-9a13-428c-82cd-3d2b0bfdcc6b", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805475, "uuid": "b426203b-d3c7-4fff-8a94-a88e462f414c", "value": "98304:+Irw7pJ7jPiYp0ViMWgi+Ch+qTbiObX0G8uIqlDC75QYcB73bmQFhTRvdcbHE/ux:+V7p9jiE9MXi+4+CNX0G8uIqlDC75QYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805475, "uuid": "775a4c48-8a83-4b85-bab3-6ef4bf604e0f", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805475, "uuid": "d80efbf9-f14a-4ebe-b75a-5d4b88da2cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805475, "uuid": "7ead460c-f46c-496a-af5f-c3a92fb724bd", "value": "SecuriteInfo.com.Trojan.Crypt.9027.17651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5659a5f7-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703780996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780996, "uuid": "342b9965-f496-4032-8a81-8b13fd63fb1e", "comment": "Malware payload (RiseProStealer)", "value": "e0e6f8a53f480d9b6ed8448548cb151b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780996, "uuid": "3d88b56c-e6d9-4ed6-b9ec-a9c92ea4ec02", "comment": "Malware payload (RiseProStealer)", "value": "9acf52d71b9e761ffdf2910a976319c7592eaed1feb86b49a63194b5ad1a6e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780996, "uuid": "7cbfc729-527b-42d2-a045-93be201eeb96", "comment": "Malware payload (RiseProStealer)", "value": "12999c5a070ae6cebc5af303c3912bde25b6fc83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703780996, "uuid": "a6d945b5-c9b2-44a1-a94e-b2ca39bd28b9", "comment": "Malware payload (RiseProStealer)", "value": "c84e25c8832d0355e7eec7cd3f214d418619380b699c61c0ecd920099ef188837d4fdcff32f4e66510f6555edcd9bb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780996, "uuid": "783412d2-4eb3-4e95-85ea-a6f35df00b05", "value": "T165756C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780996, "uuid": "4f680b42-50c1-4e26-99b4-618688f258e8", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780996, "uuid": "af2a19dc-f9ae-486c-85c7-65c3e1e92fb4", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703780996, "uuid": "b9ea7fe1-b047-4b7c-9a08-d302d96ed86e", "value": 1696246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703780996, "uuid": "3fc74df0-7ce9-4a02-81e2-4c879f53f4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703780996, "uuid": "39039bb9-7f42-4883-a242-fb90ef1fcebe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3dbe47-a540-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703740741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740741, "uuid": "4d724dc9-1204-4d38-8dc4-cbfc36d8c6cb", "comment": "Malware payload (DCRat)", "value": "cdd13d1de97a6ed5da19df954bf3594e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740741, "uuid": "b9becf3f-4b29-46c2-baa9-092062f5c8a2", "comment": "Malware payload (DCRat)", "value": "9c8b561cf27708f285da964826b1183608e75be698f6b5a4469faea8e535a760", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740741, "uuid": "feafa7dc-4773-4635-ab72-c5d678847d2a", "comment": "Malware payload (DCRat)", "value": "78afba30eb4521bc095998e98dbeff30c1e8c6e8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740741, "uuid": "7ee558f8-484d-4cf5-b770-260218c3061a", "comment": "Malware payload (DCRat)", "value": "dcaa5b284dcc7d086c12b01633fcce1a783789b0a5d8bcf6c3fcf0efd48fff434ea02e4623cf3606ddc039255c21bbad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740741, "uuid": "50b869ea-9c07-480e-988a-1f7274e78cfa", "value": "T14AA5AD027E84CA52F0091233C6EF454887B0AD5166B6E32B7DBA37AE55133A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740741, "uuid": "4895b030-7d4e-4c0b-851b-c787706b431b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740741, "uuid": "b86596bf-da45-44be-b2ae-ab582019ca7d", "value": "49152:fgylO+adjZ+RWMK8Fha66hwJVTxsjbSDDW5d1:fPOxdjrI7txbDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703740741, "uuid": "992bfe62-2b60-4b41-8523-87b4ad811d33", "value": 2110464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703740741, "uuid": "519c4341-6670-4e78-8163-be1b7b36c580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740741, "uuid": "7b57f674-722f-415b-ad7e-9eec67c94aa4", "value": "E4PlUK9p5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7402c8bb-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805527, "uuid": "cee04469-78d7-4231-afc6-7618f68f1631", "comment": "Malware payload", "value": "4cf6f4a31c3230d9c577e8466487e1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805527, "uuid": "cccec650-34d4-40dc-9c3b-b715d6f4f4ec", "comment": "Malware payload", "value": "9e1be55a2933293dfc98ca8c22f94fe051d7ba832026d6dbb1e021511eab1aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805527, "uuid": "e85df83b-dd54-4a3c-8092-acb88bc878ad", "comment": "Malware payload", "value": "e2c7c0693580e5e152d88e19f97039f54af71b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805527, "uuid": "6c1942f3-a536-4e91-a83c-c5b3e23c6b2f", "comment": "Malware payload", "value": "c789a489beb61d2805ed0d8737a97b2427a263349ba6ae51aa2b70604a1058b80e9b5ca21ecd7b1c6aba5213a51bae9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805527, "uuid": "c5fd8c6b-4b1c-4b70-b2e7-4e589ee74217", "value": "T1B2F49E86F6E3C0FAD35A3631407E2336EE77AA560A319BC71264DE681D235717D3B260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805527, "uuid": "815cd1da-ec92-42c2-a412-9c42d3b1e9c6", "value": "6144:E0AjjNZHMPrNr/gHsY//kkmTpSBm5cMhi4kQ73LA6lcgXUuF+lk5sa+8:bEzHMFs/kkmT4uQ8bA61UuF+lGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805527, "uuid": "8e852e40-166d-476b-9a6b-4a0bb3cdaf53", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805527, "uuid": "1ee32fda-85f4-442d-adcb-841282e3062e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805527, "uuid": "bcd49df1-a471-4e39-b1ad-d0e5f1cf49b6", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.18874.29031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587ced82-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703781000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781000, "uuid": "ed92e7e0-967a-45d9-b188-197737be0cda", "comment": "Malware payload (Stealc)", "value": "cdffa37fc141d02c84b9b936ed0b9cf1", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781000, "uuid": "a4ae9f12-5a38-4138-8527-482aacefad95", "comment": "Malware payload (Stealc)", "value": "9e8fd63fbf58938109c336c047af0e0bd059b3b7840da0ae1577b4ba9fd20599", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781000, "uuid": "58c62f4e-679e-4d77-bac7-418c097d40d2", "comment": "Malware payload (Stealc)", "value": "353d2047b0c1ab2b56c9995025d166ccf53efdff", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781000, "uuid": "e44818c7-44b0-40b8-a918-ec7fa445e14e", "comment": "Malware payload (Stealc)", "value": "152ac4fecab5ca556d55be4f7be92636c674f504e5213fd4cc02767d0c49dcab29e120118ac7caace022010edb64ba12", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781000, "uuid": "2a152717-36d2-4053-876b-daaeb05faa9f", "value": "T19555F1CE89EA461FFE56E6A5009CAF48121CC0B5F740A6D1C9CC19C0DE722672FA5B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781000, "uuid": "f69639a8-e8d5-4ad2-aaf5-8123f10291fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781000, "uuid": "4cebd6ce-5b20-43f4-8bda-6e92449ff288", "value": "24576:Aitr5NIPHu1yWk0grwGaKdfQnmTmA5FE0y5ekqjVnlqud+/2P+Af:AIFN/1yNlwwdInSvkqXfd+/9Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781000, "uuid": "5c1b27fa-c489-4eec-9459-719dd83ca689", "value": 1300704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781000, "uuid": "2eda16ce-bcf4-4860-aac1-f53de186a43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781000, "uuid": "b73021ef-9442-4b3e-b16b-0d2cc8c49462", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b885c78-a52a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703731264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731264, "uuid": "5bccfe35-a3d6-4af0-80c9-a1255dd03d16", "comment": "Malware payload (RedLineStealer)", "value": "9259173159b586e1dc465da5e1bf600e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731264, "uuid": "d6faf467-aa28-450e-901e-da6fe7916378", "comment": "Malware payload (RedLineStealer)", "value": "a5dc497a5c88da6b8e0598f1eafea3b025de9ca5831af616dc9ce1fc7f06d805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731264, "uuid": "c97e18f3-9cb0-4381-a948-1478d91b8b28", "comment": "Malware payload (RedLineStealer)", "value": "f497a72093babeac07cf7df557eb532fb8f370fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703731264, "uuid": "fda785c6-3870-4e0d-8578-3f513e815a09", "comment": "Malware payload (RedLineStealer)", "value": "a97f07f8f0fac0ae79d65d01d017b5c77b2a429c9189273676379992db07fdc6614d56c90c99d5fd22d44dad51cf750e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731264, "uuid": "94621642-b9fa-44cb-876f-488b33dc5189", "value": "T117248C1C678DF94AE1BE47BAD8B141B483B08926A153E71A5EC8FDEB3A10F8113511DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731264, "uuid": "7cc516d3-6980-4c80-b4ba-c801f026ea45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731264, "uuid": "529aac9d-97c3-4e07-bb8b-0a1517e55e7f", "value": "3072:JjACZAqYD4GWkgcWZHBPyu936DNALZd9UAYTiG5qUUBQpzRV5tYc8TVoj:iCZAqYD1gJNEu9ITifeH5uc8Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703731264, "uuid": "55f737a8-b2ca-48ed-8bdf-d9a2352e68b0", "value": 226640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703731264, "uuid": "e3c923fa-3d22-4c8f-b26a-3b63344ac512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703731264, "uuid": "888a97a7-9c59-4f13-93ba-62c18863d2c1", "value": "Nebulizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d138ff5a-a565-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703756721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703756721, "uuid": "a2fc319e-1694-452d-9a5b-6f15f3c04fee", "comment": "Malware payload (RiseProStealer)", "value": "b6bce0fff462b8de7dcd470b9fcacbf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703756721, "uuid": "91e7da1b-4457-4646-8436-d24b397201d4", "comment": "Malware payload (RiseProStealer)", "value": "a63a0b539e4007ebadf86062b91fdd6314c783fa1ae6f34d7e98b23ca3d1f00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703756721, "uuid": "e7468984-d51a-4d80-9de0-71a207f449de", "comment": "Malware payload (RiseProStealer)", "value": "36486f97f10196be2510e657d2fd44673828641c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703756721, "uuid": "0203fcf2-3d99-49ec-8af7-5760058375c7", "comment": "Malware payload (RiseProStealer)", "value": "740e9c343eb3ec7238da25b4d2853a8bdaef3a345da625c0f5f849ac394512d001fd26389b3d99ed00301ded822d2078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703756721, "uuid": "789b82c9-0244-4984-8efe-6d07ce12a237", "value": "T173162300BD996019E23210799671F95DB8BA6E7B9360AC1679AC33FBAFF34640437353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703756721, "uuid": "67bc7d92-f4aa-4022-a792-8c0ac7fb13c1", "value": "951bffb8bd555c3dd2f81c720d26f2ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703756721, "uuid": "da6106e1-ede0-4b0d-bb75-354ffac6a039", "value": "98304:PViX6RWzTOpek0GKCbPSMATPvvTUCDCLZeP18dS5Xs+WogsIr:YKYoekdKCbPvavvTUCWG8Asuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703756721, "uuid": "f2cd36a4-7d0e-44b9-a4f7-eee5c43ac446", "value": 4221856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703756721, "uuid": "958f06d6-f828-4194-89b0-cbeae2a6eec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703756721, "uuid": "94734442-5c3e-4d39-badf-375e5f9e8616", "value": "b6bce0fff462b8de7dcd470b9fcacbf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af46574-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1703781004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781004, "uuid": "cf61112b-ed78-4155-a312-9d73e2304510", "comment": "Malware payload (RemcosRAT)", "value": "546c3feb60e349a2c00e35de128670ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781004, "uuid": "0edb5976-2303-4019-8c61-a0ff6c1de1c2", "comment": "Malware payload (RemcosRAT)", "value": "a657f9efe2f82abb3f5adbd90e9cce0cda71769e39f301c2bce8bb214daab809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781004, "uuid": "d778a5a5-019e-4053-8756-9c844528de0d", "comment": "Malware payload (RemcosRAT)", "value": "0ec6924030bae6fc3e986b7132a81c882dfd053f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781004, "uuid": "b95bddb1-9614-4fd1-b201-ae4cf963ab9b", "comment": "Malware payload (RemcosRAT)", "value": "20cf3dbb7415ed40509b7c4ccc7e1f26fb386baf5c6ccb94b54c5c8663246963097431671eaf9a4154ebada564c3e279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781004, "uuid": "4a9a5cc7-ee3d-46bd-9501-bab02ddfda95", "value": "T133949E12B492C032C17212740E29FB7599BCBC212936597B73EA5E5BBE741C1BB36363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781004, "uuid": "764915ea-1d26-4384-98ad-1dfe2a5b7de0", "value": "8a3b06a792183c402d038c6ccea86944", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781004, "uuid": "474f024f-c70b-4a12-bb2a-cd5cb71c3ad3", "value": "6144:JCJBSkHyP4DivRrO+d3cyU6320ho4nbJAj0N91EU7ZUFbz68AO2LjXH7OcrR6B3:JCJB/RuFhU6ho0ej0N91HFAAL77OB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781004, "uuid": "a72e8a0c-8114-4b05-a9ec-f2561c9df89b", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781004, "uuid": "4dafba28-4fcd-4b5b-8dbd-921ab641b7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781004, "uuid": "32c5032b-0535-4e2a-8f15-49502a22f60a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c4b59d-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805530, "uuid": "4bfc7b40-52a7-489e-97d8-705b1db4b542", "comment": "Malware payload", "value": "12fc1a5f731359f5a8c1a56462fb9c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805530, "uuid": "9fae4150-caff-46ba-9266-90505bb246f6", "comment": "Malware payload", "value": "a668e178de7763bf4f081b508e8b17ebe7744bffba2fdee104771d8535d15f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805530, "uuid": "38474feb-aacb-4f55-9f84-5bee7486818b", "comment": "Malware payload", "value": "240f590049dd7d521af38c12843a6fcaf77f1d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805530, "uuid": "d7d01806-25e0-47b3-9a43-f42615acc181", "comment": "Malware payload", "value": "73e57e84b8225024d9106b034dd507b1307263e6489ef7b7eefcc3a46b6c1a38dc5e0ba069296a976990b648c534ec59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805530, "uuid": "42ba11b7-8302-4f9d-b1bb-ab667fd288af", "value": "T1B5469D379E1D5CCDE90164719C1A8FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805530, "uuid": "5d362e8e-6f00-4a0b-b3b6-09b994d10bce", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805530, "uuid": "cb20f9bd-7d48-449c-984f-50201a15613b", "value": "98304:IFaaEGz5s8L0vg43bZgY7yhdqTTlOCxdp+mgulfa2FMIRavYd96:IrEG9LLibbKY7od6Fxdp+mgulfa2FMIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805530, "uuid": "9f3f170d-7a29-4a36-aeec-5811ef36503a", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805530, "uuid": "2ea69502-2db7-474f-8368-3a95edb98c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805530, "uuid": "b8ed2d3c-985b-4073-9f41-44bb618f1779", "value": "SecuriteInfo.com.Trojan.Crypt.15266.8644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609342a8-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1703750090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750090, "uuid": "960651fa-e34f-4e6a-9a99-b748925ccd1b", "comment": "Malware payload (XWorm)", "value": "6c96afbfd73f9b02d4dcc8f671c199d9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750090, "uuid": "8e483442-c040-4b68-a89e-4e77a881df1a", "comment": "Malware payload (XWorm)", "value": "a6f2cd5eaeb7bd370bc2bd35fdf6ef19f5199f48b71bc6658d71afe42cc69815", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750090, "uuid": "2acad841-6a8c-4832-8cdb-38bbeed638bf", "comment": "Malware payload (XWorm)", "value": "c103a4ade6a2bc822dacfd33c3a5d1db6bd10c94", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750090, "uuid": "0d6018e3-de60-4925-b58c-389b62dacd7b", "comment": "Malware payload (XWorm)", "value": "6a08b7771ea86f788ad940c687075027d9abdfd8a1073cff90c0b1a82de7ba5fd99235fa04445e2acc7b1534c80aa4ce", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750090, "uuid": "9b2251f5-37c9-4b48-b367-697820b10a20", "value": "T176020E107AFF500872737F622FE5B6E98E6FB7B26A15649E6000030B5A62D84CDD1F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750090, "uuid": "f784fa12-4a01-440e-ac5c-694e95b0ace6", "value": "192:KEOsMceESxSgY3oKUNSgY3wGxRyi3lWxJjyTyUxm3hDyr:KEOsHeESANoFkNwGxQi3oxcOUxm3h+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750090, "uuid": "3d4f7a47-261b-4ebf-b408-b9da467a5f6b", "value": 8512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750090, "uuid": "9d6b7d7c-f729-473f-b20d-2353b2fec3e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750090, "uuid": "14109614-04d0-4bae-a85f-6cc9724c4110", "value": "IMG5527735001.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346d80d0-a548-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703744003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703744003, "uuid": "953153e1-cd50-4d30-a370-6947996981af", "comment": "Malware payload (AgentTesla)", "value": "ecf8a0698b67c5f21ce9724a72bbe21e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703744003, "uuid": "6e949255-1c88-4ea9-8658-bf2de9fb49da", "comment": "Malware payload (AgentTesla)", "value": "a7819fc6e042264920bb5d532e828c216507d925661124c0af02b6f1e6290311", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703744003, "uuid": "9ad101b2-5a55-484d-aeec-52bc3b6404fe", "comment": "Malware payload (AgentTesla)", "value": "5cb9059c14acc3a87595424995e9d16b9f74137f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703744003, "uuid": "2d98b6f9-b2c7-4e25-b54f-5f2ad42ddb67", "comment": "Malware payload (AgentTesla)", "value": "d891de09a826a25eb41cd7078d5832dee079e7cfd0074dd0a7feaa2a54eb02c45ceca468c2dbab10f1a278d9c8886d33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703744003, "uuid": "789d6068-bdfd-4a72-a173-efc3161ad395", "value": "T1C824456DD38F02A98F125376971B1E4502BDBA2EF34552B2306C933433EEC3A51666BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703744003, "uuid": "fc0129e4-bcb4-4dde-ab37-790ca5a5ce39", "value": "768:ZwAbZSibMX9gRWjCxjXPCN4IGhmxHmR3t7mbr1G8ynk/fW:ZwAlRZxTCN3zO3Ebrg87W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703744003, "uuid": "b72fa522-50c5-4f21-b196-5689c824c162", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703744003, "uuid": "8d21a176-66fb-460a-8884-3d2f2ba29f6a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703744003, "uuid": "1b28e3c0-1813-48cd-bef0-40790edbed7c", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.24468.17668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3b8ac4-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805484, "uuid": "f1b79c73-5d40-4db3-8644-bfec6c0964db", "comment": "Malware payload", "value": "3607a53301459535caf355725e573ae5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805484, "uuid": "da447acf-c0dd-480a-bd11-1a233f2eca61", "comment": "Malware payload", "value": "a98031d5a84b7c883becad43fb1f2477e5f46c595cc99c514c58f7541948edbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805484, "uuid": "99d8d440-369a-418c-a653-59b7aa5a023b", "comment": "Malware payload", "value": "7e7ebe48635ca8e75acad193ff143e163c3a954b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805484, "uuid": "ff43578c-4f35-495e-a6f9-c0f3f18d516b", "comment": "Malware payload", "value": "6e252dad7a6a0aedebc1bfd24d494be49e0ef32aceb724b601501543aa753cae3034ae2d769e6b7275cd5565fe7c6f70", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805484, "uuid": "270e2456-6379-4834-85b5-9292297ff31a", "value": "T13064080A7A93E83BE03807B04B87D6F49E61BC179C57461F6EE45E0F3C7A5409E722A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805484, "uuid": "10bc28a5-3b11-456a-b1fb-6b4511fdbfe2", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805484, "uuid": "d3c5ae9f-48f5-43b2-85f6-282d15bea3a8", "value": "6144:+RR5rhZFQGrsUwF7vlPoSoUh71/IQARL2QcVCoE6ESpf:+R5nWFpPoSoC71t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805484, "uuid": "bbb45bc0-4ecf-405d-a2f7-a481a2d1a403", "value": 310868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805484, "uuid": "e8454c63-d179-4fa5-b6e4-dd0148c9d0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805484, "uuid": "a00e1b7c-eeb3-4815-955f-115c983bc990", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.26802.4001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7f67cb-a5a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703782188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703782188, "uuid": "a0ddafd0-cc13-49fb-aa8d-0ea85851ffba", "comment": "Malware payload (Mirai)", "value": "d2e328a4fc808035e21dde15a1f2f6c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703782188, "uuid": "a3a29193-ea00-430e-b9a9-58c4f179c4cc", "comment": "Malware payload (Mirai)", "value": "aa541ed842ef1ca80c8f7bb40818285d143095e3f8374f2517e37a174272deb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703782188, "uuid": "d02c9bad-5e9e-432f-a5a0-0a6776ec5480", "comment": "Malware payload (Mirai)", "value": "ff74155b54abbcf97c64a7edcf30d44ed67cbfe5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703782188, "uuid": "f2cf481f-8889-4f41-91da-e1d194814bdf", "comment": "Malware payload (Mirai)", "value": "0110c13f84910caa28a1b6e90abee454ff1446f31484680ac009bbbb35ca79c99036421782d8b513043be4dc49cc2fc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703782188, "uuid": "2ebf10ea-6c55-4c1d-a674-9f6a9ec47391", "value": "T161C2D036629698118B313C79E8FCC813A90911B4E4F7A0772E2461D876F30B7E9B508B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703782188, "uuid": "b924d753-d0c9-4ff9-8273-69d4c17f33a6", "value": "768:X9xM13sdY3QEZOhWvB+CyoY4Gmf5L9q3UELCEc:XBWQThk9yJ4GCqLTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703782188, "uuid": "55e88d58-8d63-4ce7-a013-9ca521e97579", "value": 27452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703782188, "uuid": "fcd48d48-5719-4681-9808-4ed577b6571b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703782188, "uuid": "22da4e01-8526-41b4-9945-57a436f478b1", "value": "d2e328a4fc808035e21dde15a1f2f6c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ba273b-a559-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1703751311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751311, "uuid": "802abac1-ac3b-4f44-be36-db879ac2ef44", "comment": "Malware payload (Adwind)", "value": "0aa53c72784058e080d2402dd0b59fd9", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751311, "uuid": "ebb8a01c-be8f-4b8b-8327-e395f04de141", "comment": "Malware payload (Adwind)", "value": "aab09af59976e4fe076958a69cd215288d000bc8eafc45637f8fc7fcb545c4f5", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751311, "uuid": "6260e19c-e34a-47b3-af8f-2b4c2653a6b2", "comment": "Malware payload (Adwind)", "value": "019a73b573cf8b4dafc38bd5bb060fc7861264ac", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703751311, "uuid": "94e2889b-ae97-4e29-92ec-dd9875eac62f", "comment": "Malware payload (Adwind)", "value": "a0ce1510cdc4e8d24529eea9b879c788c85f0ce4b0a5d9927e573f8e21df9a1789a81dccb21cf7fb0869e83e85919d91", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703751311, "uuid": "462e2a42-d03d-4be4-890b-9a040d406e5b", "value": "T13ED31292D9F28E7B95AC55342E26B44763B42733A6DBCDD7B82136215C736E031913CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703751311, "uuid": "05bd7ade-c938-45c7-9246-9d2171c9c1c8", "value": "3072:F52qBTtmcdYkANTmR18S9nSzyQ5jTWbQhxlZ63aLbn:F5HdLpL9nkyQlWEhxlVbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703751311, "uuid": "0af22e72-95c1-4460-999c-90a0fb54ed98", "value": 130936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703751311, "uuid": "ac7bdc04-8a4c-4216-a660-044f569039f6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703751311, "uuid": "0776a206-5e0f-40b0-abda-3207f46a3dfe", "value": "0aa53c72784058e080d2402dd0b59fd9.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42931745-a5d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1703805015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805015, "uuid": "b6227c09-84c8-473d-a24a-a11aa3655684", "comment": "Malware payload (DCRat)", "value": "20ff4291f36bd9fbba6b368dd2690cd4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805015, "uuid": "b0e3ab37-61cb-4527-b0f1-978edfa2bf47", "comment": "Malware payload (DCRat)", "value": "ab0f07a906a076c101943b677a6325390574f4184cb1d28effd51fdb62bd6ae0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805015, "uuid": "509390f6-63ce-4605-944e-07c03e6a43af", "comment": "Malware payload (DCRat)", "value": "0ef7c0076b42e3fc115623f90039224163b04d70", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805015, "uuid": "83aa86f0-9b35-4e2a-bebb-043d5a171ecb", "comment": "Malware payload (DCRat)", "value": "9b8af895d07956daadf4885c7196e6b1c387a39d7d481fddba410f7b500a798ac079aefdb32a17c8161585782be936a6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805015, "uuid": "ce2abfd9-42cd-4e71-8eb2-d7509f3edbcc", "value": "T14B050701BE44CE11F0191233C3EF454847B4A8516AA6E32B7DBA37BD55123A7BE0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805015, "uuid": "5d32393a-633e-4808-8c12-77eece84edc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805015, "uuid": "fdda577b-d363-4b83-a5b3-59e53b9310c5", "value": "12288:GAbuRJ+dCGgR89WY7sf/qRAPFebQjr1p4aySC9WuzvAAb:vb+J+AY7sKRELj/ySCoAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805015, "uuid": "10e47662-73a0-487d-b537-2ee3cca56954", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805015, "uuid": "80ecbfc2-86af-418c-ab55-14ee15bc4fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805015, "uuid": "8ce13f79-506e-4a5f-bab9-bcd07b9c19e9", "value": "20ff4291f36bd9fbba6b368dd2690cd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e41acb1-a58a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1703772446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772446, "uuid": "07f9eaaf-0003-4b79-b9c9-812401834878", "comment": "Malware payload (Hydra)", "value": "42c341a9dcb34edf5eb2c7ba9fbf0d2e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772446, "uuid": "37787c6d-a830-4b6b-9c78-4db82ccac723", "comment": "Malware payload (Hydra)", "value": "ac03eee7abe9ae6ace0ecf36d25e95410178444809e9e87a0670ee62ded4c78e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772446, "uuid": "8a1da1c3-b138-461f-8f33-4c21b4ea820a", "comment": "Malware payload (Hydra)", "value": "2395bef9b282874b83aae62bac1a60afc49d029b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772446, "uuid": "23f7329c-2b4c-45b0-b892-75bae1f66f85", "comment": "Malware payload (Hydra)", "value": "852298d78a948bb7e3fb59917d425007779d0e8e22af23acc349a26a160fb91b0eb2fb65bb1e2ad650154c96358598ca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772446, "uuid": "6553f241-5de3-4110-bf2e-ef1387a3e21c", "value": "T10435238A3A41DA6BDC7C41BC6EAAC0CD51623F54CF4A56873525B76C2A733C90FDE290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772446, "uuid": "6fa90068-13f2-486d-9aa7-3a4dbc0e7164", "value": "24576:x+e9Mavw3MbzCpTfM0XScS80kpW7Z+ch5LC1zEfKgEjN:FxvR+pTfLXScprpQ+ch5qEtEjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703772446, "uuid": "27248aff-1cf0-4fbc-bd9c-d5bcfdd78be7", "value": 1125651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703772446, "uuid": "fecf314d-8e25-4de5-bad1-d5322dc8923a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772446, "uuid": "e1e08efe-aa60-47cb-b74d-2b9070e5c73d", "value": "dl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba5c25b-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805513, "uuid": "6ff37ec6-d9ce-4122-b8d3-79faade4a310", "comment": "Malware payload", "value": "2627ab4b7bf2e1fd9c6aa8b078c335db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805513, "uuid": "71751e16-4f80-4736-8c57-b8b9875593a5", "comment": "Malware payload", "value": "ac064a659a6365a890bf526461b66ebaa5b08ee0f504087838d9368d5b015628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805513, "uuid": "66d187b3-5c37-4da3-8972-b6410043e332", "comment": "Malware payload", "value": "97361c5dc633cf21a4487781c1cfeedd27eede8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805513, "uuid": "a5ad7552-e882-4637-9501-c5d3e0672832", "comment": "Malware payload", "value": "ec063eb1fa6814373a9c147c5f0dd089a81879372cbfdb2b13580ad1b17d4d35c2c79629c3662373f938840c8eb2d2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805513, "uuid": "b557f254-5e15-491e-b716-98621b728882", "value": "T106469D379E1D5CC9E90134719C5A8FDA29949C20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805513, "uuid": "2a289381-1420-4365-a6db-31ec56303063", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805513, "uuid": "2afefea5-5ccc-49a9-9694-44478b17baa0", "value": "98304:Hi+0/Jz9STcWz5TsXWgERuhJqTuiO+lpxeeoiVLiiR44GqmIphm:HA/JJOcUKXXERUJrUlpxeeoiVLiiR44w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805513, "uuid": "f1007791-ae06-429d-bab6-5ef93bf96302", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805513, "uuid": "5f9235be-dc44-4690-a2d0-6e16e8fd8ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805513, "uuid": "1e11e9fa-62e3-4b72-9c25-f7828666b327", "value": "SecuriteInfo.com.Trojan.Crypt.30420.4476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdada60-a579-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703765277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765277, "uuid": "92ab8757-6dd2-4fcc-a1d3-65e1768f72ca", "comment": "Malware payload", "value": "c327d8e3f19d0a87052119773bc22eb7", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765277, "uuid": "db0b5295-134e-48bd-a525-502bd65b1193", "comment": "Malware payload", "value": "ac2bd01b7c3470693c00fc1df60af198019ee320eff10dacf29d9a51cda4d722", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765277, "uuid": "2b546521-5133-46bf-8053-1c8acd8d5fc0", "comment": "Malware payload", "value": "8fdb486d49248d50ffa5d8cc69690f608fdf08b8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765277, "uuid": "9c5bfb24-5a0f-42a8-a802-eca6e490befe", "comment": "Malware payload", "value": "bbb093bbb80189c691e5d98cab51451b83c3a3bfc87cc1118e7fd0c780a27d67d7c33caba2246b76171befc06eb13227", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765277, "uuid": "a748bd22-eb48-4607-b628-93a3a5a3fcc8", "value": "T112B4B853E2805FF8D57C5738C5CB0339A722F70B96A6832657228206AFA33654B3DED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765277, "uuid": "30788927-6a34-4558-9a9b-40e8d42464c7", "value": "12288:E52GTzxPSCKaKmKGKIQ+gaQ2ojfikgxGH4Zg:tCZ3KaKmKGK3+KfikgxGH4Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765277, "uuid": "66f318ae-c9d9-4d3a-a0d1-225ef1ca626d", "value": 508784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765277, "uuid": "45af6154-0801-4b6f-8601-2bd1c77bb8b6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765277, "uuid": "14081a73-8d65-4cc6-8fcb-29bcc275de16", "value": "com.AppInstalleriOS.TrollInstalle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce193e69-a5b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1703791505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791505, "uuid": "bfba0b0b-697d-4c19-897e-a289f393ed8f", "comment": "Malware payload (Gh0stRAT)", "value": "26b878a7d801d4f352e57748d4aa304e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791505, "uuid": "29a6da77-979a-4d63-9bd2-10fc1cd11809", "comment": "Malware payload (Gh0stRAT)", "value": "af27ba7546b26e7076a25aacb66bab41fc711d2465d3f6ffecd5cffe74ecf678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791505, "uuid": "5f3e9cd3-696a-4d20-a335-1cba67d6d551", "comment": "Malware payload (Gh0stRAT)", "value": "dae264f4d466b92e44849acfa48390d5de9051eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791505, "uuid": "46fbfbca-6a6c-424f-b97f-2b5a8b58e5cc", "comment": "Malware payload (Gh0stRAT)", "value": "735e5caefba74ea6d749046ecf90d7f9f840b2973010e747c7916de4669572e65bf44d98feb3929a084b75103c49c464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791505, "uuid": "13c4f7c6-cbdb-4457-9cdd-e56f7000c1e0", "value": "T194A4E132BEC540BAE945443010FA2BBDB63ABDD606017E979704ED652D333B9F3162DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791505, "uuid": "d45e139e-6037-4fb4-a63f-0952d48124c8", "value": "38f0f9287efc15001ad1f55b3ca368bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791505, "uuid": "aab578aa-5609-4280-8638-6d5b6d785198", "value": "6144:eiTtiWB0sL7tSJ5qp37O5J4G7v4G7AWF1DXrzWQwoEzu4IdKZLuZR1UwnjbTn:FXB0sdSrqN6ZJAYDXrzW/yi5Y1UwjbTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703791505, "uuid": "47b23b50-38a7-47cf-a2d3-035772154761", "value": 493550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703791505, "uuid": "ba7d8779-fcaf-4ddf-ad55-d5a764ca4a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791505, "uuid": "9bd3e024-fbcc-4eb6-ac66-5e5a7595b9c7", "value": "26B878A7D801D4F352E57748D4AA304E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb1824f-a54e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703746810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746810, "uuid": "dde5ee76-09b7-4997-80bc-6637b51647ae", "comment": "Malware payload (Stealc)", "value": "08335bdd48a24722cad27405aa41b915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746810, "uuid": "dba17ae2-b426-4568-a687-fdfc8f4381a9", "comment": "Malware payload (Stealc)", "value": "b15800d9e86b483c3c2473e20255c247c4879c5d9305590b2eb779871bb136fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746810, "uuid": "2a9b51bb-661b-45d5-8124-f4c7e91fd6a8", "comment": "Malware payload (Stealc)", "value": "176854b69dfab7ec3520e25f90dbc516ff7672d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746810, "uuid": "a318d1c3-f397-431a-829b-f2ca52a39267", "comment": "Malware payload (Stealc)", "value": "ec94dc51dd00de66390b76c58d8dabfde970054d30ae10df81b59453807ac086f1b2bab3877277f1391e6b4988706d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746810, "uuid": "6d77a804-c1b6-4743-9285-b2d40e3f6fe3", "value": "T1C2C53353F7E60161DDB4233058EA07C31E35BD83DD74A30B7B92A2CE49B39A56471B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746810, "uuid": "121b9137-c470-4f32-a5c7-73c07ec7cf0f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746810, "uuid": "135ad2d3-ad3f-4ebf-89f1-cceea75aec71", "value": "49152:GDKeuUS/fe2a2AN8jrqXgOWqaSyJYhZcn3uOoaX6uKP5P0z4YxAwuLNKRUqHyuHg:QK5UUeOk8jrqXLyW3yuIQKhSwuRWSaHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703746810, "uuid": "0dcc501b-582d-4901-ab44-330165003a2f", "value": 2608128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703746810, "uuid": "2132ced3-ce47-48b0-9af1-5f82f9edc914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746810, "uuid": "1b5a4ac8-f63c-4036-a9e2-5d08c1faa13f", "value": "08335bdd48a24722cad27405aa41b915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d869eb57-a53f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1703740412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740412, "uuid": "9ec7e3ba-c4e6-406c-8ac7-6f689d46b0c5", "comment": "Malware payload (Amadey)", "value": "b74d5e7cd289250e9ad0344560febb2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740412, "uuid": "7a7f09f8-6f57-4a02-8d5c-1262df74f9a7", "comment": "Malware payload (Amadey)", "value": "b18f189bad1ee1382b2c4f00e19592913e2600750447742ae3846f8a231e6d99", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740412, "uuid": "eb945892-2c4f-4841-be7d-e6a5086e449a", "comment": "Malware payload (Amadey)", "value": "7a77cde86db25a487c3b31e0dd0206d0fca311ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703740412, "uuid": "7705731c-e19f-4cfe-9c41-bc2bb1814090", "comment": "Malware payload (Amadey)", "value": "af4365ce0ebfe5c801d27469f5cc9c4328c382622441920a40b21e24c80d258cde1f03eb5a5594b36684daab6b57b894", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740412, "uuid": "25973fb4-894e-481c-ad11-1e3c40ff4bf4", "value": "T1C564F15176F0A0B3E6A709B3CA75CF655B6FF8722B6441CF27240A2E1F622D14A32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740412, "uuid": "e5f4adfc-f80e-4fe9-8c0e-1e9c6a1920cf", "value": "99190d8cd877eac8f1ec8c4c753e3a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740412, "uuid": "ae60c072-c5ed-4ed5-8e99-e0285ae69031", "value": "6144:1HbVLTzigDios0S859Lsb2WKjFmJnfW8SDTacUSThPJxAnlHfRo:rfziUiosR8runSwdYacUY7gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703740412, "uuid": "aaafa13c-f8de-4ca7-b1e8-aaf9d54604e2", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703740412, "uuid": "42889e30-d365-4302-b692-5a6145b88495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703740412, "uuid": "40ad47d5-dcbc-4f57-a0d8-3989dfd45e4b", "value": "Utsysc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64e2534-a58f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703774715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703774715, "uuid": "c0c21683-8365-4d0f-a892-95edb8c5fcd9", "comment": "Malware payload (RiseProStealer)", "value": "a64d3efdffb5db4a80213b196c336f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703774715, "uuid": "83242377-995e-4554-ad35-0d27bc739491", "comment": "Malware payload (RiseProStealer)", "value": "b1fb72a02b7436b470e38efe26e869bf133c9d5fbea1b8f346847fea69cbfafd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703774715, "uuid": "3af04156-f623-4734-8fde-8edc08909f1b", "comment": "Malware payload (RiseProStealer)", "value": "06e844ad84ae392b4663996f8352a2e3923d0515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703774715, "uuid": "bda1b81d-a1d8-438f-a6b2-efd4fb235f67", "comment": "Malware payload (RiseProStealer)", "value": "666b3ca91234f88c4bd192c681db8a1622ad0660bb90e43f0481759e9a4205c1c6d842e42e611e419006db54dd8af699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703774715, "uuid": "cc2bbba5-c866-4775-8e6c-02d274421e91", "value": "T108C53383B7D201A2D9B8633028E917D35B367C97CDB5631B7B2165CD18F38A0697272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703774715, "uuid": "31058166-afaf-4a64-8bc0-c9260d6b0da8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703774715, "uuid": "07b52f62-5bd3-4dbc-b930-ef967a212055", "value": "49152:iGtKtH2262oFyWcJEgpjlVoyIY04Inxuhbaxzqjxoy0p+pPvT+L0uHEqPpQ5XaWf:PG2+EyWcJEPynNSultYaXT+QmREXaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703774715, "uuid": "5a622bc9-3767-4d58-b03e-855a928e1304", "value": 2607616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703774715, "uuid": "aea7d0cf-0be3-44c2-ba1c-22a603be2f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703774715, "uuid": "e14a0d42-f9b2-4791-87da-62a81dfa107d", "value": "a64d3efdffb5db4a80213b196c336f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f6f011-a528-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703730553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730553, "uuid": "7506cf71-7170-424b-834e-86766e3f4b45", "comment": "Malware payload (RedLineStealer)", "value": "19964f72671367499bff2bbf6c0e02b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730553, "uuid": "b462e2e4-36fc-4277-8752-a8794b8847aa", "comment": "Malware payload (RedLineStealer)", "value": "b224f01d877a0bbfbadeb54f49e7e1efb2762d27fa2c4e15f2567a59a37f15bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730553, "uuid": "9044da00-76ab-4bcf-a2b7-94c79cf3ba48", "comment": "Malware payload (RedLineStealer)", "value": "6d431728ad3a630746e0ec32b3fece56acf17b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703730553, "uuid": "52c57bbb-37e7-4851-9b00-ee13eb7957c4", "comment": "Malware payload (RedLineStealer)", "value": "9a054a9dd98839afaca391a632fd2587ae6ed3e1a50ed01f82172b346c370e3222cadd13a39ba5505f7c14d084e33a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730553, "uuid": "9190257a-76d8-44e8-b65e-bc508202a30f", "value": "T1D4C4E00DA1A65F51C3C83571AAA3406A83B9E58B2173F72E3F5805E275833FCD74A2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730553, "uuid": "5a36f5e5-9a17-498f-903a-bcc61c55e2b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730553, "uuid": "5fc0bcc5-7791-4ea1-927f-c5943adcd340", "value": "12288:bGsQ5ZlvQTCcAEa3CfluX60rwj6x8olSoauqF1K+O81RH:CZlITCcAYuX467ltaTFE+O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703730553, "uuid": "6e9d4708-acee-40fe-b1e3-c02fc93d66ca", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703730553, "uuid": "64c79301-c3a1-4c12-9e40-d719d576eb5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703730553, "uuid": "7ac0905f-65bc-4ca8-8adb-8866277f5a7a", "value": "DPDsvcx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893f0534-a551-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703748010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748010, "uuid": "cdf1fa4a-a658-42b9-9ef8-a29313e82b72", "comment": "Malware payload (RiseProStealer)", "value": "f3b0179ba1f2f60ea88c4f14c4e7a829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748010, "uuid": "8fd8a5c6-d46a-463a-ac82-cb37f81f9cab", "comment": "Malware payload (RiseProStealer)", "value": "b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748010, "uuid": "dc0bcbc6-15f2-48b6-b001-95e4a5b36904", "comment": "Malware payload (RiseProStealer)", "value": "cada0b63415bfdafac480da21742d673a6f1d359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748010, "uuid": "ed1959bc-ead8-47fa-b72f-34add27b3d48", "comment": "Malware payload (RiseProStealer)", "value": "672f747bd27386bd3a405f9468d3d6b260825e0f6a3cbb4583d5ce2894a637206fd4eb0a92f4b4ac536d67780ed3939b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748010, "uuid": "2eb6be6b-8df1-400e-b9cf-021c37e6d17d", "value": "T1D6C53383F2D24161DCA423345CE927931B363D93DDB5B30B2B61A98E48E3A95347277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748010, "uuid": "6b4e9b99-cda3-4713-804d-ee5a1b90f318", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748010, "uuid": "c7f6644d-3510-4785-8b37-3aaa54b48fc8", "value": "49152:VkJD9VUS2v2/czNA6XgbuzDUyjYFb1nbuZvaMba5A7e0JSkJsGdLtFprqRbFFjfr:y9ESLEzNA6XAycRpuwiPBOGdZGxFFrJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748010, "uuid": "d9d7eeb5-11ae-48da-aa31-1975de18f250", "value": 2608128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748010, "uuid": "2a001d26-bb5b-4fb5-bf00-f6cb58730614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748010, "uuid": "fcd2ebea-4f92-4928-a4dc-333e97541fc4", "value": "f3b0179ba1f2f60ea88c4f14c4e7a829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a66b74c-a57b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703766078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766078, "uuid": "f3d72b23-4213-41c6-bf6a-b9f1763a6349", "comment": "Malware payload", "value": "ee785f4e2c09935ac201a2ea6f95613d", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766078, "uuid": "bdee40b5-1bcd-4e6f-961a-8896c138b3b0", "comment": "Malware payload", "value": "b581909a30755e941bf4469f6d7bc77e1e5bacaca77ad0d82e5bbe00a5ac3590", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766078, "uuid": "a1f90e91-85fc-4632-9bc2-6e92b35d5404", "comment": "Malware payload", "value": "93e8934e79ae7fabeda7687b739bbaf8cd6607cf", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766078, "uuid": "36c7b6c0-7d09-4c94-b025-c2449616c415", "comment": "Malware payload", "value": "e256b556d5c0eb678ef7ebed11414c0b07a46c8eab792884b64eebf7ec55f1211c1bcdabe88aa7e7de8fd373471c0fef", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766078, "uuid": "a9c71d9b-e4f9-4869-9bcc-f298c6fb20b8", "value": "T115A423CFD37D28F4CD4B512B5AD1897480CA69CD904F6378681383EC04E6BAA83ED7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766078, "uuid": "d735ab87-74eb-4195-af80-018ec40b7e15", "value": "12288:xpk/DzlerVpz8OYmgKQb4/KTalD8lS1eOfonlwmSkMCfxXvoKMoKy:xpkPlejQfmgKa4/s88lSUOwlwJ6pXAKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703766078, "uuid": "4cd36c0a-d241-4073-92f2-7ff9556f5f6a", "value": 470186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703766078, "uuid": "330f9a2a-1337-4c8b-b4fb-b92e63e2d2db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766078, "uuid": "83b5e502-7452-4ab7-9803-22cdbd11123a", "value": "com.AppInstalleriOS.TrollInstaller2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84860094-a5b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1703788805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788805, "uuid": "ccf6060c-3353-4521-976b-bf01c1954381", "comment": "Malware payload (AsyncRAT)", "value": "55eed83103f8ff8f57ee8515d3250478", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788805, "uuid": "9ff764f5-7b7b-4a25-90f6-ab25d0ca559f", "comment": "Malware payload (AsyncRAT)", "value": "b797f9e92621f88060708e2873182661412d297fd6c2e2abff887482e4393e8b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788805, "uuid": "cac1d315-f32b-4505-938b-42ebb02cfcbe", "comment": "Malware payload (AsyncRAT)", "value": "732d97e62b2be9dcf2e9d33c115fd383173fde5a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703788805, "uuid": "effe6c38-8a24-4b18-b685-dcbb71cdc854", "comment": "Malware payload (AsyncRAT)", "value": "d36302c4c4ac82e066a92dd1b77d4ac82ea9fe8c659b9766af6dbe6617561b29faffc329fd51cf2524f640f8942b1465", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788805, "uuid": "f82c3304-a0d0-4d4b-91bb-7b2545dc0fb4", "value": "T149431A003FE9D129F1BD9BB4ADF3658449B4E5676A02D54E1CD412CB0622BC69E03BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788805, "uuid": "7d1790f4-2b53-4a38-b917-4cef49a2bd88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788805, "uuid": "623d0a37-229d-4be3-b9ee-46daaf76fe8e", "value": "1536:hvKDtKNvPmE5O/7bMKbL1tOV7McXq7gx:hvK4NvOE5OXMKbLkMcXqEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703788805, "uuid": "08d3b99e-e9f7-4d7a-b11a-8d5783bb01d8", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703788805, "uuid": "9254bbac-230d-428a-8c0f-ad11a31426f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703788805, "uuid": "2f2c1a2d-5f47-48b9-ae3b-9a206b3fe602", "value": "55EED83103F8FF8F57EE8515D3250478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8ed49d-a58b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1703772903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772903, "uuid": "d7a34258-78e7-404a-9e61-81073f0c4838", "comment": "Malware payload (Formbook)", "value": "f2149396514cd512219a8ed2ea59033f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772903, "uuid": "07715fda-7b73-419f-954b-4a1e7fd1add3", "comment": "Malware payload (Formbook)", "value": "bb6889ea81e999b4c550c20244e68f42ea08525ac9cc30b9d6f6180fd571cce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772903, "uuid": "d7b6679b-2d7d-4449-a4b1-3981511fe3fd", "comment": "Malware payload (Formbook)", "value": "7fbfc4e0801b7887c9858be9576ba50c3235876a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703772903, "uuid": "cc685313-30d8-42d4-be4e-1bb2b8ca90e1", "comment": "Malware payload (Formbook)", "value": "0310483579f6e44220ee10df9bee650413d47a10fda4630de0da8bbdb4b9a175c19de6b4c31892e19dadaf0e1e46389a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772903, "uuid": "2b6f3ff1-80db-4921-b00d-da13d6b59b4b", "value": "T13F63D503B8BF85F6D2985A7AC573C109136CEB66E6D7C60A2CCAA3451023BE9DD11DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772903, "uuid": "3b9722f4-4bcf-4e85-8055-c3ef22ea5167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772903, "uuid": "f018882d-3287-472d-a0d5-be00243290a0", "value": "1536:5DgdZJknngjHE9qMzNZXcrejR19Du0cgcZOQS1lU:WZJkngjH4zErQXcgcZON1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703772903, "uuid": "7eec7ed0-83a8-4e44-81d7-bd1ba2a2a3e5", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703772903, "uuid": "89c6661a-d43a-4ffc-9be0-1f4903367891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703772903, "uuid": "9ba7adc1-4a71-4748-bc41-00cb960b61f4", "value": "SecuriteInfo.com.Win32.RansomX-gen.29384.16358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00bcc25-a591-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703775671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703775671, "uuid": "1d87527b-ba03-4916-a89c-08196ca8510b", "comment": "Malware payload", "value": "5c522aef4ff48ddc7820eff474cefe57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703775671, "uuid": "a25422ec-a102-4e8e-b860-5097f23284b8", "comment": "Malware payload", "value": "bc9c3137bc81329aca982fffb116159259dfe3c173ef707017cc968e45971bd3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703775671, "uuid": "3ea32e3c-fcaa-40fe-87ea-567992e0b83a", "comment": "Malware payload", "value": "ee6acbfae9ba9fe74ea6fa1e483f4aeb64d7dd36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703775671, "uuid": "81ab84bf-d4d0-4576-a7db-cf0ff896b45a", "comment": "Malware payload", "value": "c78a8fe5ca708d6650aba32616bcce4cfe161291918fadae0c65ab3b8a458e44cfebd6cbc6ba3d36fde76f6a21346dd3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703775671, "uuid": "d2335ff2-f8e6-47a1-b8c8-ecde0bdf9423", "value": "T1C911B72380003025CC652EAE4A155A1B090E9EB73F0B7CE876A28A393CEA610CD68D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703775671, "uuid": "2a0db4ea-725d-43c4-9868-5f1aa56b608e", "value": "24:cZpqNKknuLNswRqhxp88Z4ucHDuhlPkSMuPll/4VmGB/YVK:c2NNu6vHNquWuhlkuPH4YW/YVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703775671, "uuid": "06f2b2c3-fca8-428b-badb-45f9657a49f6", "value": 892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703775671, "uuid": "c0faf763-36bd-435e-bc2a-691cce319e5a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703775671, "uuid": "6aaaa3a1-3d57-422c-a6a8-40203c4481a4", "value": "popo.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cb0b5e-a583-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703769612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769612, "uuid": "b6de7fee-066c-4d98-8a12-a0e4bfb52ccc", "comment": "Malware payload (RiseProStealer)", "value": "ebeca8f1f9b546f1ad993fc44dbd2f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769612, "uuid": "dea183bc-2260-43f0-815a-b0cc6bb7b626", "comment": "Malware payload (RiseProStealer)", "value": "bd09222e00af329436f92ffddb3d0b35bc2ba06142c28731a7701b1f02d035ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769612, "uuid": "cc47da54-852a-47e0-b726-ed49a309b81a", "comment": "Malware payload (RiseProStealer)", "value": "cc81ced0e6f1fa731760a2e4a4d9a595775d6fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703769612, "uuid": "27970a73-3be0-4723-8704-f49802a49fb2", "comment": "Malware payload (RiseProStealer)", "value": "e7e1da60e1eebec35d8caf64737bcf034f0aef5d652aa8b0907f02b6c2c0319b33b057bb07cb5f5a9eb9d9eec066e3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769612, "uuid": "706e031d-4ba9-4ec1-95cd-fe6e693dce9d", "value": "T1DFC53383B3E60162DCA1233058F917D26B317C93CD75A30B7B6095DE19F3AA56532B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769612, "uuid": "c45c176e-3653-43c1-9743-5121b1fd856d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769612, "uuid": "ce7a7e97-47e4-46b4-b42d-5e3eccdc00b7", "value": "49152:P2/0Xf262LogWwJYgpW0VAyIYUA8nxuGYaxX2DdM200D3fimSLXzHqqq8XQ1uRik:Xf+cgWwJYLynZuud54yqmSLtX6uR2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703769612, "uuid": "7a8bbf12-54f4-463a-aba5-e6c6ba9d4c7a", "value": 2607616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703769612, "uuid": "f655df6c-7404-4d26-9c21-93be62ee9c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703769612, "uuid": "b38b71bb-4283-464b-9ddb-158635087eea", "value": "ebeca8f1f9b546f1ad993fc44dbd2f21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484136b2-a570-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1703761216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703761216, "uuid": "fb28fea2-2bf7-4d24-b9c5-1a11d9805b35", "comment": "Malware payload (RedLineStealer)", "value": "b9550f6b0984fa4a8cdcc2d299b3e1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703761216, "uuid": "16d6de44-a776-47b0-8fad-ef38b4f099aa", "comment": "Malware payload (RedLineStealer)", "value": "c054e399f622866883bb56ef3eee38e9d4d465c0d5163dff605f2ec2f0778dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703761216, "uuid": "144a54d1-b07d-40c3-a226-eac2dc71c0b9", "comment": "Malware payload (RedLineStealer)", "value": "1d140a020da094f448c0c3aacc7e0368c95689cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703761216, "uuid": "59db5a0e-d8f5-487b-a7b4-4876d1edf4b8", "comment": "Malware payload (RedLineStealer)", "value": "362648dc09cd6e78681accf6aecb394897733327c04ca997f806579ca508f4d259dbbd38a15942ee1cb30762824e0664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703761216, "uuid": "d0f0d517-c968-4ff2-8554-4cf048274772", "value": "T156B4CF5072D2D033DAE355748534C7B34A7B7C325529598FBAE46BAA7E313E0A321F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703761216, "uuid": "01cc8897-d1f9-4554-b15d-0c3189726472", "value": "a8fed6536d3881a9a4190496ecec9b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703761216, "uuid": "de0f16e4-3e2d-4f34-abd6-20779fd805b4", "value": "12288:lTEGZrnjTfrRlUVB63vcAAvP87zTUraj7I7Dov:lT5Z/RlUm3ETvkUraA7Dov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703761216, "uuid": "aaacb39e-9a70-4cfa-92d1-496e2f0a810e", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703761216, "uuid": "f061f55d-361b-43ca-ac2b-a772481bdce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703761216, "uuid": "3940707d-1596-4cc1-80cf-00c88915af78", "value": "b9550f6b0984fa4a8cdcc2d299b3e1da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26983c76-a5a8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1703785211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785211, "uuid": "c4083c25-626f-4428-a138-5b2c3e5ad19e", "comment": "Malware payload (Stealc)", "value": "4d32664a3aff7c0ab0ffb4adde75b99a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785211, "uuid": "c405d7e9-7619-4b99-b605-7b46b3179923", "comment": "Malware payload (Stealc)", "value": "c3b7fecabec97517f56a046dd5db5a4060471b5903d0fb9821705420c5d10707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785211, "uuid": "8b0cb3c1-d0ea-4f41-ab14-ac1afdf0d64c", "comment": "Malware payload (Stealc)", "value": "aa7e517c907b0d69905454b8deb10622519eac0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703785211, "uuid": "2cbc1eac-3baf-48a1-b8d3-72518c804474", "comment": "Malware payload (Stealc)", "value": "49daffee467f187f4fbc65471cbd453d6a651d5719e364aa3566c425734526bb87712629256b8df2b4b7fe58e465aa20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785211, "uuid": "7dd7baed-5e3f-49ca-a4c8-1d9353c561aa", "value": "T16B548C1132E8D432E2F319314638C7F54A7B78726825946FA7D42A795E64FE1EA30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785211, "uuid": "5e7f3350-3f0f-4d6e-90d5-59cd6000fb16", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785211, "uuid": "fb48c6f2-142f-4269-a7cd-ca43d1ebe24b", "value": "6144:/ecopGFVVQLpU7Zq7v2nEZ99xq2/6ikJKbRXMA:/+pGFfQlU7MDv6HKbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703785211, "uuid": "c1f150ed-7b79-4657-a07b-42bee4978eb8", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703785211, "uuid": "f5528092-beb0-4ca0-9f5c-771701be732a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703785211, "uuid": "a5ab077a-1b0e-4ff6-aa7b-28b617e4f107", "value": "4d32664a3aff7c0ab0ffb4adde75b99a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781777f0-a553-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703748841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748841, "uuid": "7282a3a8-3ecc-4e60-bb47-09af0c61a245", "comment": "Malware payload (Gafgyt)", "value": "af18188e2cfbbcda72896358b456c3c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748841, "uuid": "5395dd08-479b-4758-bd65-8c18627ad439", "comment": "Malware payload (Gafgyt)", "value": "c459eaef90ab6d471f85f67421609d393dd50c77b5385280b4e11c2ce8aabe08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748841, "uuid": "5e156786-7125-493d-bca0-bfb607c3332f", "comment": "Malware payload (Gafgyt)", "value": "a241bc98c210e57eef1eece940ff5825027f6704", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703748841, "uuid": "505ad13f-a94d-40bc-bf5b-e1d0c20c8fda", "comment": "Malware payload (Gafgyt)", "value": "5706511247764d6f2212ff674aac6247f9a4634745766704fe20ce62f32a84741e386c320d7477036e0eae6a40138b31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748841, "uuid": "e60940df-4762-4d60-99cb-1de7184d9c21", "value": "T1FD13F18DBC554F4ECFAF68784B2C13411A58AE814246CFCE5384ED90C73D64BB9D28AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748841, "uuid": "68b4dead-51f6-4f71-b1e1-3ad4ee8c89fe", "value": "768:f9MqD8E1M99aqhUalDr6QmMhfASwgeYcZE/I3WTUXa5TfWRLuzFllbwe/:FDhu8YUal6QnhfFjeYcZE/IG7RZRl5wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703748841, "uuid": "630a83ed-24c7-4fa2-ae31-d18585536647", "value": 43976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703748841, "uuid": "7386a14a-7861-4413-8661-71c7a1a824bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703748841, "uuid": "c08e7083-50d7-4b46-96ce-ac7afe160f1f", "value": "af18188e2cfbbcda72896358b456c3c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6e34e3-a59b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703779580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779580, "uuid": "33f54e25-ffff-470b-89a0-5b9813943352", "comment": "Malware payload", "value": "42f3a8eabdf588d5f671f9938fa2af0c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779580, "uuid": "997f99f0-a7e4-42fd-8f47-189411d7a0f9", "comment": "Malware payload", "value": "c4aa5b01a92843d942464181a625dfd84fffde97dd6d15e0c6110034afd4a060", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779580, "uuid": "2f4b12a7-4492-4357-9bb8-5003f095a3ec", "comment": "Malware payload", "value": "dc13c26f28d02b8051e56f7000b6a2f3710adc2c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703779580, "uuid": "0394e8d7-7f7d-4eea-965f-00acaf54183f", "comment": "Malware payload", "value": "54a251cf7e6a7a9efdebcc949671bcc48271c9d93e367dc419d65be94933f88aecdc43a4cbb2a8573a43290ca5da739d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703779580, "uuid": "d11f64f0-7eb3-4e47-8594-3c0b707a37e6", "value": "T1F90702177686917FD09B0936562BEBE5563B7BB11B118CA72BD01C8C8E32AC1713FA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703779580, "uuid": "ec824f01-8af6-432a-82f5-cbe36c3603dd", "value": "196608:BYxfTCpSRDxrXF7ARwM3O3gJIT2Eip8E66bbyCfTUzGIZcP3AMFmiT9bSeQ:BYMpSDD9xM+318SE2bS/36K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703779580, "uuid": "bd97849b-fe43-4dce-a34d-41360a8b92a1", "value": 17818112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703779580, "uuid": "a5fcf34b-fb4d-4b4d-8058-ed0c4b155dbd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703779580, "uuid": "cc99c5ea-2292-4b75-9aab-1fb51d3446d3", "value": "Documento-0102391i73-24.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a67a79-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805505, "uuid": "0a2f79a2-981d-407a-a2a9-04fcfe77e48f", "comment": "Malware payload", "value": "84a76c0733503a1d30e52415061f3fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805505, "uuid": "526b2062-3dac-4c85-bdac-c5952029b7d9", "comment": "Malware payload", "value": "cb9fc4d02f25afa003a47c3e96ae110945a2d293ceb9e1f7cd54f3dd0045ff59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805505, "uuid": "1d6130cb-0fab-4ab1-9787-5ce4dc9c8d6a", "comment": "Malware payload", "value": "9e81ab883463bc08781ab55055fad0abd4ac2735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805505, "uuid": "c3fd448a-68fa-48e4-ab24-6eae1d116cb3", "comment": "Malware payload", "value": "a0a60efa8c490786f5ee67c35f6da42fd9ea7d3e8af30930bc28944b3314ba3a3416dd2e9c2e114e472444573f455927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805505, "uuid": "12ffa4d0-24c0-43b9-9bd8-88e7d4e546bd", "value": "T18A469D379E1D5CC9E90134719C568FCA2954AC21B5086B9B76C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805505, "uuid": "925b7549-a421-40f9-bf6a-dfa5b408b757", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805505, "uuid": "08faeb23-9bdc-4bba-ac04-82f5f1a58e99", "value": "98304:W6Da0Y3zM4+0QX8JGEg88vhUqTFyOl6SptmgUl/a7FMIXf7r1Iy:Wh0YDX+x0Gl88ZUUH6SptmgUl/a7FMIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805505, "uuid": "29f9ad8b-85ae-49e4-bfe0-edf0e25206ac", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805505, "uuid": "bd25eda1-3a3c-466e-b6c5-ec535ee95d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805505, "uuid": "7bad5669-b72f-4bad-b639-14b4f76faf42", "value": "SecuriteInfo.com.Trojan.Crypt.19349.4142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4cb2f1-a59e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703781011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "d33d9450-aabf-44af-a6ad-15152d42129a", "comment": "Malware payload (LummaStealer)", "value": "02f1d0ec4fe7ff37798172887f0be054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "66a18936-b182-482c-92dc-4ca91820bdd9", "comment": "Malware payload (LummaStealer)", "value": "cf8fc15de0b79ca65fcf8682ed6d088ee5b8b994ed71454f84fabade050d2b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "bc3963fc-4e06-439d-878c-422e9e86c809", "comment": "Malware payload (LummaStealer)", "value": "919d6ae5c9badb9b4cd5e86517165fa567bad277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781011, "uuid": "605ca85e-2669-4f0b-a7b7-8cad831ec245", "comment": "Malware payload (LummaStealer)", "value": "f28489414ee1b5d098cf83c851cf738d0a427ec9e432a47ae9e509327c4e4b7fb286d2153056c6e9ade6054e4f9250f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "0c844f66-6324-490e-a343-c12777141b5a", "value": "T121C53393E7E501B2D8A613305CE917832B717CA2CEB4736B2B2165CE4DB2991357273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "df1a79db-362f-4e44-b434-2db9817f752b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "20cc0620-0423-49c8-b24e-e5698cb0ccb8", "value": "49152:79kwSddA2b249acwsdgtLY91yMY2Z8n5udqaImtRQMG099ElJlULCPZjqCKMtdF9:2wsAp2acwsdByzWGutWYUflU+0kpOyPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781011, "uuid": "45c98b84-e9a5-4912-9af0-f8be759ded82", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781011, "uuid": "1e1bc6f8-c45f-4009-8352-fa5ca08ac9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781011, "uuid": "99ab5ae4-5122-4e68-9ac4-a28d413c4085", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a164effa-a57b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703766090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766090, "uuid": "67bf66cf-6422-4d69-94f5-a939a5daf407", "comment": "Malware payload", "value": "dd0b6afd870effd1939ca3a483951848", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766090, "uuid": "4ed3ecb2-23a6-4639-baab-60494b2524d2", "comment": "Malware payload", "value": "cfe33cfd47b5fcad236b7bf86c20abfc87372e334bc87214d2825271dcb3dc8e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766090, "uuid": "c034b178-01ae-41ad-b958-092fa7bc59c6", "comment": "Malware payload", "value": "3192e1a973674903daaf56bdd5d70d0234f098a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703766090, "uuid": "34d53b75-860f-43f3-9928-9a196351286b", "comment": "Malware payload", "value": "32d2f032dae57a416262673d86f855968a50242a824c733411166da7e012230a1884972e29745f67279de659bedef58a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766090, "uuid": "b8a98ff9-7b44-4a7e-aa55-fe9a16a85a92", "value": "T195B4E743A19C4EF8E47C137C89DB0235B736FB1A93A282765B1283165B933EA523DDD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766090, "uuid": "47d7f772-fe49-415b-8286-e466437df2f6", "value": "6144:GWy8bB9G13OzLQX9m9HtzKqKCK+KbaZgresBg:GcB9GRWQXyBKqKCK+KGeKsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703766090, "uuid": "5be9dfed-9a7c-452d-995d-15ebf83cb3f1", "value": 512976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703766090, "uuid": "b17a0aa6-c45c-4b5d-bdf5-bd0d5a304e64", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703766090, "uuid": "606f94f7-620c-429f-8cba-046513a32271", "value": "dd0b6afd870effd1939ca3a483951848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b4470e-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805498, "uuid": "012b7028-3b9c-4c04-a375-e2ceb6b2e3fa", "comment": "Malware payload", "value": "0763e994581b98af5189561df21399df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805498, "uuid": "b65b8848-88ff-4760-be7d-390c7805db9c", "comment": "Malware payload", "value": "d0ea9691ad5ee78b49662ba26aede080cd2bc5fd30b26e5d7340b075824601c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805498, "uuid": "d4709f93-ce88-4c5b-bcc6-5ecbdadf933c", "comment": "Malware payload", "value": "f2e7675a2d322eaac53bc8829d40c9cd2c7f9286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805498, "uuid": "3c68be0f-0726-4f79-9185-96b09cd6f18f", "comment": "Malware payload", "value": "2c943be682a2dcc20193b18f5ee4583b566339804d46be06022768ea59079e699cafb7f84b9e3b1f6618e6c15879fec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805498, "uuid": "925fa179-2691-40ee-8e0a-6638ad037a4f", "value": "T165469D379E1D5CCDE90124719C5A8FDA29649C20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805498, "uuid": "89b98167-9283-4d21-9d6d-6b275975e04c", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805498, "uuid": "c2344474-349e-4eee-9589-76a98b33c00c", "value": "98304:VyMDAniZYujabS67U0gCOGhaqT5vOfxdp+mgulfa2FMIRavY9J+:V5AnYljoHU1CO8aICxdp+mgulfa2FMIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805498, "uuid": "8295dc2c-ed04-4b6b-9ab4-8db13393f484", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805498, "uuid": "c183dfb0-0396-49f9-a19a-de7a9a3fd8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805498, "uuid": "af578167-2a13-4195-bdc2-c46fe81ffd8d", "value": "SecuriteInfo.com.Trojan.Crypt.26208.27441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38f33b2-a579-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703765342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765342, "uuid": "6d6fe63b-5f62-42a4-a1d8-3821659dc0b4", "comment": "Malware payload", "value": "7548382b1e1047220cdb6d14f5344827", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765342, "uuid": "01cdaf8f-3de9-4c59-a8ff-a5d84876a2de", "comment": "Malware payload", "value": "d212722f9b0fe104fb0807994c18d61dcb80e3bb592b1090b169932b9a21e206", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765342, "uuid": "609614b0-954c-418e-b219-093af685248b", "comment": "Malware payload", "value": "f0318c445d293723c6d26cf68df68bbe63123692", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703765342, "uuid": "f4c176aa-659b-47bf-adc6-d13529796f16", "comment": "Malware payload", "value": "29f7f7b3b3cd979cdef8001d4f88f264291ade17642a41bc10f40f976ef6e9aaac6d2563682951468be0ea04b1ccf19d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-32434", "colour": "#24E3C2", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765342, "uuid": "4bc88909-3246-4452-8e28-799954d9d03d", "value": "T1CE647D22A69C2C31C026B1BD1D510A60F837FE2643F543F8BF6A915DCF9EF5604369A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765342, "uuid": "b6be336e-3893-41c2-89e6-ca4f4d71e3fe", "value": "3072:H0OfgCKUv7ME5KgNW5EiIeQY2Lcd2+bLq/hw0Fv1Co4/4JN1rsB4:H4CJ0EUW8SZ6o4QlsB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703765342, "uuid": "70806a8a-21a5-49c4-85ed-3432c5147ebe", "value": 321744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703765342, "uuid": "3b7eac96-4354-46c1-a625-797177ad0d6e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703765342, "uuid": "92c63b04-7e1c-4410-9586-3c4bbca52f88", "value": "7548382b1e1047220cdb6d14f5344827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bdb525-a58c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703773325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703773325, "uuid": "087b4f67-9069-4767-8bbe-f4ad446aa7c9", "comment": "Malware payload", "value": "7c703d9cb213ba2b68c0fc4ccde65ac3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703773325, "uuid": "86e0330b-e508-42bc-b013-ce287c266cd9", "comment": "Malware payload", "value": "d34622df68cd68606d50511318d0667047124a9dab98115436f567ae0a4d63f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703773325, "uuid": "c64bf760-79ca-416a-b324-33836676905a", "comment": "Malware payload", "value": "2877b18cb47848666d363ceb76375ec9fa587788", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703773325, "uuid": "55530412-fd71-4e5a-8e72-e50ad4028c11", "comment": "Malware payload", "value": "18c65b291b7548360cc7deb64e06c635b281ae57857ad9e8cfd83956c40d85537ec2447416880bd01de67270256180c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703773325, "uuid": "2f834684-a6f5-484f-9833-621237de0669", "value": "T17C534B23F6C585A1F6EED737289A9BD0B732F2E046B38757060054F4EFC1BD68A45A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703773325, "uuid": "ce2b75dd-8501-4604-987e-e37a07395dea", "value": "1536:DummSV75mgwvw4+s1/m9Vzi2345bnzXqzgBYEtHKtxhWKMIK9BS:DumLnNwvw4+s1m91i234dzXqzgBYEtHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703773325, "uuid": "8205ee7f-82c9-4927-8be0-f92b23a39b31", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703773325, "uuid": "bc0b4de1-547f-43b8-a2be-de5926b158c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703773325, "uuid": "28239caf-6bd8-41aa-8d39-b74b5289fa97", "value": "classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad33b88-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736443, "uuid": "08ca5ce4-7708-4e1d-b5d3-bb48569ee9c5", "comment": "Malware payload (Gafgyt)", "value": "802605cd2a529cb4cd7fb9a6d09b6bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736443, "uuid": "5e9451c2-c33c-44fc-83db-8b6cb9d31d66", "comment": "Malware payload (Gafgyt)", "value": "d3eef26949af5e080f82a15de5b51c38ae4fabc2944c04a26b603d7b7e581b4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736443, "uuid": "1acd1705-da6a-4d0f-984a-308ecd279364", "comment": "Malware payload (Gafgyt)", "value": "1d09b45861dde51c0024efbe780c16d132ad0927", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736443, "uuid": "065b5261-2bb4-4894-8fd6-e3742031111a", "comment": "Malware payload (Gafgyt)", "value": "6239908301d583dabc8be3a4c26ec62fcc09d1af41b73bae78ec878d954e04511e738aba8f5e39e5f32f6cc2bf031dff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736443, "uuid": "e4ebe225-6cfc-4166-9d98-bd5c8d38a342", "value": "T1ABB32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736443, "uuid": "9a7aa7d8-d6e3-4c7d-b465-4493d9b4a773", "value": "3072:pC/4rdZHsXsZwwR9FNk5mm/QcuLmHniPNb:pCwrvHwsZwY9FOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736443, "uuid": "53437ad7-3388-4962-b4af-55d0514c6477", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736443, "uuid": "15d5ac1e-003e-4715-8953-69ed87f230d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736443, "uuid": "d81ace8f-a65f-4cb1-8a64-4af353d01783", "value": "802605cd2a529cb4cd7fb9a6d09b6bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dba5333-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805517, "uuid": "cf70b4aa-16f2-4542-8fd4-bc4c0bbccd92", "comment": "Malware payload", "value": "be55a6ab97fde3c0e88a4440277fe324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805517, "uuid": "1f3b4998-0f01-414c-bbb4-f97a6aeb5363", "comment": "Malware payload", "value": "d6800992ed7256abe316f57a65a01aa61628467d515bed8384693a84eec20cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805517, "uuid": "5ae7cf4d-82f7-4730-b28a-bcb13809fe87", "comment": "Malware payload", "value": "43bb57e9576bfbb8caaadb4307fdda54855136cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805517, "uuid": "531df65b-e545-4ef9-8de2-fc1f3d984f85", "comment": "Malware payload", "value": "c79611a344b7efd7b888c620b280d666cacd1c1df2bc15dd47203789b9310d80272b5d865556e054f195c86fb37f3fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805517, "uuid": "949b61f6-ef44-496c-ba3e-487ad4c09115", "value": "T179469D379E1D5CCDE90124719C5A8FDA2964AC20B5085B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805517, "uuid": "a398d916-a80f-42c7-99a5-17d9b4a2f6f2", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805517, "uuid": "6df8fb4f-4585-4302-bcdc-e990dc553a4f", "value": "98304:swxaAW23eOQ0/kxQ8kagFI1h1qTlzOwxdp+mgulfa2FMIRavYBJS:s9AWCbQZrkDFI314Jxdp+mgulfa2FMIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805517, "uuid": "9417a9ef-d69e-4949-88eb-7ec4b49d0f8c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805517, "uuid": "3a616bc9-cebd-488f-98e8-322208cc9318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805517, "uuid": "d5809acb-7a2e-4ce4-a321-a2bf217421b8", "value": "SecuriteInfo.com.Trojan.Crypt.24707.7621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5b2628-a562-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1703755510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703755510, "uuid": "9d820c8f-9c0e-4f7a-b0f7-52f330e6fd8d", "comment": "Malware payload (LummaStealer)", "value": "2230a8d4d8af7d9163b9c7129c189f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703755510, "uuid": "711ec992-ed05-4dc1-a5a5-3d138a5d86b7", "comment": "Malware payload (LummaStealer)", "value": "d727b6a26f73dadebca9b92f00be6dbb2958a56539c8d173a106ea18e33976fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703755510, "uuid": "8120d094-24d6-4195-aa61-f06866dbb292", "comment": "Malware payload (LummaStealer)", "value": "418716ceda9ad44eba3ab74c4b124b29224ae521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703755510, "uuid": "a5d3c25a-4558-4fc8-a529-69016fb82c3d", "comment": "Malware payload (LummaStealer)", "value": "b64715d07c0399ff0e1f102d364aa1fa5951a6bcbfee9b1f00d26cac4ebefaf77d9dd925535defdae485e713315885ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703755510, "uuid": "4b86f263-d896-4222-8884-2ee12bd271b0", "value": "T17EC53383B7D540B1D8B523306CE91AD26B397D82CE75931B7B10A1DE0DF29A06971B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703755510, "uuid": "f4bdcecd-770d-46e2-acee-2e40450075d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703755510, "uuid": "296ec838-4272-464a-aaba-59890bf21cd0", "value": "49152:q6SlcqumXg5luVh2m2MXRx5QygvxZayykY+EjnxuLFa2FzgL/G093AWl4OLHtj+O:fSlctkg5EhaKRx5QyUyLnVuZojqK4OLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703755510, "uuid": "0fc3e713-0812-47f8-ab21-3e4e25f386f6", "value": 2607616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703755510, "uuid": "091c9d70-b85c-4c50-bd5d-1fa413bcda5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703755510, "uuid": "fee2a9e7-ed07-4789-ad7e-8d10b8c9ad0a", "value": "2230a8d4d8af7d9163b9c7129c189f91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cc763e-a5be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1703794731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703794731, "uuid": "e1602d8f-a95a-4664-ae31-481e7b163c99", "comment": "Malware payload (SnakeKeylogger)", "value": "cc491e806d2908ac5c65d7ac5fdf1afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703794731, "uuid": "96e39b92-1c0e-47d0-a405-7f277a993d2b", "comment": "Malware payload (SnakeKeylogger)", "value": "d805b874ab77c6272e89f57f5b6f080b039f42064a85778a7ff4bf436575cf68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703794731, "uuid": "cf727e4b-8c4b-4989-a17e-5d0b39cba5a7", "comment": "Malware payload (SnakeKeylogger)", "value": "aeed3236e3d7618202f1f0bb44bd6a29ed314b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703794731, "uuid": "cdd2a59b-7841-48d5-971a-a4c7733ef178", "comment": "Malware payload (SnakeKeylogger)", "value": "c3cc83c7445eacb89287de787065d30190bb827a1b499d3987ab92fa83cdaf43c9d09815c70feabc0d72db8c2b1f004b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703794731, "uuid": "14d6e0ba-38a1-48f9-b3ef-37018b2f937c", "value": "T181B4D015ABF8437EE8F34B75FDF244676A31F94A3503DB4E2009672E0893B085A9276D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703794731, "uuid": "4d3a3aab-5df1-4ca6-9748-9b1f89d546fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703794731, "uuid": "768433ee-a84d-43e4-8798-30f61e3bc5a2", "value": "12288:jJMRs+BI3OGJDDbrpsL3qxa7syrEwlxCHV:j2R83YC+BZlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703794731, "uuid": "0426225d-c056-4110-8143-2ee9738f38fc", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703794731, "uuid": "0f99454b-1eb2-431e-be3d-52853420dd1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703794731, "uuid": "aa1d3488-39d8-437f-a3c1-e6cf8229ea22", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1433.11871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3688b7-a5a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703781895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781895, "uuid": "fcc1bbce-ce3d-4e7e-aeb5-5fe1cf6c7c80", "comment": "Malware payload (Mirai)", "value": "b879358660a1294ba90a3b413d99df66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781895, "uuid": "4bfddf00-a1ca-4123-b4a0-e1485d981a88", "comment": "Malware payload (Mirai)", "value": "d8813eac6e4b6d9a8ae43c2a45801d0ea4ca847575e6da96e97dd1eb7754ff6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781895, "uuid": "b2a5e268-49f1-4407-9577-85f760c17681", "comment": "Malware payload (Mirai)", "value": "e36fc20bf9181b3c233ec5cebe407c6026f07220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703781895, "uuid": "214802e7-b486-4c54-baf9-9964f1a19001", "comment": "Malware payload (Mirai)", "value": "1d6878f8c9302e98f351ac2ac0d02261beb4cfd560850101310154afd8ea321a9f0c2e73eec57d116dc4cda66748e9a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781895, "uuid": "b9825366-9f83-42dc-aef6-81eaebc3af6c", "value": "T172A2C1203B413A6195B40774FDB8924766EF4FBCD5DF7764881096F8BAC5C0A13BB611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781895, "uuid": "d8f05a08-1a80-43b4-92ed-f5b1b6f094d0", "value": "384:LJ04vXozIf33wgcHsjs7nxINNpyJtNStnNxXDzq1J/gQhymdGUop5h5:V04vpf3g0Q7xydBNx2Phs3Uozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703781895, "uuid": "7d88874f-269b-4856-9d32-9940867acb9d", "value": 22452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703781895, "uuid": "a7c3600a-26c5-4e36-8810-cdc8b2f045da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703781895, "uuid": "b7374b15-7c31-4aa2-933d-34e3bbf7c1b2", "value": "b879358660a1294ba90a3b413d99df66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870fed19-a5b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703791815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791815, "uuid": "b656002e-0d14-4cc7-afce-695bf9ed4c8a", "comment": "Malware payload (Socks5Systemz)", "value": "3d178664bc15e781e35d12108a2c5ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791815, "uuid": "6f722153-4b52-4024-b72c-44a161094864", "comment": "Malware payload (Socks5Systemz)", "value": "daa567d513d049f218c6a71a786c44119f9acb0ea480f424468a8a09e9c75dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791815, "uuid": "af6ed1f7-3e31-4c04-bc91-00da4bdf46de", "comment": "Malware payload (Socks5Systemz)", "value": "e4169852794fcf6d9f7edd359bbec16f406bcca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703791815, "uuid": "bbde8642-99b3-4331-9c0b-97cc01fc1f2c", "comment": "Malware payload (Socks5Systemz)", "value": "81236d5e2e5f6014093b4d0be70303d5681cc407d8e90d27e935c13ab0882718b25cbeab93f559248d24ffa104ad62ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791815, "uuid": "7fd5792b-1ee8-4c82-b920-6237ef2c15ba", "value": "T186C53383E3D60172D871233418EA02936E35BD97DE78A35B7BA065DE4CF39952872336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791815, "uuid": "a361626f-37c2-49fe-950d-60bd3518a4fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791815, "uuid": "61b4e274-fc0b-46fc-ab83-14b8ee031cd8", "value": "49152:fqylkVQqIh2X2aCYKsfjgSlopRy9YH5+n5uMTsITqnu0I0UCa5cL7LnmZLqJenjo:CV+h3rYKsfjmyiZcu5uy0WL7jVejTSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703791815, "uuid": "450fc0f7-caa5-467c-bf2c-002c75c19652", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703791815, "uuid": "eaec5b05-b1ac-40df-86fa-5c67be30f9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703791815, "uuid": "753975fd-6bef-4341-b236-7d63bfe91149", "value": "3d178664bc15e781e35d12108a2c5ab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36fff9f-a543-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703742095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742095, "uuid": "9d863fcd-07bd-4eba-845b-0554ee4d16a6", "comment": "Malware payload (Mirai)", "value": "bfa1a116f39412f5d42c956e81bcae0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742095, "uuid": "e66113b1-1807-4521-bb82-643800c2523f", "comment": "Malware payload (Mirai)", "value": "dd1a1b3434518628ad16841df928e13676f81a77481824dfc2c9ea232016ac30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742095, "uuid": "10341759-7314-44e1-b038-0938c971d34d", "comment": "Malware payload (Mirai)", "value": "73ae8ed7a1335cb4c51eb549c280706a0d7feb6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703742095, "uuid": "fb35cc4e-929f-4da5-9068-ecf80a4f1c84", "comment": "Malware payload (Mirai)", "value": "552245157da4bf6925449daeb741aadd826f843cfe660f42a0c2fb118e726d65a9f7be9cc66ad3a7ea58d1cbda3ca3fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742095, "uuid": "7721a8fd-09df-43e6-9f85-810babdb33a6", "value": "T1F073C80E6E718FEDF26C833047B74E31A75963D623E09685E29CD6141F7024E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742095, "uuid": "42ccbfc2-5d49-497f-bed9-76d5a8f6c8bb", "value": "1536:ghjZLA0WVNCLh6Uiw7FFVbKVF8KVprTB+bzAndpL8e8hAZnjkt:gDLKCSw7yB+P+L3not", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703742095, "uuid": "eec407ef-8d1c-4dd3-8998-6cbd14850eb5", "value": 77488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703742095, "uuid": "9b551c73-53cd-4d0d-92e1-2f1a4d38a3d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703742095, "uuid": "ec7722c9-7f37-4c3b-bf72-a16422eec135", "value": "bfa1a116f39412f5d42c956e81bcae0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f77da83-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805520, "uuid": "e9cc90c1-b934-4c48-8330-d42989eef1f3", "comment": "Malware payload", "value": "304cf1c352e6dcd8c42769c9a3bbe368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805520, "uuid": "117c1ee1-f072-4c2c-8f50-9f96eb3665f9", "comment": "Malware payload", "value": "dee75f1776dc3e889fae9a36b28c025742c19d0aae9ec2f616797dcc6678f3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805520, "uuid": "2d3b4f27-5315-416d-8d46-67d48248dd4a", "comment": "Malware payload", "value": "33a608320bda66810924f194524c1c0a1b1c4c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805520, "uuid": "4a53be1a-0796-4819-9602-95498b201723", "comment": "Malware payload", "value": "dda76954bfd510de8ecce5545a2c0bb91180ca5d1ca38d22cbad51acafabbf95fe1c72a42eb704e398fdb4c7d36522db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805520, "uuid": "24ad73f8-0b25-4e5c-8ba8-2c68e43f8717", "value": "T111468D379E1D5CC9E80124719C5A8FDA2954EC21B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805520, "uuid": "93e21c5e-64b1-47da-928a-7446f9917a8d", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805520, "uuid": "d049ed35-8ae1-4e50-89da-68f4b46a56ff", "value": "98304:JChZKU232uib/+Ecu7jgLyHhTqTQnOWipOVGwB1nKXtbbPxzrpoe:JCaU2mjbGi7kLyBTRbipOVGwB1nKXtbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805520, "uuid": "12d664e3-1981-4343-943c-c72a6963cc68", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805520, "uuid": "85ab2bb7-f915-4327-bdcf-9cb6affed999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805520, "uuid": "b17dc2d2-7bca-43f1-acab-cee12e133708", "value": "SecuriteInfo.com.Trojan.Crypt.16475.28661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc0d44e-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805490, "uuid": "d2af3769-438a-41f1-9959-e6e676d96aa7", "comment": "Malware payload", "value": "b9784c8cf0128acb9fcccafe52a27ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805490, "uuid": "e53c8470-ad9c-4be7-9b26-29e349344bea", "comment": "Malware payload", "value": "df7414c1763000edbfa188e2710181eff9da94398edc8ba7e70f34e043106197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805490, "uuid": "b2373225-7668-41bc-a751-7407da3da2c6", "comment": "Malware payload", "value": "fe7c345b78e00b39a75b0bc913d7fdc49bc37a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805490, "uuid": "9a558d0a-56cc-4bad-a7c1-fe0ab4c1593f", "comment": "Malware payload", "value": "76b9974be90edd0d09ec830a77d5c32c2ad2c4612774cb000d97b772c6ccb4f75a20a91d41a2f216d8f792bfd9bc827d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805490, "uuid": "4be4626a-df9b-45ba-9b43-5bb7c38e2048", "value": "T1F9469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805490, "uuid": "5ff79b25-fe2b-4395-9ef6-415b4760e0b6", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805490, "uuid": "12030647-3f05-4138-9214-bf4821c99346", "value": "98304:lcBL7Yj37nRSxzYZ8ygb8mh0qTdrOixdp+mgulfa2FMIRavY9J+:lo7YjzRic8Lb8c0oTxdp+mgulfa2FMIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805490, "uuid": "e8427fc4-87ab-40f9-9f4d-49e267287f0c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805490, "uuid": "3d6020c8-c05f-4090-9dfb-81c584ca69f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805490, "uuid": "4e5e649c-d656-438c-983c-e75723803951", "value": "SecuriteInfo.com.Trojan.Crypt.12559.5133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685503bf-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1703750103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750103, "uuid": "993a77fe-d4a2-4e04-ae5a-adc1e7e05666", "comment": "Malware payload (DBatLoader)", "value": "92947d7a1abfa8702bca9f435b9f0889", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750103, "uuid": "99a52a4a-2ead-4aa5-a538-c705721fc95b", "comment": "Malware payload (DBatLoader)", "value": "e14cbebf916fa0be576202a8c7b931a485fb0dafec28402292af1de5991a130b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750103, "uuid": "185d33dc-34a6-4a09-8592-115a52a2fb88", "comment": "Malware payload (DBatLoader)", "value": "61339f9e26d01713c9c7a06f008a584e17fcd8ec", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750103, "uuid": "3c70fed9-0207-42cc-b36b-a932be3dbc22", "comment": "Malware payload (DBatLoader)", "value": "8a5b565f52c92060e03d9c5205f90f99da8c23d23d6f8941167245ca3197ed29b7794a3f430bc59fa7b43f0b7c599a00", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750103, "uuid": "08dc3b7b-e737-43e3-a41c-f1e388ad4976", "value": "T160A5F1B5A6532531CC329339EF6652E6FC2E7F322C5C38062ED03894DA351D36DA91A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750103, "uuid": "5d264a21-d1e5-469e-83be-7d8388bb3686", "value": "69b487696e297631768bb0af7c3f52b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750103, "uuid": "5405ce61-06c1-4af9-9d20-6c12e33cbc1a", "value": "49152:GFhCdKfnsqsHnt7VWuMjUb7dVZAOy+GyZ0NUgYaIbEiDsFa5t:GTZvsuKfH2yZ0Cg6EiFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750103, "uuid": "41ac4dc8-0b51-4df8-8834-cedf1210279a", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750103, "uuid": "c3737dbe-c0d4-4b17-932a-43a5b7518e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750103, "uuid": "7e2dfe2b-8187-4ca0-a604-7749fc6a144a", "value": "Haziran-Aral\u0131k Eksik Evrak Raporu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a890d57b-a597-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BadBazaar)", "timestamp": 1703778128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778128, "uuid": "a0688935-cf4d-44c8-8e9e-5c168792cf75", "comment": "Malware payload (BadBazaar)", "value": "d3d61042a2aae6ce7a8583a472a8ccb7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778128, "uuid": "96c75c39-a55b-4fc6-a0d1-5cc0d9a049db", "comment": "Malware payload (BadBazaar)", "value": "e157032f657504457d0a81314d69b7781cfb26515662c348999a2a72e51b2a98", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778128, "uuid": "d517b2bd-93aa-4ee3-bd6d-92bb7f9d4c52", "comment": "Malware payload (BadBazaar)", "value": "bff7aa6b3cda51fea1696b7ec08595eff4c715e4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703778128, "uuid": "fd4c0e44-cd4e-4cf7-b872-af4cd2a9fc58", "comment": "Malware payload (BadBazaar)", "value": "27cc182b392ded88a2f0d86403e49212a9500f5ba17fcff53c38b9e9349314ce34c543d6d05aa57b937e5cbfaf52f577", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BadBazaar", "colour": "#DE20FE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778128, "uuid": "a253c50e-b3de-43df-8650-a0371b47b1b6", "value": "T160E723E7F3749D3DC9720A72815A6172E9298F209713F62E640CBB397A732E246457F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778128, "uuid": "dec86443-1127-415e-bb5c-a427a431c85a", "value": "786432:VHIqrGi+rBdaKDDJmkavG4/tWKejCbSGCXKr83eJ7pTnIwya/+j+uigSiMQLhVWd:ZaiABdF4UKWIguJNMlZj+XijWJ4LBZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703778128, "uuid": "502e0444-b945-404d-874a-a14fea881499", "value": 68633238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703778128, "uuid": "7ffff990-e8c0-4ed5-8b77-6c3879db1bd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703778128, "uuid": "bd23b243-100b-4d7a-893c-2e26990ec75b", "value": "Telegram_CN_VIP.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598c64d6-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805483, "uuid": "d1bc28dc-4c2e-4d21-b041-87ba07f2def4", "comment": "Malware payload", "value": "c8463fc24fd4d7251d5ed3471c5c6c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805483, "uuid": "a68edfe9-d1cf-4e9a-b155-2dd40967bc95", "comment": "Malware payload", "value": "e1bcae27d13331d80b06ed41c0711abecbf300b6b58f8838ea773215e6f4521b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805483, "uuid": "b2396751-9263-4407-b654-aa936c4add1d", "comment": "Malware payload", "value": "13802a7d5c59f3a2a7e28d479c1842b7c96c70a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805483, "uuid": "04d17c77-b07a-4354-a0dd-2807dbee2ab1", "comment": "Malware payload", "value": "fb333ea7c8002b752ccf228b3aaaaa692f616de0d45256486cd2587f0820fe3cfe008fdf3ff44cb874b6250e8976a45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805483, "uuid": "355ecea9-164a-4e55-be8f-f3bbb54a08a5", "value": "T14705AE23B6D280F2C711293109BAA736D975E65A0E25CFCF5395DE2C1E361B19C3723A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805483, "uuid": "5e212479-9f4c-4553-bfcb-834e4aa348be", "value": "12288:ceErS2vCvQLI43sJaVQ4/zIw4ZOKw9D4W8Ls:cA8CoLIsNzD4QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805483, "uuid": "a79e0b88-1950-4f59-806e-0e7f2b8eaa88", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805483, "uuid": "7daa39cc-c048-4ca3-9541-9272a1b468de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805483, "uuid": "4ee49afd-d96c-47c3-9c2d-f6a432fec9db", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.2736.11973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e45e49-a536-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703736412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736412, "uuid": "be68146e-7fa4-44f3-b6e4-92493afd98c7", "comment": "Malware payload (Gafgyt)", "value": "18eead3047f42f82e9ac25d368432316", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736412, "uuid": "16743dce-f0a4-4e94-9456-6e95b516fc79", "comment": "Malware payload (Gafgyt)", "value": "e1fda1e3b6c988ad970fa2a2f7766dc95a3b3a3535683176395c71be061e6946", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736412, "uuid": "47fc3e09-0d30-4278-8e00-52c476fae28b", "comment": "Malware payload (Gafgyt)", "value": "c268ad9d99b68a7225fcc1fc0f4dbbd6f77e5d37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703736412, "uuid": "259dd4e5-fa2a-493f-88dd-f4c4c20bd32f", "comment": "Malware payload (Gafgyt)", "value": "675858d15cf408d0ce2cad879caf979d6fbc2098c1ffcbdc0d6caf23ab58da72ba1e605656f4673a35bc94b7f0e06a79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736412, "uuid": "df642e7b-6454-4385-9226-bc9c365ab853", "value": "T1E2A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736412, "uuid": "8089f0c0-c66b-4684-b91b-38830abb6a54", "value": "3072:VK1z13U6HzHoXRtmTUhQogNEmmFVcqq0GnDZT:VK7DDeKlogNEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703736412, "uuid": "0c4ac4fa-da57-45c5-80a1-ef381d9eb7ca", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703736412, "uuid": "2be6da7c-9ebb-47a8-85f0-c5838fa9d3f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703736412, "uuid": "078b49a0-4503-4783-99dc-b4990324baf0", "value": "18eead3047f42f82e9ac25d368432316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7453225-a51b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703724975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724975, "uuid": "4f5738a6-8325-4793-860d-a31f40c46f46", "comment": "Malware payload (Mirai)", "value": "ff368ba687a238e2b00b1ad5e5d14207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724975, "uuid": "301909d3-59b9-46d1-a3df-b341b8bed6f6", "comment": "Malware payload (Mirai)", "value": "e4b7a32a801df68fc9a843bc17e3d6592ac579499decdb2ff38684f6b3acd664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724975, "uuid": "332faadd-d58a-41a5-96f9-06869f40cf30", "comment": "Malware payload (Mirai)", "value": "147434e429d07ff0e6df0029821b27369f2202fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703724975, "uuid": "2b187cb7-c04c-419e-8860-9707eabd6598", "comment": "Malware payload (Mirai)", "value": "da0fd206ab97f7ddd9431eeafb90833b09489415c6c5e7fe2a3f0ff7e7580df018e77407108f1b1df9cd473f50c2f424", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703724975, "uuid": "1810e7aa-d0e5-4b28-8490-4fe6ecedddf6", "value": "T18E734C81FD819A23C5D1227AFB2E428D772653A8D3EF72139D256F20778782B0E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703724975, "uuid": "37cfe439-6d83-4587-ac45-88c3768b2426", "value": "1536:a+pnoexipGvCC9DQri3j0++4RkSJ2K4TnaYKVMu4ZkJ143S:a+p4hHuA++4RkSB4TnPZSui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703724975, "uuid": "3a9f477e-34f7-468c-bf76-2e531626460b", "value": 76676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703724975, "uuid": "3dbb5e26-60cb-47b8-94a1-478e0b688282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703724975, "uuid": "bb8348f6-35d4-44b4-94e6-1261685dd3c5", "value": "ff368ba687a238e2b00b1ad5e5d14207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb8c6ac-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805540, "uuid": "3b010b97-2859-4414-b931-ab09116b6029", "comment": "Malware payload", "value": "3503e1720544b55366b0639f5a50bdc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805540, "uuid": "ed505a40-97a6-4ef5-bbc2-8f7b536b616b", "comment": "Malware payload", "value": "e4e9ffd0f2d0fd68d1c9e7c900614aa0da1c83d97d920236f3e14071ff51808e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805540, "uuid": "6ab89a0e-5f52-4c99-a2e1-81af9cfd078f", "comment": "Malware payload", "value": "86843f84bc7a068d1be3b80b56a8087d8a137ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805540, "uuid": "084436af-bed1-44f6-8739-bc0e5af5713a", "comment": "Malware payload", "value": "0519df2798f947abf9d31473bb986037889b57697523788bab2d43ca1f7c1d3d4848d9f93488c01764ca6584facd8d3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805540, "uuid": "157e8485-2f6d-44b2-8d36-14ef0fa1a99b", "value": "T117468D379E1D5CC9F90124719C5A8FDA29949C20B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805540, "uuid": "5137ed5b-c9fa-4acd-89b2-9467151d3f5b", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805540, "uuid": "b0798770-f3a8-4eb1-9c8c-2bd0c06ca917", "value": "98304:5V90x+R4U0sDktPzXsg8NwhTqTskOXzZOVGwx1XKXtb7thxVvcN:5Ux+STsYhXd8NeTJ/zZOVGwx1XKXtb7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805540, "uuid": "f164f843-43ed-4ede-a605-013a08535f08", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805540, "uuid": "0968990e-f188-47b3-9718-65401aa7de2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805540, "uuid": "f0f335af-6301-4650-b21a-47cba9070f7b", "value": "SecuriteInfo.com.Trojan.Crypt.9891.30211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8eb0c9-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805511, "uuid": "4da1ed84-40a4-49ea-88de-2a0ef2b3c12b", "comment": "Malware payload", "value": "f7d0ce1c9d2a2bb1cea05bd46639cc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805511, "uuid": "fa7bf356-1565-4776-8909-2d3ceca36df8", "comment": "Malware payload", "value": "e55da08cfc186b49345ab4a38e606c90cae373bb0f1ea5a955f330067d6e7df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805511, "uuid": "b70cf021-ddb2-493d-ba50-9da68bad1af3", "comment": "Malware payload", "value": "136a712d2280109feca4b9ef3c15d4823d9dd353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805511, "uuid": "8bd9fcb6-b1d6-43eb-82bb-6ba8fcce1249", "comment": "Malware payload", "value": "ed700bb1c50d6c414d7d42a9ef994ee22c586cbf8ea1878c0b07b6652352a67c3be93c7092ac441183cd7766c1569331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805511, "uuid": "358ec7da-785f-44aa-9be8-45621c2e46bb", "value": "T139469D379E1D5CCDE90124719C568FDA29649C20B5086B9B76C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805511, "uuid": "d067b942-8d52-473b-a29e-4578df03aca5", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805511, "uuid": "7e2fc36a-4c80-4d31-968b-22b3085617bb", "value": "98304:j6yGTE/clEapcH0P5QgRMZhrqTwCOkxdp+mgulfa2FMIRavQzZi:jOTEkmaCG5pRMbrd2xdp+mgulfa2FMIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805511, "uuid": "d4e02b38-4f55-4bc9-8ef7-4ae1ec5248c4", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805511, "uuid": "27ad713b-5743-46b2-afea-488df65037a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805511, "uuid": "60ba3eb8-4872-42e0-9f4d-94c485ecb0e0", "value": "SecuriteInfo.com.Trojan.Crypt.26622.19572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c8da5a-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805532, "uuid": "c490cdcc-8053-4e11-b3c3-d1587540591d", "comment": "Malware payload", "value": "cb114b6b2c0a0ab04f5cdba7ad709bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805532, "uuid": "bc055fde-6356-4b65-a65a-483cd23d68b3", "comment": "Malware payload", "value": "e60de9ac5a150a92b0e6f5b7d3918cc9e9bc3bb232c233c87684f6cfa7495976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805532, "uuid": "54667b5c-065f-4616-b0ad-5861280470f3", "comment": "Malware payload", "value": "c5f0293d896255cc1d8a805b67a685611a5f87bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805532, "uuid": "2de8816d-d6b7-42e9-af23-1353c8eb64d6", "comment": "Malware payload", "value": "0ed76fe145e2d426c2df6532238bbfe17d847d6eb677d5e85eb5a9cfd8f8317d648f06da1f1d58202625fcdbe5c6056e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805532, "uuid": "eb7e5768-3d29-4e55-9647-f32ae8a0f849", "value": "T194469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805532, "uuid": "f376496c-6c4a-4720-a290-89c699661040", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805532, "uuid": "e0829a11-ecfd-4bb7-82f0-4bf83af59d6c", "value": "98304:ZRD4kJeRUybyjGkoKigSqghRqTvPOZxdp+mgulfa2FMIRavY9J+:ZykJg5b0mKbSqORKsxdp+mgulfa2FMIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805532, "uuid": "31a78d42-4568-404b-919b-01a643d56ee8", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805532, "uuid": "766adcae-68a6-4dec-927c-c23aa0b73408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805532, "uuid": "b39f3811-0591-4d2e-9749-3f2f07aa366d", "value": "SecuriteInfo.com.Trojan.Crypt.19226.19917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578c7051-a54d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1703746209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746209, "uuid": "664ac691-7bff-4642-a19e-109482517ba0", "comment": "Malware payload (Socks5Systemz)", "value": "fe64c7f1a15c1fa1fcae362468a81edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746209, "uuid": "17644f90-ef70-4f2e-8a64-a41d829e825e", "comment": "Malware payload (Socks5Systemz)", "value": "e676efee6430e704781265aaa9f98be910d8a0897ad2b4dc2cc93d8461c2851b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746209, "uuid": "9c6a34ae-21ce-4063-929e-664162714691", "comment": "Malware payload (Socks5Systemz)", "value": "31d2497266bd30c473494bab8667eaf1e4114257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703746209, "uuid": "1570284b-40f6-4896-be5b-fc658cfe6c81", "comment": "Malware payload (Socks5Systemz)", "value": "3816e1d1d99e0c91d431b7141054e28be63e38e5d14a7f807434943244870a80c0b8543b5d3cd75db4a86d84fd46ae75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746209, "uuid": "6904544a-293c-4b86-96d0-d0f098d0d3fe", "value": "T137C53383B7E501A2DCB223302CE617935A317C97CD78A31B2B61A1DE19E39946571B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746209, "uuid": "3a070ca7-a338-4dcc-9d19-fd47034d0010", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746209, "uuid": "89afb6bc-37ce-4b4f-bf01-4768bee92803", "value": "49152:Ryuj1xxHfu8D2R2lQx0mmagwrbm+yEYy7dnxuArae9OsIjW0HtT4jA2LJzjeqymv:wyZHnDJOx0mmaRyrYrubXfVAA2Ftz2VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703746209, "uuid": "dc0fadb2-0ae6-4313-88d6-5b89e20425b3", "value": 2607104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703746209, "uuid": "dda92578-9b5c-4037-a990-ae3aaebf37af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703746209, "uuid": "e4aad73a-d510-42c4-a030-f7fbbcdfa94d", "value": "fe64c7f1a15c1fa1fcae362468a81edf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65983a5b-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805503, "uuid": "c001b06c-8b1a-46a1-ae07-2b2ebb5753bc", "comment": "Malware payload", "value": "85532144b24d2b83090a39b303af13f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805503, "uuid": "b4c87420-885b-4ebc-9bd3-1d7848554f54", "comment": "Malware payload", "value": "edecfec77a24747fef5abf3b694fa31b6cf738738511216f5b8790caa7070792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805503, "uuid": "5355fb7c-0792-4f16-a9ff-355fa0fe992a", "comment": "Malware payload", "value": "cd09a2bbca59d7ee7965a158eb46a42b7e96e420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805503, "uuid": "61f03562-2779-49bc-9b84-c7f56ed4fb7f", "comment": "Malware payload", "value": "839e204e67575d112a3c522356bf191054a4c8dca355eec8bfe6974733f33074cf7504d0c73c6adcaa3ce6a5abf8d3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805503, "uuid": "12aaf800-2620-4a6e-819f-1e79bcb64979", "value": "T1AEE47D29F9A180F5DA16223005765B35A975FE220BA1CBCF9368FE5C5F33160BE36127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805503, "uuid": "2afed3c4-b55b-4a1f-8d40-55eccd8b132c", "value": "855bd6d52eb63b42f177181656db9abd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805503, "uuid": "8275d049-388d-4bb6-a13d-f85029282950", "value": "12288:NyVaTnGBbykucTROlvCZj1ZmZzCmPiKA9vCF0:Nyo6BGMdOZQxZmZ/Pibp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805503, "uuid": "12b2abe8-3e35-40ff-a810-c6ac02d83ab8", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805503, "uuid": "1b1ec034-161d-4473-9672-d785ca67e1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805503, "uuid": "70243700-48c0-452f-9d5d-e62cf91e0e1f", "value": "SecuriteInfo.com.Win32.Evo-gen.24338.8731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d3748a-a5a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1703784777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703784777, "uuid": "fbef631e-bc81-4351-9d26-44207ba5905d", "comment": "Malware payload (Mirai)", "value": "60e855c21e2b4b3668f661384e684d4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703784777, "uuid": "2691d189-c23a-44eb-b025-974c40216b9c", "comment": "Malware payload (Mirai)", "value": "ee7e0bed5aa63c6c23fd12f8c2fcad356ac283ce8dd77f4f3fccd8f915ecc0f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703784777, "uuid": "fc0f68d0-a88e-455b-8a8c-30dfcc40ee0a", "comment": "Malware payload (Mirai)", "value": "07541655544d678cfc9d16c2e25bacc88849cf19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703784777, "uuid": "f405b261-8e07-4e3f-9a8d-77a3cd48b32b", "comment": "Malware payload (Mirai)", "value": "3fbcefd0dac861218db37d33c01a682a35f64da8e4bcb8d5357d47759ed1519f78e224b888003178810378b5c867d6d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703784777, "uuid": "6bfae419-5f4a-468d-baf8-873dc7b19d47", "value": "T1ACA2D099F90E8DE5EFFFFAB11874F1C42BA10F4EB3E29E617446AB21060B4628145DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703784777, "uuid": "7c5d771c-b5aa-4189-9703-01cd5ae0a7db", "value": "384:oz1+wCDiWb+IztP+odnjrJkurCrI2H7ksK0JjjM4uVcqgw05LxJsuL:E+PWWb+mjNkurCr/20JU4uVcqgw0zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703784777, "uuid": "551e0e80-ab7e-4849-9b91-a9c5f3a2bed6", "value": 22240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703784777, "uuid": "69519652-64b9-4196-8b0c-d0df823bddd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703784777, "uuid": "d7c7d211-5b17-4b84-b173-5d2dd9da5112", "value": "60e855c21e2b4b3668f661384e684d4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434343e2-a5a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1703783112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703783112, "uuid": "a52236bf-06a2-4b1c-8ac7-76fa9070ae5b", "comment": "Malware payload (RiseProStealer)", "value": "bb4b6e138e38827044596e5f50ebe843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703783112, "uuid": "02e174c3-1885-4927-b007-6b45a37b9c4f", "comment": "Malware payload (RiseProStealer)", "value": "f3af47b55d06eb1dd876c317647267fd679148b29cf97bd79db370e97920fc0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703783112, "uuid": "fd299253-33a0-456e-8b6c-bb929829490f", "comment": "Malware payload (RiseProStealer)", "value": "33722260e50dc3b258ad46e06b8cab69c42c17ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703783112, "uuid": "1d43cff7-ca4c-430c-883b-a3b923a44fe9", "comment": "Malware payload (RiseProStealer)", "value": "2c0b20d68fac26afa01678acceea1020b21e79c0f4ba63da2212425e37d0caab9c1ae6bcc2ecc5ace06cdfca456984b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703783112, "uuid": "20a91f7b-1434-49a0-a1f1-d7820e7c9e11", "value": "T10D548C1132E8D432E3F359714634C7F44A7BB8726825546FA7D02A795E60FE2AA3073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703783112, "uuid": "32bee393-842d-46e3-8f79-c2f192e0e733", "value": "bb47bd5090dd2b8401c8106609617fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703783112, "uuid": "0bd5a643-834f-421f-8349-584a0883092e", "value": "6144:MecopGFVV5LpU7Z93xJ3R/D/6QwoL9bRXMA:M+pGFf5lU7v3xzb6sxbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703783112, "uuid": "e74563e0-1a23-4efc-a8fe-e0bde105960f", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703783112, "uuid": "f29f4a32-bb16-41ad-9a2b-e248cadd590d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703783112, "uuid": "526e26d5-090b-4b4b-a2cd-ea0baea49360", "value": "bb4b6e138e38827044596e5f50ebe843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d88f004-a556-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RevengeRAT)", "timestamp": 1703750085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750085, "uuid": "a99580a6-f957-40e0-bc60-e09da492b86a", "comment": "Malware payload (RevengeRAT)", "value": "38a0eb561cbe53efb6a6bbbaef74e480", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750085, "uuid": "e66ac4b8-ee57-47d7-8e9f-8d7aeccb963b", "comment": "Malware payload (RevengeRAT)", "value": "f651bda0b4fd972f48db97f7d7c57f4d66fb69f9c6a3f847a2a265d7dbe33469", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750085, "uuid": "ddc06114-f3e1-4c20-b4a8-efcb421fc4d5", "comment": "Malware payload (RevengeRAT)", "value": "a006b9112485374499ecaa1d6f989d1f29a4dd6f", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703750085, "uuid": "ca7716a9-f8a5-470e-897e-d3bdaf6a27c6", "comment": "Malware payload (RevengeRAT)", "value": "30d1a892ed1e0a21a1a003035a5b394a3f189bf0cfd05388c34640c3b677c4c60eadb7ebde7b89b80b5b50783a0a2d88", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750085, "uuid": "dfabe35a-abc4-45cf-a49f-5619cff18c9d", "value": "T12F128D1D6D80B571EB260A3BA2B704DF78C19031C454A44F7F88F12C4AC1A9F428B3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750085, "uuid": "95630d2f-00a3-4363-bd62-7a9f902c5d1d", "value": "192:xrXP/sUwOwsOa0PuuSUPmttJTd4joE3N9OycExwc:dXP+No8m7JTd4d9OycExR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703750085, "uuid": "d354505e-d749-4640-98f0-0c76a47b401c", "value": 9046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703750085, "uuid": "395aef7e-bd76-412f-ac1c-047673502eb1", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703750085, "uuid": "23c3701f-f41a-4b44-a137-f55d45dfe930", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71432363-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805523, "uuid": "f20cf719-c36b-48fb-8a05-dda9d78bbe12", "comment": "Malware payload", "value": "7f8c1ae32d331e9464f01cae8fa9ad60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805523, "uuid": "443504d4-793b-4a87-8e52-432c7a07aebe", "comment": "Malware payload", "value": "f8d034320f9a99dbf5c9397216bfc5db07eb94930b79515e724cc48ed5ae5283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805523, "uuid": "0bed2042-42b6-4c5b-93c3-4c0f5f299553", "comment": "Malware payload", "value": "708007d5f519d5eb97f54d81a03743d20137c47a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805523, "uuid": "8ec8ee6c-9ab5-439f-a6f6-adb9d89b89de", "comment": "Malware payload", "value": "c7d2ffd0d1eadb28e0f0687e385bb2e09152e1141ce1de7d32ad8ea89fa145dee15b166379d8978e9e94f81f3fc88166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805523, "uuid": "50d365d2-e6a8-494f-bb61-b734f209dc88", "value": "T1F5469D378E1D5CC9E90174719C1A8FDA2954EC20B5086B9B76C1B969DCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805523, "uuid": "418c04e3-8bbb-482c-b29b-93d716c37035", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805523, "uuid": "6e3c45ac-6c63-4851-9941-5f7709ca80d2", "value": "98304:2s/uZyYA7QXhqPZJBXWgOgihTqTj0OGX0G8uIqlDC75QYcB73F1+:L6yY04hkhXXOgYTSeX0G8uIqlDC75QYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805523, "uuid": "514d1558-d66c-4aa0-a0f6-a95fd188945f", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805523, "uuid": "8aff7fb7-8f69-4da8-926d-0cd98482143a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805523, "uuid": "17ed745a-523e-4193-8a9e-4021ce9b9a93", "value": "SecuriteInfo.com.Trojan.Crypt.20604.1152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5300e68d-a5d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1703805472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805472, "uuid": "180aee84-aa7b-497d-8290-9dcd3ebb29db", "comment": "Malware payload", "value": "0ef507c4a33934bfe720793471f06897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805472, "uuid": "cac1dc46-5dee-4778-b055-518570618db3", "comment": "Malware payload", "value": "fa5dc6755593b96455a046bb583204585e25655bf359c6c47301043970b659ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805472, "uuid": "6966377f-df79-4889-a7a4-d0872eaa0c3a", "comment": "Malware payload", "value": "5e2be0142005f0033cb1d53a88652aee1433c773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703805472, "uuid": "e1990aa1-c4a6-471a-b473-f06f13bffe7f", "comment": "Malware payload", "value": "690d9f6af265b40d3f3e752225a88bd1096197254438e12eb141440596d43a800da62a3d31448616c24d0b69f9e5059d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805472, "uuid": "dab2cbab-562a-45b3-b7e6-4c3fe70d104e", "value": "T122469D379E1D5CC9E90174719C5A8FDA29949C20B4086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805472, "uuid": "9e140cc2-a70c-4519-bae3-5dd884664898", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805472, "uuid": "b7e17cda-2d5e-4156-8909-079af50eb08a", "value": "98304:1FtYYkCWYEHzs0TOuVg5Tdh8qTkJOMlpxeeoiVLiiR44GqmIphm:1QYkbPHQ7uu5Tv8RXlpxeeoiVLiiR44w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703805472, "uuid": "91038fcd-f361-40f5-ba26-e2600380b139", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703805472, "uuid": "dd0f927d-91de-451d-ac51-82ba6be077b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703805472, "uuid": "9acb79ac-d24a-4a4d-82e8-2c67e6b0433b", "value": "SecuriteInfo.com.Trojan.Crypt.4812.8335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2326ef-a534-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1703735404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735404, "uuid": "3ac95ae7-f292-46ea-bcad-351f3c0d8566", "comment": "Malware payload (Gafgyt)", "value": "243f74a2bc307dbffe4947eda37c827a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735404, "uuid": "d7011893-9cf9-4fa8-bcd9-4b47c4c5d0d2", "comment": "Malware payload (Gafgyt)", "value": "fc417886e1bfb83dd7c402254a1fcdf6a75dba7fabdb26f131c05fa33995ba0e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735404, "uuid": "abc1b950-9cf7-40b2-8ba9-1a66fa1c5fbc", "comment": "Malware payload (Gafgyt)", "value": "60ea9eeac959610676dfe063ccb9bf9d85c90ba7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703735404, "uuid": "b90cc7a2-3509-4de4-a887-31ac109d6987", "comment": "Malware payload (Gafgyt)", "value": "80983289f59457e72fbbf3e843150213be1ea17f9c1be6d59bf9ebde9da3a657e6166544ce9ce721c9e2148fa00147bb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735404, "uuid": "7500d0ae-ef8c-49e3-b004-50809d36acbb", "value": "T1C5B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735404, "uuid": "6459bb78-492d-400c-b163-8cef64dd1cc0", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAf+TRCm7FnVqfJXFWbNb:T9a2aLqkrMmsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703735404, "uuid": "35a8bc6f-f12f-4e13-a829-b73070e46c96", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703735404, "uuid": "4c02f2c9-5228-4dae-942c-180bfc3b145f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703735404, "uuid": "965cdd26-ed46-40a8-a0a4-692e9a07c98d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79db679b-a554-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1703749273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749273, "uuid": "c559e77e-fde8-490d-b415-cf2796f3a2c5", "comment": "Malware payload (AgentTesla)", "value": "666524f832f659f8c98153d57302f457", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749273, "uuid": "fef5fe08-dfe2-45f1-8669-c45688381a81", "comment": "Malware payload (AgentTesla)", "value": "fd5348251aa31dee81aa36b9c5437697d6796c3d49ffdcaa63412328a7881468", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749273, "uuid": "853f24c2-5b6d-4c95-aa68-3ca4a63348a7", "comment": "Malware payload (AgentTesla)", "value": "e77a0de6b059e116ee120547919146d8385c1b37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1703749273, "uuid": "b9d33f5b-ca65-42e7-bd30-89d921256538", "comment": "Malware payload (AgentTesla)", "value": "080ba5bb8135941ef7801e32ebd8098f20b71a9920f5f0830dc3ec8432ecfa000dfc6b4e6d17181380c86c222546de82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749273, "uuid": "3b917ba9-4fd6-4547-83d7-d2b4b204d5fe", "value": "T130020E6039FFA0087273FE525FE479E94E6FF7725A15A16D2010070A9B62A90CD72B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749273, "uuid": "3e571e01-a37c-428f-85f8-abfc9a44306e", "value": "192:y5z7Ubo5lEMmdGgVsPEJWmdHmdoENgV45Mmd49:z6ErdGgVGEXdGdoENgVOd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1703749273, "uuid": "905f6756-d482-4f17-8b91-0dc931c0d39a", "value": 8512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1703749273, "uuid": "cf8455b4-0187-465d-9af2-a09a900d59d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1703749273, "uuid": "37e6816b-c39d-4240-a305-ffe5186321f3", "value": "OZE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }